JIRA allows you to define quite flexible workflows with lots of configuration options but when working on a JIRA development project it becomes really hard to keep track of things. 

The Need and the Goal

Most of the time, JIRA customization is a project all by itself which includes analyzing customer processes (which by the way can be internal business units or external customers), designing and developing JIRA workflows to realize those processes. These projects include not only JIRA configuration but also groovy script development or even Java development. 

From a practicality point of view, it is hard to see all things in JIRA workflows. JIRA UI shows you workflow steps, transitions, screens, conditions, validations, post-functions in separate windows or tabs. There is not a single unified user interface page that shows all details of a workflow with detail. This makes comprehension of an existing workflow very hard. 

On the other hand we have a similar need while analyzing and designing the workflows. How do you document the workflow? What do you show the customer to agree on? What do you give your team to implement? How can you collect all details on a single sheet of paper so everybody can easily see all of it. 

These questions do not have perfect answers but in this blog post I tried to summarize the technique we use at OBSS to for designing and documenting JIRA workflows. The document format explained below is merely a proposition for a starting point but I must say it did well so far, even in projects with 30+ workflows. 

Please note that this document format is to configure a workflow on JIRA, it does not aim at documenting your business processes. (This document might reference your business process documents if you have them tough) 

 

The Document

Each workflow is documented using only Confluence and Gliffy, on a single Confluence page. The main goal of the document, as mentioned above, is to build a single point to see all details of the workflow which will act as an analysis and technical design document along the way. (You can find the complete document W1_SampleRequestWorkflow.pdf)

First, the name of the workflow

As you see, the document starts with the workflow name. The name is anything you want but it should better be the name of the workflow you will use in JIRA so you can find it easily both ways. The name should be in "Wx_<workflow_name>" format. For example: W1_SampleRequestWorkflow. Giving a number to any work product is a good practice and it sure pays off here as well. (We will name our custom developments or SLA definitions as sub items of this number later)

Purpose

The statement of the purpose of the workflow from a business perspective. What does this workflow do? What will it accomplish? Something like: "This workflow will be used to track user requests from inception to the point where the request it complete. Workflow covers manager approvals of both business and IT."  

Workflow

After that comes the workflow itself drawn in Gliffy. 

 

  

 

The small circle marks the beginning of the workflow. Each box is a different status and each connecting line is a transition. (So arrows have directions). Each status has an associated number code and we will reference statuses later by their numbers. Each transition has a name but does not have a number. Each transition has a name because that name will also be shown on the transition button on the view screen; but does not have a number because we will reference transitions by the numbers of statuses they originate from and go to.

You may also add swimlanes to the the diagram to visually define participants of the workflow but that is optional because it might make sense for one workflow but might not for another.  

Workflow Table

Below the workflow is the workflow table. The table includes all details that are needed to configure this workflow and each row in the table represents one transition.

 

  

The first column is the transition code which is created by combining the numbers of the statuses the transition originates from and goes to. For example: A transition from 1:Open to 2:In Progress is coded 1-2. (There might be more than 1 transition from one status to the next. In that case transition should be named like 1-2a, 1-2b, etc.)

The second column is Transition Name and naturally shows the name of the transition. The value in this column is the same with the text on transition line on the diagram and this text will be shown on the workflow transition button of the issue.

The next two columns are From and To columns. They show the origin and the destination statuses of the workflow.

The next two are Condition and Validation columns.

The next one is the Fields column and it shows the names of fields and field types that will be asked on the transition screen. For "select list" fields, the options of the field is given when the field is appears in the table for the first time. (See field Request Type on create transition). Required fields are checked with validators most of the time but they are shown in the fields column as well because this notation increases readability. (See comment field on transition 1-5)

Next comes the Post-Functions column. This column shows the post-functions added by us, not the default ones added by JIRA because default ones are … well … defaults. There is no point in showing them.

And finally is the Notes column which is empty most of the time but if you want to add notes for that transition for some reason, that is the place.

