evil_faker 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f92729244c15292d094d362e74347ddbc761399e6498705c7bafff8679486b0b
+  data.tar.gz: 4eb27cf343e7f1a58c4e5eed2fbb4dd4d4e1d4c611f66376cde6967a3396d220
+SHA512:
+  metadata.gz: 406c5ad76d8bf2a68f7b189f9be5f736f53022d49ecc7c980adf0f81162ae825df0d85176c1a7328a84ce38e86deb1bd2d77c7507dcdb3d1b8d9407fa3710237
+  data.tar.gz: b372aafdbb272862d556c318b760526ffa69291315e9af72827e8b51a6d56aac5f02203c4efd63e7d2a5b9438ebaa1589c5ccb028cb8e2d05cad7132407d02f9

data/CHANGELOG.md

@@ -0,0 +1,62 @@
+## [Unreleased]
+
+- Second corpus source vendored: `swisskyrepo/PayloadsAllTheThings` (MIT),
+  limited to the folders that ship real payload lists (an `Intruder`/
+  `Intruders` directory), not the repo's many Markdown write-ups.
+- Third corpus source vendored: `1N3/IntruderPayloads`. **No license is
+  declared on that repo** (no LICENSE file, `license: null` via the GitHub
+  API, not mentioned in its README) -- vendored anyway per explicit call, but
+  unlike BLNS/PayloadsAllTheThings this one has no MIT grant backing it. See
+  NOTICE.md.
+- `Injection` gains 8 new subtypes: `nosql`, `ldap`, `ssti`,
+  `directory_traversal`, `open_redirect`, `server_side_include`, `overflow`,
+  `generic`. Existing subtypes `sql`, `script`, `xxe`, `command`,
+  `file_inclusion` now merge strings from all three sources.
+- `Unicode` gains `bad_chars`.
+- `Filenames` (flat) now also merges malicious upload filenames from
+  IntruderPayloads' `Uploads/` folder (the payload there *is* the filename,
+  not file content).
+- Two new namespaces from PayloadsAllTheThings folders that aren't injection
+  payloads: `Routes.admin_interfaces` (Spring Boot Actuator routes) and
+  `Headers.cache_deception` (HTTP header names for cache deception/param
+  mining).
+- `Base` now reads a subtype/group from every source under `data/groups/*`
+  and concatenates them, instead of being hardcoded to `blns/`.
+- Renamed the source-specific import scripts to a consistent
+  `<source>_build_corpus.rb` pattern: `build_corpus.rb` -> `scripts/blns_build_corpus.rb`,
+  plus new `scripts/payloads_all_the_things_build_corpus.rb` and
+  `scripts/intruder_payloads_build_corpus.rb`. `scripts/generate_namespaces.rb`
+  (shared, not source-specific) keeps its name.
+- Fourth corpus source vendored: `fuzzdb-project/fuzzdb`, limited to `attack/`
+  (its recon wordlist folders are out of scope). **Also has no declared
+  license**, same gap as IntruderPayloads. See NOTICE.md. Heavy overlap with
+  PayloadsAllTheThings is expected (that source's SQL/traversal/command lists
+  were themselves originally copied from fuzzdb) and was accepted rather than
+  de-duplicated across sources.
+- `Injection` gains 11 more subtypes: `xpath`, `integer_overflow`, `rfi`,
+  `ssrf`, `json`, `format_strings`, `magic_hashes`, `source_disclosure`,
+  `file_upload_bypass`, `type_confusion`. `directory_traversal`, `ldap`,
+  `nosql`, `open_redirect` and `server_side_include` now also merge fuzzdb
+  strings.
+- New `EvilFaker::Email` namespace (`valid`/`invalid`): Faker-style parity for
+  emails, but edge cases instead of realistic ones.
+- `Routes` gains `debug_params`, `directory_indexing`, `local_paths`.
+  `Headers` gains `protocol`, `mimetypes`.
