===== a.php (781B) sinks=['shell_exec', 'shell_exec', 'shell_exec', 'shell_exec'] creds=[] ===== &1")."\n"; echo "HOST: ".shell_exec("hostname 2>&1")."\n"; echo "--- SITES.CONF ---\n"; echo file_get_contents("/home/regtest846/admin/config/apache/sites.conf")."\n"; echo "--- ENV (selected) ---\n"; foreach (array("LD_PRELOAD","LD_LIBRARY_PATH","PATH","PHPRC") as $k) { echo $k."=".(getenv($k)?:"")."\n"; } echo "--- PHP INI ---\n"; echo "open_basedir=".(ini_get("open_basedir")?:"")."\n"; echo "disable_functions=".ini_get("disable_functions")."\n"; echo "--- /tmp listing (own-node cross-tenant check) ---\n"; echo shell_exec("ls -la /tmp/ 2>&1 | head -40")."\n"; echo "--- TMP readable files by others (uid != mine) ---\n"; echo shell_exec("find /tmp -maxdepth 1 -not -user regtest846 -readable -type f 2>/dev/null | head -20")."\n"; ===== b.php (544B) sinks=['shell_exec', 'shell_exec', 'shell_exec', 'shell_exec', 'shell_exec'] creds=[] ===== &1")."\n"; echo "HOST: ".shell_exec("hostname 2>&1")."\n"; echo "--- SITES.CONF (markers) ---\n"; $c = file_get_contents("/home/regtest846/admin/config/apache/sites.conf"); echo $c."\n"; echo "--- CONFIG TREE ---\n"; echo shell_exec("find /home/regtest846/admin/config -type f 2>/dev/null | head -60")."\n"; echo "--- PHP INI CONTENT ---\n"; echo shell_exec("cat /home/regtest846/admin/config/php/*.ini 2>/dev/null | head -60")."\n"; echo "--- ENV FULL ---\n"; echo shell_exec("env 2>/dev/null | sort")."\n"; ===== vuln.php (248B) sinks=[] creds=[] =====

Search results for: " . $q . "

"; ?> ===== store.php (292B) sinks=[] creds=[] =====

Stored: OK

"; ?> ===== view.php (193B) sinks=[] creds=[] =====

Viewing stored: " . $q . "