 

There are some remarks to be made here:

First, some columns in the table (namely Transition Name, From and To columns) actually duplicate the information already shown in the diagram. We could well get away with just showing the transition code but that destroys readability. If you do that, you can not read any row in the table without going back and forth to the flow diagram. So, better keep those columns. On the other hand we could try to load all information on the table to the diagram but that also has a few drawbacks. First off all at some point you will probably discuss this workflow with the customer and the more detail there is on the diagram harder for the non-IT user to understand. Second, diagrams can not be compared but Confluence page text can be. The workflow design will go through many changes thoughout its lifetime and at every design change, the admin will need to see what was changed and implement it to the workflow. You can not compare changes on a Gliffy diagram but sure you can compare Confluence pages.

Another point: The same field might be used on a number of transitions on the workflow or even across different workflows. So why not create a separate Fields page (to serve all workflows) with field types, options, etc and reference those fields here? Or create a separate "Screens" page that defines the screens so we can reference them here. Actually we tried that and found it to be very slow and much less productive. It becomes very hard to create and maintain the document so we decided it is better to show it in the Fields column.The configuration expert knows the basics of screen reusability so does it the best way he/she can.

And finally, any custom development that will be implemented via Groovy scripts or Java development is referenced here with a "blah blah (Custom Dev Wx.y )" reference. More on that below.

Edit and View Screens

Two lists of fields that will take place in Edit and View screens are given in the tabs and the order they will appear on the screen. There is no Create screen here because the fields column of the first row in the workflow table acts as the create screen definition.

   

Custom Developments

There might be many features in your workflow that will be implemented via Groovy scripts of Java development. Things can not be done with conventional JIRA configurations. These developments are listed here with a four column table.

 

The first column is the code which is something like "Custom Dev Wx.y" where x is the number of the workflow and y is the index number of the custom development. The second is the type of development, which most likely has a value like Groovy of Java. Third is the Title of the development and fourth is the detailed description of the development. (If it is too large of a development and needs a detailed analysis document, you might choose to prepare a separate page for that analysis somewhere else and just reference it here)

Most Custom Dev's should have a reference in the workflow table but that is not a must. You might implement some certain features completely outside the workflow configuration but might consider it to be related to this workflow somehow so show it here. A nightly running background service that closes all inactive issues might be a good example.

And finally, if you have similar custom development items or maybe identical custom developments that run with different parameters (even across different workflows) show them here as separate rows and reference one another in the description. This way you can see how many development items there are for this workflow and the developer can also see what other development to look for existing codes.

SLAs

This section is used if you use JIRA Service Desk. Once again a table. This time with 8 columns:

 

  

The first column is the SLA code and is like SLA Wx.y . X is the number of the workflow and y is once again the index number of the SLA timer. The second column is the name of the timer (which will also appear on the issue view screen and reports) Next 3 columns are start, pause and stop statuses respectively. The next column is the definition JQL. The final two columns are the target time and calendar. Please note that the first five columns are for defining the metric and the last three are repeated for each target.

 

This is all there is for the configuration document. This amount of information prety much sums up what a JIRA admin will need to configure the document.

For a scope with multiple workflows it would be beneficial to summarize the projects and issue types in a higher level table. (Most likely on a different page)

Lifecycle of Document

Your JIRA project will go through different stages and this document will serve many purposes along the way. At the analysis phase it will serve as a document to see the complete workflow and act as a workdesk to work on with the customer. At the end of analysis it will act as the foundation of your agreement with the customer. During implementation it will let your team see the whole workflow together and will let you make impact analysis for change requests from a single point. Also it will grow during implementation with more and more technical design decisions and implementation details. At this point you might want to take a copy of your page so keep the original page as "agreed analysis" and the latter to improve with technical details.