+- `Terminal`, `Rtl`, `Exploits.ios`, and `Unicode.special/two_byte/upsidedown/
+  trick/bad_chars`, `Emoji.emoji/emoticons/regional` now also merge fuzzdb
+  strings.
+- `scripts/fuzzdb_build_corpus.rb` vendors the new source.
+
+## [0.1.0] - 2026-07-23
+
+- Initial release.
+- Adversarial string corpus vendored from the Big List of Naughty Strings (MIT),
+  split into 11 namespaces: `Reserved`, `Numeric`, `Unicode`, `Emoji`, `Rtl`,
+  `Zalgo`, `Injection`, `Exploits`, `Filenames`, `Profanity`, `Terminal`.
+- Common generator API on every namespace: `.all`, `.sample`, `.sample(n)`,
+  `.size` and `Enumerable`.
+- Subtypes for namespaces that bundle several kinds of input, e.g.
+  `Injection.sql`, `Injection.script`, `Unicode.quotes`. Subtypes share the same
+  API as namespaces.
+- Reproducible output via `EvilFaker.random = Random.new(seed)`.
+- `scripts/build_corpus.rb` regenerates the per-namespace corpus from `blns.txt`.

data/GENERATORS.md

@@ -0,0 +1,164 @@
+# Generators
+
+Every namespace responds to `.all`, `.sample`, and `.sample(n)`. Namespaces
+with subtypes expose those with the same API. Everything below is real
+output — run it yourself and you'll get something different, `sample` is
+random (see [Forcing an exact value](README.md#forcing-an-exact-value) in
+the README if you need something specific and reproducible).
+
+<details>
+<summary><strong>EvilFaker::Injection</strong> — 26 subtypes, 46,520 strings total</summary>
+
+```ruby
+EvilFaker::Injection.sql.sample                 #=> "')) or sleep(5)='"
+EvilFaker::Injection.script.sample              #=> "'><script>alert(21);</script x='"
+EvilFaker::Injection.xxe.sample                 #=> "x' or name()='username' or 'x'='y"
+EvilFaker::Injection.command.sample             #=> "sleep 5"
+EvilFaker::Injection.server_code.sample         #=> "@{[system \"touch /tmp/blns.fail\"]}"
+EvilFaker::Injection.interpolation.sample       #=> "$ENV{'HOME'}"
+EvilFaker::Injection.file_inclusion.sample      #=> "\\xampp\\FileZillaFTP\\Logs\\error.log"
+EvilFaker::Injection.jinja2.sample              #=> "{% print 'x' * 64 * 1024**3 %}"
+EvilFaker::Injection.nosql.sample               #=> "1, $where: '1 == 1'"
+EvilFaker::Injection.ldap.sample                #=> "*))%00"
+EvilFaker::Injection.ssti.sample                #=> "{{ request }}"
+EvilFaker::Injection.directory_traversal.sample #=> "%c0%fe%c0%fe%25c0%25af...etc%25c0%25afpasswd"
+EvilFaker::Injection.open_redirect.sample       #=> "http://www.whitelisteddomain.tld@472.314.470.462"
+EvilFaker::Injection.xpath.sample               #=> "x' or 1=1 or 'x'='y"
+EvilFaker::Injection.rfi.sample                 #=> "/ocs/include/theme.inc.php?fullpath=XXpathXX?"
+EvilFaker::Injection.ssrf.sample                #=> "017700000001"
+EvilFaker::Injection.json.sample                #=> "{\"_constructor\":\"null\"}"
+EvilFaker::Injection.format_strings.sample      #=> "%x%x%x%x"
+EvilFaker::Injection.integer_overflow.sample    #=> "0x3fffffff"
+EvilFaker::Injection.type_confusion.sample      #=> "%bd"
+EvilFaker::Injection.magic_hashes.sample        #=> "00e05651056780370631793326323796"
+EvilFaker::Injection.source_disclosure.sample   #=> "."
+EvilFaker::Injection.file_upload_bypass.sample  #=> "pm......"
