Big List of Naughty Strings
Dev tools
test data
SHOW HN2015
514points
79comments
#20of 2,565 in 2015
Top 1%of 2015 by points
How HN took it
CuriousMostly questions and neutral comments
7 positive, 20 neutral or asking, 1 mixed, 10 critical, out of 38 comments about the project. Thread score -0.03.
Idea: 6 for, 4 againstExecution: 0 for, 6 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful resource for testing text handling
From 3 comments
Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it. I can think of a few more cases…
rspeer on HNThis should be really handy for fuzz testing, nice work!
rectangletangle on HNNice; sort of a programming complement to Shutterstock's _List of Dirty, Naughty, Obscene, and Otherwise Bad Words_[0]. So helpful to have a bunch of minds working on useful…
hoprocker on HN
Objections
Injection strings like DROP TABLE are dangerous to run in production
From 3 comments
" # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) /dev/null; rm -rf /*;…
jsat on HNLikewise: 1;DROP TABLE users 1'; DROP TABLE users-- Seems a bit hairy to have that in there in case someone tries to run these tests on their prod environment
cowls on HNIf I put this into my company's tests, we'd end up with no users... I have a lot of work ahead of me. :/
acehyzer on HN
Coverage of some categories is too thin
From 2 comments
Looks interesting, but the Script Injection, SQL Injection and Server Code Injection sections need a lot more samples to be remotely useful.
orf on HNIf you really intend this for use in testing, I'd suggest making the injections less nasty. I could easily see a junior dev slapping this in and deleting some important stuff.…
pbnjay on HN
Requests
Add more invalid UTF encodings and null bytes
From 2 comments
If you really intend this for use in testing, I'd suggest making the injections less nasty. I could easily see a junior dev slapping this in and deleting some important stuff.…
pbnjay on HNIs the scope just well-formed strings or would you consider adding binary nasties like null bytes, mal-encoded characters, or even just newlines on their own? What about XML…
jl6 on HN
Make injection strings less destructive
From 2 comments
Yeah, the other exploit strings do innocuous stuff like putting up javascript alerts or touching files, but the SQL injection ones aren't innocuous at all. I wonder if there's…
sanderjd on HNYeah, I would make the SQL injection and command injections test a little less kinetic =). Using a simple SELECT test, like SELECT @@VERSION, would be a little safer... Edit:…
efriese on HN
Questions
Which encoding the file uses
From 1 comment
It's not completely clear to me which encoding the blns.txt file uses. Since this project is all about weird/evil bytestrings, the encoding of the file itself is very important.…
simonw on HN
Alternatives named
FuzzDB and SecLists
From 2 comments
This is good. There are lots of lists like this; you might find additional strings to add to it here: https://code.google.com/p/fuzzdb/ Fuzz lists are to web pentesters what…
tptacek on HNAnother good list that incorporates FuzzDB: https://github.com/danielmiessler/SecLists As other commenters noted, strings like DROP TABLES should be used with caution!
janfry on HN
Bug Magnet Chrome extension
From 1 comment
for anyone testing web sites, I built a chrome extension that makes things like this available in the right-click menu [1] the code is on github, so it can be easily extended [2]…
adzicg on HN