Challenges

The document is simple and easy to prepare but …

Customers (especially non-IT minds) might find it difficult to understand the document. The document itelf mostly does not contain anything technical but the existance of the workflow table and terms like Conditions, Validators, Post-Functions make it look more like a technical design document. This might cause some resistance from some customers. In this case you can add a new section to the document that summarizes the workflow in a few paragraph of text with a daily use language.

Conclusion

This format serves as a good starting point for any analysis and design need. It serves as an analysis document in the beginning, then a design document during the project and then a reference document for later but since no two projects are the same, it will always change for the needs of your specific project. As I said earlier, this is what we start with at OBSS and it has done pretty well so far. Hope you benefit from it too.

 

Emre TOPTANCI

OBSS Atlassian Team Lead

  • No labels

491 Comments

  1. Anonymous

  2. Anonymous

  3. Anonymous

  4. Anonymous

  5. Anonymous

  6. Anonymous

  7. Anonymous

  8. Anonymous

  9. Anonymous

  10. Anonymous

  11. Anonymous

  12. Anonymous

  13. Anonymous

  14. Anonymous

  15. Anonymous

  16. Anonymous

  17. Anonymous

  18. Anonymous

  19. Anonymous

  20. Anonymous

  21. Anonymous

  22. Anonymous

  23. Anonymous

  24. Anonymous

  25. Anonymous

  26. Anonymous

  27. Anonymous

  28. Anonymous

  29. Anonymous

  30. Anonymous

  31. Anonymous

    -1 OR 1=1
  32. Anonymous

    -1 OR 1=1
  33. Anonymous

  34. Anonymous

  35. Anonymous

  36. Anonymous

    ' OR '1'='1
  37. Anonymous

    ' OR '1'='1
  38. Anonymous

  39. Anonymous

  40. Anonymous

  41. Anonymous

  42. Anonymous

  43. Anonymous

  44. Anonymous

  45. Anonymous

  46. Anonymous

  47. Anonymous

  48. Anonymous

  49. Anonymous

  50. Anonymous

  51. Anonymous

  52. Anonymous

  53. Anonymous

  54. Anonymous

  55. Anonymous

  56. Anonymous

  57. Anonymous

  58. Anonymous

  59. Anonymous

  60. Anonymous

  61. Anonymous

  62. Anonymous

  63. Anonymous

  64. Anonymous

  65. Anonymous

  66. Anonymous

  67. Anonymous

  68. Anonymous

  69. Anonymous

  70. Anonymous

  71. Anonymous

  72. Anonymous

  73. Anonymous

  74. Anonymous

  75. Anonymous

  76. Anonymous

  77. Anonymous

  78. Anonymous

  79. Anonymous

  80. Anonymous

  81. Anonymous

  82. Anonymous

  83. Anonymous

  84. Anonymous

  85. Anonymous

  86. Anonymous

  87. Anonymous

  88. Anonymous

  89. Anonymous

  90. Anonymous

  91. Anonymous

  92. Anonymous

  93. Anonymous

  94. Anonymous

  95. Anonymous

  96. Anonymous

  97. Anonymous

  98. Anonymous

  99. Anonymous

  100. Anonymous

  101. Anonymous

  102. Anonymous

  103. Anonymous

  104. Anonymous

  105. Anonymous

  106. Anonymous

  107. Anonymous

  108. Anonymous

  109. Anonymous

  110. Anonymous

  111. Anonymous

  112. Anonymous

  113. Anonymous

  114. Anonymous

  115. Anonymous

  116. Anonymous

  117. Anonymous

  118. Anonymous

  119. Anonymous

  120. Anonymous

  121. Anonymous

  122. Anonymous

  123. Anonymous

  124. Anonymous

  125. Anonymous

  126. Anonymous

  127. Anonymous

  128. Anonymous

  129. Anonymous

  130. Anonymous

  131. Anonymous

  132. Anonymous

  133. Anonymous

  134. Anonymous

  135. Anonymous