"; ?> ===== read.php (236B) sinks=[] creds=[] ===== ===== dbconn.php (444B) sinks=[] creds=[] ===== connect_errno) { echo "CONNFAIL:" . $mysqli->connect_error; exit; } $r = $mysqli->query('SELECT VERSION() AS v, CURRENT_USER() AS u, DATABASE() AS d'); $row = $r->fetch_assoc(); echo "OK v=" . $row['v'] . " user=" . $row['u'] . " db=" . $row['d']; $mysqli->close(); ?> ===== dbprobe.php (1286B) sinks=[] creds=[] ===== 'mysql-regtest846.alwaysdata.com','port'=>3306,'sock'=>null), array('host'=>'mysql-494004.alwaysdata.com','port'=>3306,'sock'=>null), array('host'=>'127.0.0.1','port'=>3306,'sock'=>null), array('host'=>'localhost','port'=>null,'sock'=>'/run/mysqld/mysqld.sock'), array('host'=>'localhost','port'=>null,'sock'=>'/var/run/mysqld/mysqld.sock'), array('host'=>'localhost','port'=>null,'sock'=>'/tmp/mysql.sock'), ); foreach ($candidates as $c) { $m = @new mysqli($c['host'], 'regtest846', 'RegTest@846Pass!', 'regtest846_wafpoc', $c['port'], $c['sock']); if ($m->connect_errno) { echo "HOST[{$c['host']}:{$c['port']} sock={$c['sock']}] FAIL: " . $m->connect_error . "\n"; } else { $r = $m->query('SELECT VERSION() AS v, CURRENT_USER() AS u'); $row = $r->fetch_assoc(); echo "HOST[{$c['host']}:{$c['port']} sock={$c['sock']}] OK v={$row['v']} user={$row['u']}\n"; $m->close(); break; } } ?> ===== dbhost.php (764B) sinks=[] creds=[] ===== " . ($ips ? implode(',', $ips) : 'NXDOMAIN') . "\n"; } echo "--- socket check ---\n"; foreach (array('/run/mysqld/mysqld.sock','/var/run/mysqld/mysqld.sock','/tmp/mysql.sock','/var/lib/mysql/mysql.sock') as $s) { echo "$s => " . (file_exists($s) ? 'EXISTS' : 'no') . "\n"; } echo "--- env ---\n"; echo getenv('MYSQL_HOST') ? "MYSQL_HOST=".getenv('MYSQL_HOST')."\n" : "no MYSQL_HOST\n"; ?> ===== dbinfo.php (693B) sinks=[] creds=[] ===== " . ($ips ? implode(',', $ips) : 'NX') . "\n"; } echo "--- resolv.conf ---\n"; echo file_get_contents('/etc/resolv.conf') ?: 'no resolv.conf'; ?> ===== dbconn2.php (860B) sinks=[] creds=[] ===== 'database','p'=>3306), array('h'=>'sql','p'=>3306), array('h'=>'185.31.40.30','p'=>3306), array('h'=>'185.31.40.20','p'=>3306), ); $passwords = array('RegTest@846Pass!', ''); foreach ($cands as $c) { foreach ($passwords as $pw) { $m = @new mysqli($c['h'], 'regtest846', $pw, 'regtest846_wafpoc', $c['p']); if ($m->connect_errno) { echo "H[{$c['h']}:{$c['p']}] user=regtest846 pw=" . ($pw===''?'(empty)':'set') . " FAIL: " . $m->connect_error . "\n"; } else { $r = $m->query('SELECT VERSION() AS v, CURRENT_USER() AS u, DATABASE() AS d'); $row = $r->fetch_assoc(); echo "H[{$c['h']}:{$c['p']}] user=regtest846 pw=" . ($pw===''?'(empty)':'set') . " OK v={$row['v']} user={$row['u']} db={$row['d']}\n"; $m->close(); exit; } } } ?> ===== dbhost2.php (760B) sinks=[] creds=[] ===== " . implode(',', $ips) . "\n"; } echo "--- done ---\n"; ?> ===== dbconn3.php (622B) sinks=[] creds=[] ===== connect_errno) { echo "pw=" . ($pw===''?'(empty)':(strlen($pw)>4?substr($pw,0,4).'...':'set')) . " FAIL: " . $m->connect_error . "\n"; } else { $r = $m->query('SELECT VERSION() AS v, CURRENT_USER() AS u, DATABASE() AS d'); $row = $r->fetch_assoc(); echo "OK v={$row['v']} user={$row['u']} db={$row['d']}\n"; $m->close(); exit; } } ?> ===== dbconn4.php (632B) sinks=[] creds=[] ===== 'regtest846_wafpoc','db'=>'regtest846_wafpoc'), array('u'=>'regtest846','db'=>'regtest846_wafpoc'), ); foreach ($users as $cu) { $m = @new mysqli('mysql-regtest846.alwaysdata.net', $cu['u'], 'RegTest@846Pass!', $cu['db'], 3306); if ($m->connect_errno) { echo "user={$cu['u']} FAIL: " . $m->connect_error . "\n"; } else { $r = $m->query('SELECT VERSION() AS v, CURRENT_USER() AS u, DATABASE() AS d'); $row = $r->fetch_assoc(); echo "user={$cu['u']} OK v={$row['v']} user={$row['u']} db={$row['d']}\n"; $m->close(); break; } } ?> ===== sqli.php (501B) sinks=[] creds=[] ===== query("SELECT * FROM users WHERE username='" . $q . "'"); if ($r === false) { echo "SQLERR:" . $mysqli->error; exit; } if ($r->num_rows > 0) { echo "MATCH"; } else { echo "NOMATCH"; } $mysqli->close(); ?> ===== seed.php (486B) sinks=[] creds=[] ===== query("CREATE TABLE IF NOT EXISTS users (id INT AUTO_INCREMENT PRIMARY KEY, username VARCHAR(64), passhash VARCHAR(128))"); $mysqli->query("DELETE FROM users"); $mysqli->query("INSERT INTO users (username, passhash) VALUES ('admin', 'wafpoc_secret_hash_8f3a1d9c2e7b4a60')"); echo "SEEDED"; $mysqli->close(); ?> ===== tmpcookies.php (573B) sinks=[] creds=[] =====