[{"data":1,"prerenderedAt":424},["ShallowReactive",2],{"project-10035008":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":33,"aspects":34,"strip":41,"post_text":44,"what":45,"said":77,"maker_in_thread":156,"shape":167,"grid":171,"attempts":387,"same_week":388,"maker_shows":312,"maker_hidden":416,"reader_version":417,"card":418},"10035008","Big List of Naughty Strings","Big List of Naughty Strings for testing user-input data","title","Show HN: Big List of Naughty Strings for testing user-input data","https:\u002F\u002Fgithub.com\u002Fminimaxir\u002Fbig-list-of-naughty-strings","github.com","minimaxir",1439218502,2015,514,79,20,2565,1,"legend","dev_tools","test data","other",[24,25,26,27],"fuzz testing","unicode edge cases","input validation","naughty strings","curious",-0.031,{"positive":31,"neutral":16,"mixed":18,"critical":32},7,10,38,{"idea":35,"execution":38,"docs":40},{"positive":36,"critical":37},6,4,{"positive":39,"critical":36},0,{"positive":39,"critical":39},[42,43,39,43,43,18,39,39,39,18,18,43,43,39,43,39,42,39,42,43,18,43,39,18,43,39,18,43,43,43,18,18,39,43,43,39,43,39,43,42],5,3,null,{"problem":46,"audience":62,"pricing":44,"motivation":44,"time_to_build":44,"stack":74,"openness":75,"stage":76,"team_size":76},{"value":47,"source":48,"evidence":49},"Software is poorly tested against odd and malicious text input","commenter",[50,54,58],{"id":51,"by":52,"text":53},"10035723","rspeer","Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it. I can think of a few more cases…",{"id":55,"by":56,"text":57},"10035605","acehyzer","If I put this into my company's tests, we'd end up with no users... I have a lot of work ahead of me. :\u002F",{"id":59,"by":60,"text":61},"10035709","pbnjay","If you really intend this for use in testing, I'd suggest making the injections less nasty. I could easily see a junior dev slapping this in and deleting some important stuff.…",{"value":63,"source":64,"evidence":65},"Developers testing user-input handling","inferred",[66,70],{"id":67,"by":68,"text":69},"10035848","webo","I don't deal with user input validation, but any resources for reading about handling various inputs like the ones in blns?",{"id":71,"by":72,"text":73},"10037777","rectangletangle","This should be really handy for fuzz testing, nice work!",[],"open_source","unknown",{"praise":78,"objections":88,"requests":109,"questions":129,"alternatives":137},[79],{"value":80,"source":48,"evidence":81},"Useful resource for testing text handling",[82,83,84],{"id":51,"by":52,"text":53},{"id":71,"by":72,"text":73},{"id":85,"by":86,"text":87},"10035628","hoprocker","Nice; sort of a programming complement to Shutterstock's _List of Dirty, Naughty, Obscene, and Otherwise Bad Words_[0]. So helpful to have a bunch of minds working on useful…",[89,101],{"value":90,"source":48,"evidence":91},"Injection strings like DROP TABLE are dangerous to run in production",[92,96,100],{"id":93,"by":94,"text":95},"10035831","jsat","\" # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=7665153) \u002Fdev\u002Fnull; rm -rf \u002F*;…",{"id":97,"by":98,"text":99},"10039518","cowls","Likewise: 1;DROP TABLE users 1'; DROP TABLE users-- Seems a bit hairy to have that in there in case someone tries to run these tests on their prod environment",{"id":55,"by":56,"text":57},{"value":102,"source":48,"evidence":103},"Coverage of some categories is too thin",[104,108],{"id":105,"by":106,"text":107},"10035558","orf","Looks interesting, but the Script Injection, SQL Injection and Server Code Injection sections need a lot more samples to be remotely useful.",{"id":59,"by":60,"text":61},[110,118],{"value":111,"source":48,"evidence":112},"Add