  136. Anonymous

  137. Anonymous

  138. Anonymous

  139. Anonymous

  140. Anonymous

  141. Anonymous

  142. Anonymous

  143. Anonymous

  144. Anonymous

  145. Anonymous

  146. Anonymous

  147. Anonymous

  148. Anonymous

  149. Anonymous

  150. Anonymous

  151. Anonymous

  152. Anonymous

  153. Anonymous

  154. Anonymous

  155. Anonymous

  156. Anonymous

  157. Anonymous

  158. Anonymous

  159. Anonymous

  160. Anonymous

  161. Anonymous

  162. Anonymous

  163. Anonymous

  164. Anonymous

  165. Anonymous

    "& ping -n 25 127.0.0.1 &
  166. Anonymous

  167. Anonymous

  168. Anonymous

  169. Anonymous

    '& ping -n 25 127.0.0.1 &
  170. Anonymous

  171. Anonymous

  172. Anonymous

  173. Anonymous

    & ping -n 25 127.0.0.1 &
  174. Anonymous

  175. Anonymous

  176. Anonymous

  177. Anonymous

    "& SET /A 0xFFF9999-2 &
  178. Anonymous

    ping -n 25 127.0.0.1 &
  179. Anonymous

  180. Anonymous

    (select convert(int,cast(0x5f21403264696c656d6d61 as varchar(8000))) from syscolumns)
  181. Anonymous

    '& SET /A 0xFFF9999-2 &
  182. Anonymous

  183. Anonymous

    "&ping -c 25 127.0.0.1 &"
  184. Anonymous

  185. Anonymous

    '+ (select convert(int, cast(0x5f21403264696c656d6d61 as varchar(8000))) from syscolumns) +'
  186. Anonymous

    & SET /A 0xFFF9999-2 &
  187. Anonymous

  188. Anonymous

    '&ping -c 25 127.0.0.1 &'
  189. Anonymous

    convert(int, cast(0x5f21403264696c656d6d61 as varchar(8000)))
  190. Anonymous

  191. Anonymous

    SET /A 0xFFF9999-2 &
  192. Anonymous

  193. Anonymous

    &ping -c 25 127.0.0.1 &
  194. Anonymous

    '+convert(int, cast(0x5f21403264696c656d6d61 as varchar(8000)))+'
  195. Anonymous

  196. Anonymous

    "&expr 268409241 - 2 &"
  197. Anonymous

    ping -c 25 127.0.0.1 &
  198. Anonymous

  199. Anonymous

    'AND 1=cast(0x5f21403264696c656d6d61 as varchar(8000)) or '1'='
  200. Anonymous

  201. Anonymous

    '&expr 268409241 - 2 &'
  202. Anonymous

    ping -n 25 127.0.0.1
  203. Anonymous

  204. Anonymous

    -1 or 1=1 and (SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)
  205. Anonymous

    &expr 268409241 - 2 &
  206. Anonymous

  207. Anonymous

    ping -c 25 127.0.0.1
  208. Anonymous

  209. Anonymous

    -1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
  210. Anonymous

    expr 268409241 - 2 &
  211. Anonymous

  212. Anonymous

    -1" and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+"
  213. Anonymous

  214. Anonymous

    SET /A 0xFFF9999-2
  215. Anonymous

  216. Anonymous

    (SELECT CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97)))
  217. Anonymous

  218. Anonymous

    expr 268409241 - 2
  219. Anonymous

  220. Anonymous

  221. Anonymous

  222. Anonymous

  223. Anonymous

  224. Anonymous

    '+NSFTW+'
  225. Anonymous

  226. Anonymous

  227. Anonymous

    (SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)
  228. Anonymous

  229. Anonymous

  230. Anonymous

    -1'+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
  231. Anonymous

  232. Anonymous

  233. Anonymous

    -1\'+(select 1 and row(1,1)>(select count(*),concat(CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97)),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))-- 1
  234. Anonymous

  235. Anonymous

    1 procedure analyse(extractvalue(rand(),concat(0x3a,CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97)))),1)-- 1
  236. Anonymous

