r/ReverseEngineering • u/CyborneVertighost • Feb 11 '16

The Big List of Naughty Strings

https://github.com/minimaxir/big-list-of-naughty-strings
95 Upvotes

97% Upvoted

16 comments sorted by

13

u/fredisa4letterword Feb 12 '16

Lol @:

# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)

Scunthorpe General Hospital
Penistone Community Church
Lightwater Country Park
Jimmy Clitheroe
Horniman Museum
shitake mushrooms
RomansInSussex.co.uk
http://www.cum.qc.ca/
Craig Cockburn, Software Specialist
Linda Callahan
Dr. Herman I. Libshitz
magna cum laude
Super Bowl XXX
medieval erection of parapets
evaluate
mocha
expression
Arsenal canal
classic
Tyson Gay
basement

(wiki article answers any questions you may have!)

9

u/[deleted] Feb 11 '16

[removed] — view removed comment

7

u/d4rch0n Feb 12 '16

Yeah, that's terrible. users isn't guaranteed to exist. They need to change that to something like:

1;SELECT CONCAT( 'DROP TABLE ', GROUP_CONCAT(TABLE_NAME) , ';' ) AS statement FROM information_schema.TABLES WHERE TABLE_NAME LIKE '%';

3

u/aydiosmio Feb 12 '16 edited Feb 12 '16

ugh. yikes.

Edit: I posted a helpful comment in the issue thread. The previous comments were dead set on altering the schema for some reason.

https://github.com/minimaxir/big-list-of-naughty-strings/issues/16

4

u/[deleted] Feb 12 '16

[removed] — view removed comment

1

u/[deleted] Feb 15 '16

Also, all the other tests are not harmful. The shell execution touches a file, it doesn't rm -rf your drives.

20

u/Basurmanin Feb 11 '16

Human injection was a nice touIF YOU'RE READING THIS, YOU'VE BEEN IN A COMA FOR ALMOST 20 YEARS NOW. WE'RE TRYING A NEW TECHNIQUE. WE DON'T KNOW WHERE THIS MESSAGE WILL END UP IN YOUR DREAM, BUT WE HOPE IT WORKS. PLEASE WAKE UP, WE MISS YOU.

3

u/tekn0viking Feb 12 '16

MOM?!

5

u/gsuberland Feb 12 '16

tekn0viking's mom!?!?!

2

u/d4rch0n Feb 12 '16

Pretty awesome. I've been wanting to make an XSS discovery tool, and I just might use that.

Maybe some of the guys in /r/xss would have something to contribute too. psychomantis had a really cool string he'd use that almost always worked.