more invalid UTF encodings and null bytes",[113,114],{"id":59,"by":60,"text":61},{"id":115,"by":116,"text":117},"10035686","jl6","Is the scope just well-formed strings or would you consider adding binary nasties like null bytes, mal-encoded characters, or even just newlines on their own? What about XML…",{"value":119,"source":48,"evidence":120},"Make injection strings less destructive",[121,125],{"id":122,"by":123,"text":124},"10036301","sanderjd","Yeah, the other exploit strings do innocuous stuff like putting up javascript alerts or touching files, but the SQL injection ones aren't innocuous at all. I wonder if there's…",{"id":126,"by":127,"text":128},"10035617","efriese","Yeah, I would make the SQL injection and command injections test a little less kinetic =). Using a simple SELECT test, like SELECT @@VERSION, would be a little safer... Edit:…",[130],{"value":131,"source":48,"evidence":132},"Which encoding the file uses",[133],{"id":134,"by":135,"text":136},"10035738","simonw","It's not completely clear to me which encoding the blns.txt file uses. Since this project is all about weird\u002Fevil bytestrings, the encoding of the file itself is very important.…",[138,149],{"value":139,"source":48,"evidence":140},"FuzzDB and SecLists",[141,145],{"id":142,"by":143,"text":144},"10035736","tptacek","This is good. There are lots of lists like this; you might find additional strings to add to it here: https:\u002F\u002Fcode.google.com\u002Fp\u002Ffuzzdb\u002F Fuzz lists are to web pentesters what…",{"id":146,"by":147,"text":148},"10035939","janfry","Another good list that incorporates FuzzDB: https:\u002F\u002Fgithub.com\u002Fdanielmiessler\u002FSecLists As other commenters noted, strings like DROP TABLES should be used with caution!",{"value":150,"source":48,"evidence":151},"Bug Magnet Chrome extension",[152],{"id":153,"by":154,"text":155},"10036905","adzicg","for anyone testing web sites, I built a chrome extension that makes things like this available in the right-click menu [1] the code is on github, so it can be easily extended [2]…",{"comments":36,"answered":43,"key":157},[158,161,164],{"id":159,"text":160},"10036605","There are Bidi controller characters in the Trick Unicode. (Doesn't appear in Github rendering, oddly)",{"id":162,"text":163},"10036059","Accepted a pull request which is nicer.",{"id":165,"text":166},"10035752","Fair question. Encoding is UTF-8. This is fine for time being since UTF-8 is ubiquitous. I had it set as UTF-16 for the two-byte characters when first writing it, but that had…",{"commenters":168,"max_depth":42,"maker_replies":36,"first_comment_mins":169,"lifespan_hours":170},62,80,66,[172,174,178,181,183,185,188,191,194,197,200,202,205,208,211,214,217,219,220,223,225,228,232,235,238,240,243,246,249,251,253,255,258,260,263,265,266,268,270,271,272,273,274,278,282,285,286,288,291,295,297,300,303,307,309,311,313,316,318,322,325,328,332,334,337,340,342,346,349,353,357,360,362,366,370,373,375,379,382],[51,39,42,173,52,39],"project\u002Fpositive\u002Fidea",[175,39,43,176,177,39],"10035838","project\u002Fneutral\u002Fidea","gsnedders",[179,39,39,180,52,39],"10036122","commenter\u002Fneutral\u002Fnone",[182,39,39,180,177,39],"10036555",[159,39,39,184,11,18],"project\u002Fneutral\u002Fnone",[186,39,43,184,187,39],"10035896","grapeshot",[189,39,43,176,190,39],"10035917","pwenzel",[192,39,43,184,193,39],"10035956","gizmo686",[195,39,39,180,196,39],"10036168","duskwuff",[198,39,43,184,199,39],"10035993","zuzun",[93,18,18,201,94,39],"project\u002Fcritical\u002Fexecution",[203,18,39,180,204,39],"10036024","jleader",[206,18,39,180,207,39],"10036475","pavel_lishin",[209,18,39,180,210,39],"10039