  237. Anonymous

  238. Anonymous

  239. Anonymous

  240. Anonymous

  241. Anonymous

  242. Anonymous

  243. Anonymous

  244. Anonymous

  245. Anonymous

    ' WAITFOR DELAY '0:0:25'--
  246. Anonymous

  247. Anonymous

  248. Anonymous

    1 WAITFOR DELAY '0:0:25'--
  249. Anonymous

  250. Anonymous

    WAITFOR DELAY '0:0:25'--
  251. Anonymous

  252. Anonymous

  253. Anonymous

    1) WAITFOR DELAY '0:0:25'--
  254. Anonymous

  255. Anonymous

  256. Anonymous

    ') WAITFOR DELAY '0:0:25'--
  257. Anonymous

  258. Anonymous

    ')) WAITFOR DELAY '0:0:25'--
  259. Anonymous

  260. Anonymous

  261. Anonymous

  262. Anonymous

    1)) WAITFOR DELAY '0:0:25'--
  263. Anonymous

  264. Anonymous

  265. Anonymous

    1));DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(50)+char(53);WAITFOR/**/DELAY/**/@x--
  266. Anonymous

  267. Anonymous

  268. Anonymous

    1;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(50)+char(53);WAITFOR/**/DELAY/**/@x--
  269. Anonymous

  270. Anonymous

  271. Anonymous

  272. Anonymous

    1);DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(50)+char(53);WAITFOR/**/DELAY/**/@x--
  273. Anonymous

  274. Anonymous

  275. Anonymous

    syscolumns WHERE 2>3;DECLARE/**/@x/**/char(9);SET/**/@x=char(48)+char(58)+char(48)+char(58)+char(50)+char(53);WAITFOR/**/DELAY/**/@x--
  276. Anonymous

  277. Anonymous

  278. Anonymous

    -1 AND ((SELECT 1 FROM (SELECT 2)a WHERE 1=sleep(25)))-- 1
  279. Anonymous

  280. Anonymous

  281. Anonymous

    ((select sleep(25)))a-- 1
  282. Anonymous

  283. Anonymous

  284. Anonymous

    ((SELECT 1 FROM (SELECT SLEEP(25))A))
  285. Anonymous

  286. Anonymous

  287. Anonymous

    '+((SELECT 1 FROM (SELECT SLEEP(25))A))+'
  288. Anonymous

    -1' or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))+'
  289. Anonymous

  290. Anonymous

  291. Anonymous

  292. Anonymous

  293. Anonymous

    -1 or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))
  294. Anonymous

    hTTp://r87.com/n
  295. Anonymous

  296. Anonymous

    -1" or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))+"
  297. Anonymous

  298. Anonymous

  299. Anonymous

  300. Anonymous

    http://r87.com/n?.action
  301. Anonymous

  302. Anonymous

  303. Anonymous

  304. Anonymous

  305. Anonymous

    r87.com/n
  306. Anonymous

  307. Anonymous

  308. Anonymous

  309. Anonymous

  310. Anonymous

  311. Anonymous

  312. Anonymous

  313. Anonymous

  314. Anonymous

  315. Anonymous

  316. Anonymous

  317. Anonymous

  318. Anonymous

  319. Anonymous

    %27%22--%3E%3C%2Fstyle%3E%3C%2FscRipt%3E%3CscRipt%3Enetsparker%280x00A0BA%29%3C%2FscRipt%3E
  320. Anonymous

  321. Anonymous

    %27%22--%3E%3C%2Fstyle%3E%3C%2FscRipt%3E%3CscRipt%3Enetsparker%280x00A0BB%29%3C%2FscRipt%3E
  322. Anonymous

  323. Anonymous

  324. Anonymous

    data:;base64,JyI+PHNjcmlwdD5uZXRzcGFya2VyKDB4MDBBMEJDKTwvc2NyaXB0Pg==
  325. Anonymous

