WooYun.org

<init-param>
			<param-name>excludes</param-name> 
			<param-value>myLeavemessage.action,seatknowledgeList.action,newWorksheetmanager.action,getQueueUser.action,seatnotebooklist.action,qualityGradeList.action,seatBlackerList.action,getchatsessionlist.action,seatContractMessageList.action,getUserList.action,tradesys-chatsessionstat.jsp,customerInfo.jsp,consultantInfo.jsp,webcall/knoLibIframe.jsp,webcall/ucstarVisitorStatueData.jsp,blackerSave.action,newBlackerSave.action,webcall_chat/addblacker.jsp,webcall/messageRoleMenuView2.jsp,seatListSelect.jsp,webcall/worksheetAdd.jsp,webcall/messageNoteAdd.jsp,webcall/messageNoteAdd.jsp,login_bysso.jsp,queryusername.action,userregisterforclient.jsp,clientGroupmessagerList.action,panel/,randImages.jsp,softphone/,result,ssoOaUserConfig,ssoOaUserList,mypanel-showurl.jsp,test.jsp,test1.jsp,sso-,plugins/gateway/gateway-rtx-autocreate.jsp,login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-,.gif,.png,error-serverdown.jsp,client_showaffiche.action,client_affiche.action,client_affiche_list.action,client_affiche_scroll.action,client_affiche_grade.action,saveAfficheofcleint.action,issuedaffichesuccess.jsp,client_subscriber.action,client-subscribersave.action,subscriber_success.jsp,client-subscribersave.action,client-subscriberupdatesave.action,client_subscriberupdate.action,client_subscriberdelete.action,client-subscriberadd.action,client_mail.jsp,client_systemaffiche_scroll.action,clientaffichesystemscroll.jsp,client-systemaffiche-list.action,client_issueaffiche.action,client-deleteAffiche.action,client-editAffiche.action,client-updateAffiche.action,plugins/gateway/gateway-client-registrations.jsp,exportmessagetofile.jsp,plugins/gateway/gateway-checker.jsp,plugins/gateway/gateway-client-registrationsadd.jsp,plugins/gateway/gateway-client-editregistrations.jsp,clientregister.action,register_sucess.jsp,ipphoneList.action,bbsdiscuss/dhtreeForums.jsp,js_list_nodes.jsp,grouptreehome-inner.jsp,bindgroup-index-inner.jsp,gjpanel-showurl.jsp,clientBindGroupAffEdit.jsp,clientBindGroupAffDelete.jsp,clientAfficheShow.jsp,plugins/sms/sms-limit-user-ajaxset.jsp,share_own.jsp,mypanel-redirect.jsp,panelextends-registertairan.jsp,plugins/sms/sms-user-config.jsp,zk/show_personalsch.zul,zk/show_commonsch.zul,zk/show_notice.zul,zk/sch_personal.zul,zk/sch_common.zul,zk/sch_notice.zul,user-email-edit.jsp,outlinker-export.jsp,outlinker-loadexport.jsp,outlinerload.action,outlinerload_star.action,user-register.jsp,user-register.action,zkau1,worksheetmanager.action,webcall_chat/knowledgeSearchTreeData.jsp,webcall_chat/knowledgeSearchData.jsp,webcall_chat/knowledgeSearchData.jsp,webcall_chat/knowledge-search.jsp,webcall_chat/newContractMessageList.action,webcall_chat/notebooklist.action,webcall_chat/newknowledgeList.action,webcall_chat/newBlackerList.action,webcall_chat/leaveMessage.jsp,webcall_chat/knowledge-search.jsp,webcall_chat/newVisitorManagerSeat.jsp,getQueueUser.action,/WEB-INF/ucstar/user/bindgroupuser.html,schedulemsgdelete.action,hint/hint_client_show.jsp,system-message-schedule-client.jsp,share_own.jsp,schedulemsglist.action,hint_client_show.jsp,hint/hint_client_show.jsp,offlineBroadcastList.jsp,chatsessionmsgMiniList.action,chatsession_messageview_minilist.jsp,service_tousu.jsp,xinda_clientchatwinmarquee.jsp,web-client-updatepwd.jsp,userinfo.jsp,userinfo-basic.jsp,userinfo-contact.jsp,userinfo-detail.jsp,ucstarVisitorStatueMain.jsp,emp-detail-info-customershow.jsp,xinda_mymanager.jsp,changepassword.jsp,xinda_onlinebusinesshall.jsp,xinda_clientsso.jsp,xinda_call.jsp,xinda_crmsys.jsp,xinda_ssologin.jsp,emp-detail-info.jsp,clientaffiche_manager.jsp,blank.jsp,clientaffichesystemscroll2.jsp,client_systemaffiche_scroll.action,tradesys-share.jsp,tradesys-fund.jsp,userclient-card.jsp,analysis_huaxi.action,logincms.jsp,schedulemsglistclient.action,shedulemsg_list_client.jsp,updateuser.action,selectgroupbysession.jsp,ace-select-radio-groups.jsp,selectuserbysession.jsp,system-message-schedule-client.jsp,user-basic-info.jsp,user-contace-info.jsp,user-detail-info.jsp,user-basic-info-emp.jsp,user-contact-info-emp.jsp,user-detail-info-emp.jsp,toedituserbasepage.action,toeditusercontactpage.action,toedituserdetailpage.action,toedituserbasepageemp.action,toeditusercontactpageemp.action,toedituserdetailpageemp.action,tradesys-latencycustomer-list.jsp,tradesys-latencycustomer-create.jsp,latencycustomeredit.action,latencycustomerdelete.action,latencycustomersaveorupdate.action,service_vote.jsp,webcall_chat/contractMessageSave.action,webcall_chat/sendSuccess.jsp,webcall_chat/sendError.jsp,webcall/messageRoleMenuViewBigtree.jsp,mainSeat.action,ucstarMessage-list-new.jsp,ucstarMessageReceiptMain.jsp,vcstar_sg/,refuseReasonSelect.action,webcall/authIdentity.jsp,webcall/surveyView.jsp,answerCollect.action,webcall_chat/leaveSystemMessage.jsp,knowledgefaqsearch.action,knowledgefaqcontent.action,webcall_chat/knowledgeFAQsearch.jsp,webcall_chat/knowledgeFAQContent.jsp,webcall_chat/knowledgeFAQ.jsp,webcall_chat/knowledgefaqmanager.jsp,webcall/modifyPassword.jsp,webcall_chat/paomadeng.jsp,loginManager.jsp</param-value>
			</init-param>

http://x.x.x.x/seatListSelect.jsp                  查看ucstar所有用户
http://x.x.x.x/ucstarMessage-list-new.jsp  查看UCstar所有用户聊天记录
http://x.x.x.x/webcall/messageNoteAdd.jsp

http://x.x.x.x/client-editAffiche.action   
http://x.x.x.x/FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector   任意后缀上传，jsp马访问时会进行跳转首页，但可以解析jspx后缀的木马。