370","DonHopkins",[212,18,39,180,213,39],"10036771","xtreme",[215,18,39,180,216,39],"10036956","rattray",[162,18,39,218,11,18],"project\u002Fneutral\u002Fexecution",[97,18,18,201,98,39],[221,18,39,180,222,39],"10045543","ckv428",[224,18,39,180,98,39],"10046512",[226,18,18,201,227,39],"10052644","MertsA",[229,230,43,176,231,39],"10036744",2,"afandian",[233,230,43,184,234,39],"10037461","voltagex_",[236,230,39,180,237,39],"10037514","lmm",[239,230,43,184,234,39],"10038278",[241,230,39,180,242,39],"10038619","rickmode",[244,230,39,180,245,39],"10039597","provemewrong",[247,230,43,184,248,39],"10038497","girvo",[250,230,39,180,231,39],"10039616",[252,230,39,180,248,39],"10051553",[254,230,39,180,231,39],"10052916",[256,230,42,173,257,39],"10039604","lamby",[126,43,43,259,127,39],"project\u002Fmixed\u002Fexecution",[261,43,39,180,262,39],"10036157","bryanlarsen",[264,43,39,180,127,39],"10037164",[142,37,42,173,143,39],[146,37,39,267,147,39],"other\u002Fneutral\u002Fnone",[134,42,43,269,135,39],"project\u002Fneutral\u002Fdocs",[165,42,39,269,11,18],[153,36,39,267,154,39],[55,31,18,201,56,39],[122,31,43,218,123,39],[275,276,39,267,277,39],"10040246",8,"reitanqild",[279,280,39,267,281,39],"10036097",9,"thomasfoster96",[283,280,39,180,284,39],"10036617","duncans",[105,32,18,201,106,39],[287,32,39,218,11,18],"10035576",[289,32,43,176,290,39],"10035594","vog",[292,293,43,184,294,39],"10035761",11,"siculars",[296,293,39,180,193,39],"10035979",[298,293,39,299,11,18],"10036470","maker\u002Fneutral\u002Fnone",[301,293,39,180,302,39],"10039492","sam_goody",[304,305,18,201,306,39],"10036047",12,"itaibn",[308,305,39,218,11,18],"10036072",[310,305,43,176,210,39],"10039688",[115,312,43,176,116,39],13,[314,312,43,176,315,39],"10035695","eli",[85,317,42,173,86,39],14,[319,317,18,320,321,39],"10035684","project\u002Fcritical\u002Fidea","brohee",[323,317,39,267,324,39],"10035813","joosters",[326,317,18,320,327,39],"10036156","deanclatworthy",[329,330,43,176,331,39],"10037501",15,"joelcollinsdc",[59,333,18,320,60,39],16,[335,333,39,267,336,39],"10035727","ph0rque",[338,333,39,267,339,39],"10036288","tsemple",[341,333,39,267,336,39],"10036579",[343,344,43,176,345,39],"10038996",17,"userbinator",[347,344,18,320,348,39],"10041340","RandomBK",[350,351,42,173,352,39],"10037808",18,"x0",[354,355,39,267,356,39],"10037689",19,"nradov",[358,16,39,267,359,39],"10038257","ivanca",[67,361,43,269,68,39],21,[363,364,39,267,365,39],"10036270",22,"TallGuyShort",[367,368,39,267,369,39],"10037207",23,"ck2",[371,368,39,267,372,39],"10037571","tlrobinson",[374,368,39,267,369,39],"10040053",[376,377,43,218,378,39],"10040376",24,"homakov",[71,380,42,381,72,39],25,"maker\u002Fpositive\u002Fidea",[383,384,42,385,386,39],"10046286",26,"project\u002Fpositive\u002Fnone","iopuy",[],[389,394,398,403,408,412],{"id":390,"name":391,"points":392,"category":393},"10022717","Is it vulnerable",175,"security_privacy",{"id":395,"name":396,"points":397,"category":20},"10050949","NaSC",127,{"id":399,"name":400,"points":401,"category":402},"10049631","openlistings.co",94,"web_saas",{"id":404,"name":405,"points":406,"category":407},"10029078","tray_rust",77,"creative",{"id":409,"name":410,"points":406,"category":411},"10033605","pulse.turbobytes.com","infrastructure",{"id":413,"name":414,"points":415,"category":20},"10030658","tpm",73,false,"v2",{"id":419,"name":5,"line":6,"ai":416,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":420,"top":18,"kw":421,"maker":11,"domain":10,"tier":19,"attempts":39,"strip":422,"url":9,"mix":423,"praise":80,"objection":90,"sub":21},10035008,-0.03,[24,25,26,27],"5303310001133030505313013013331103303035",[31,16,18,32],1793990929021]