  326. Anonymous

  327. Anonymous

  328. Anonymous

    data:;base64,JyI+PHNjcmlwdD5uZXRzcGFya2VyKDB4MDBBMEJEKTwvc2NyaXB0Pg==
  329. Anonymous

  330. Anonymous

  331. Anonymous

    '" ns= netsparker(0x00A0BE)
  332. Anonymous

  333. Anonymous

  334. Anonymous

    '" ns= netsparker(0x00A0BF)
  335. Anonymous

  336. Anonymous

  337. Anonymous

  338. Anonymous

    ns:netsparker056650=vuln
  339. Anonymous

    1 ns=netsparker(0x00A0C0)
  340. Anonymous

  341. Anonymous

  342. Anonymous

    http://example.com/? ns: netsparker056650=vuln
  343. Anonymous

  344. Anonymous

    1 ns=netsparker(0x00A0C1)
  345. Anonymous

  346. Anonymous

  347. Anonymous

    ns:netsparker056650=vuln
  348. Anonymous

  349. Anonymous

  350. Anonymous

    //r87.com/n/n.css?0x00A0C2
  351. Anonymous

  352. Anonymous

    ns:netsparker056650=vuln
  353. Anonymous

  354. Anonymous

  355. Anonymous

    //r87.com/n/n.css?0x00A0C3
  356. Anonymous

  357. Anonymous

  358. Anonymous

  359. Anonymous

    //r87.com/n/j/?0x00A0C4
  360. Anonymous

  361. Anonymous

  362. Anonymous

  363. Anonymous

  364. Anonymous

  365. Anonymous

    //r87.com/n/j/?0x00A0C5
  366. Anonymous

  367. Anonymous

    ${28275*28275-(13)}
  368. Anonymous

  369. Anonymous

  370. Anonymous

  371. Anonymous

  372. Anonymous

  373. Anonymous

    #{28275*28275-(13)}
  374. Anonymous

  375. Anonymous

  376. Anonymous

  377. Anonymous

  378. Anonymous

  379. Anonymous

  380. Anonymous

    "||NETSPARKER||,
  381. Anonymous

  382. Anonymous

  383. Anonymous

  384. Anonymous

  385. Anonymous

  386. Anonymous

  387. Anonymous

  388. Anonymous

  389. Anonymous

  390. Anonymous

  391. Anonymous

    javascript:netsparker(0x00A0CA)
  392. Anonymous

  393. Anonymous

  394. Anonymous

  395. Anonymous

  396. Anonymous

    javascript:netsparker(0x00A0CB)
  397. Anonymous

    response.write(268409241-22)'
  398. Anonymous

  399. Anonymous

  400. Anonymous

  401. Anonymous

    +response.write(268409241-22)'
  402. Anonymous

  403. Anonymous

  404. Anonymous

  405. Anonymous

    "+response.write(268409241-22)+"
  406. Anonymous

  407. Anonymous

    <%a style=x:expre/**/ssion(netsparker(0x00A0CE))>
  408. Anonymous

    <% response.write(268409241-22) %>
  409. Anonymous

  410. Anonymous

  411. Anonymous

    print(int)0xFFF9999-22
  412. Anonymous

    <%a style=x:expre/**/ssion(netsparker(0x00A0CF))>
  413. Anonymous

  414. Anonymous

  415. Anonymous

    +print(int)0xFFF9999-22;//
  416. Anonymous

    n;ns:expression(netsparker(0x00A11A));
  417. Anonymous

  418. Anonymous

  419. Anonymous

    '+print(int)0xFFF9999-22+'
  420. Anonymous

    n;ns:expression(netsparker(0x00A11B));
  421. Anonymous

  422. Anonymous

  423. Anonymous

    "+print(int)0xFFF9999-22+"
  424. Anonymous

    body{x:expression(netsparker(0x00A152))}
  425. Anonymous

  426. Anonymous

    http://r87.com/?
  427. Anonymous

    body{x:expression(netsparker(0x00A153))}
  428. Anonymous

    {php}print(int)0xFFF9999-22;{/php}
  429. Anonymous

  430. Anonymous

    //r87.com/?
  431. Anonymous

    */netsparker(0x00A16C);/*
  432. Anonymous

    '{${print(int)0xFFF9999-22}}'
  433. Anonymous

    /../../../../../../../../../../boot.ini
  434. Anonymous

    http://r87.com/?
  435. Anonymous

    */netsparker(0x00A16D);/*
  436. Anonymous

    [php]print(int)0xFFF9999-22;[/php]
  437. Anonymous

    /../../../../../../../../../../web.config
  438. Anonymous

    '+netsparker(0x00A16E)+'
  439. Anonymous

    %2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fboot.ini
  440. Anonymous

    '+netsparker(0x00A16F)+'
  441. Anonymous

    /../../../../../../../../../../boot.ini
  442. Anonymous

    r87.com/?
  443. Anonymous

    "+netsparker(0x00A170)+"
  444. Anonymous

    file:/windows/win.ini
  445. Anonymous

    /\r87.com/?
  446. Anonymous

    "+netsparker(0x00A171)+"
  447. Anonymous

    file:/boot.ini
  448. Anonymous

    ///r87.com/?
  449. Anonymous

    \';netsparker(0x00A18C);///
  450. Anonymous

    /../../../../../../../../../../windows/win.ini
  451. Anonymous

  452. Anonymous

    \';netsparker(0x00A18D);///
  453. Anonymous

    c:\windows\win.ini
  454. Anonymous

    ',netsparker(0x00A1A0),'
  455. Anonymous

    c:\boot.ini
  456. Anonymous

    ',netsparker(0x00A1A1),'
  457. Anonymous

    /../../../../../../../../../../windows/iis6.log
  458. Anonymous

    netsparker(0x00A210)
  459. Anonymous

    /../../../../../../../../../../proc/self/fd/2
  460. Anonymous

    netsparker(0x00A211)
  461. Anonymous

    /../../../../../../../../../../etc/httpd/logs/error.log
  462. Anonymous

    netsparker(0x00A30C);
  463. Anonymous

    /../../../../../../../../../../etc/httpd/logs/error_log
  464. Anonymous

    netsparker(0x00A30D);
  465. Anonymous

    /../../../../../../../../../../var/log/apache2/error.log
  466. Anonymous

    '+netsparker(0x00A312)+'
  467. Anonymous

    /../../../../../../../../../../var/log/apache/error.log
  468. Anonymous

    '+netsparker(0x00A313)+'
  469. Anonymous

    /../../../../../../../../../../proc/version
  470. Anonymous

  471. Anonymous

    /../../../../../../../../../../../etc/passwd
  472. Anonymous

  473. Anonymous

    file:///etc/passwd
  474. Anonymous

    //r87.com/?0x00A32A
  475. Anonymous

    //r87.com/?0x00A32B
  476. Anonymous

    ....//....//....//....//....//....//....//....//....//....//....//etc/passwd
  477. Anonymous

    ....//....//....//....//....//....//....//....//....//....//....//windows\win.ini
  478. Anonymous

    %2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
  479. Anonymous

    ns../../../../../../../../../../../boot.ini.......................................................................................................................................................................................
  480. Anonymous

    /../../../../../../../../../../../etc/passwd
  481. Anonymous

  482. Anonymous

    /etc/passwd
  483. Anonymous

  484. Anonymous

    doaddcomment.action
  485. Anonymous

  486. Anonymous

    data:;base64,TlM3NzU0NTYxNDQ2NTc1
  487. Anonymous

    /confluence/pages/doaddcomment.action
  488. Anonymous

  489. Anonymous

    /pages/doaddcomment.action
  490. Anonymous

    file%3a%2fboot.ini
  491. Anonymous

    c%3a%5cboot.ini