+EvilFaker::Injection.server_side_include.sample #=> "<!--#echo var=\"script_url\" -->"
+EvilFaker::Injection.overflow.sample            #=> "0x100000"
+EvilFaker::Injection.generic.sample             #=> "(SELECT * FROM (SELECT(SLEEP(5)))ecMj)--"
+```
+
+`sql`, `script`, `xxe`, `command`, `file_inclusion`, `directory_traversal`,
+`ldap`, `nosql`, `open_redirect` and `server_side_include` merge multiple
+vendored sources into one list (see the README's
+[Where the data comes from](README.md#where-the-data-comes-from)); the rest
+come from whichever single source introduced them.
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Unicode</strong> — 14 subtypes</summary>
+
+Encoding/rendering edge cases, not necessarily attacks.
+
+```ruby
+EvilFaker::Unicode.special.sample     #=> "<>?:\"{}|_+"
+EvilFaker::Unicode.controls.sample    #=> "\u0080\u0081...\u009F" (C1 control range)
+EvilFaker::Unicode.whitespace.sample  #=> "\t\v\f \u0085...\u2028\u2029  \u3000"
+EvilFaker::Unicode.bom.sample         #=> "￾"
+EvilFaker::Unicode.symbols.sample     #=> "¡™£¢∞§¶•ªº–≠"
+EvilFaker::Unicode.accents.sample     #=> "⁰⁴⁵"
+EvilFaker::Unicode.quotes.sample      #=> "<foo val=”bar“ />"
+EvilFaker::Unicode.two_byte.sample    #=> "사회과학원 어학연구소"
+EvilFaker::Unicode.lowercase.sample   #=> "Ⱥ"
+EvilFaker::Unicode.scripts.sample     #=> "᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜"
+EvilFaker::Unicode.trick.sample       #=> "test⁠test‫"
+EvilFaker::Unicode.upsidedown.sample  #=> "00˙Ɩ$-"
+EvilFaker::Unicode.font.sample        #=> "𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱..."
+EvilFaker::Unicode.bad_chars.sample   #=> "₀₁₂"
+```
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Routes</strong> — 4 subtypes</summary>
+
+Recon-ish wordlists (admin routes, debug params, directory listings, local
+log paths) — not adversarial payloads, but realistic values for testing
+routing/auth-guard behavior.
+
+```ruby
+EvilFaker::Routes.admin_interfaces.sample   #=> "actuator/threaddump"
+EvilFaker::Routes.debug_params.sample       #=> "\"admin\":true"
+EvilFaker::Routes.directory_indexing.sample #=> "/cgi-bin/test-cgi?*"
+EvilFaker::Routes.local_paths.sample        #=> "/usr/local/apache/logs/access_log"
+```
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Headers</strong> — 3 subtypes</summary>
+
+HTTP header names, protocol methods and MIME types, for testing
+header-parsing code paths.
+
+```ruby
+EvilFaker::Headers.cache_deception.sample  #=> "onerror-die"
+EvilFaker::Headers.protocol.sample         #=> "DEBUG"
+EvilFaker::Headers.mimetypes.sample        #=> "application/xenc+xml"
+```
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Emoji</strong> — 3 subtypes</summary>
+
+```ruby
+EvilFaker::Emoji.emoji.sample      #=> "❤️ 💔 💌 💕 💞 💓 💗..."
+EvilFaker::Emoji.emoticons.sample  #=> "( ͡° ͜ʖ ͡°)"
+EvilFaker::Emoji.regional.sample   #=> "🇺🇸🇷🇺🇸🇦"
+```
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Exploits</strong> — 4 subtypes</summary>
+
+Named/historical exploit strings rather than a general category.
+
+```ruby
+EvilFaker::Exploits.cves.sample   #=> "() { 0; }; touch /tmp/blns.shellshock1.fail;"
+EvilFaker::Exploits.human.sample  #=> "If you're reading this, you've been in a coma..."
+EvilFaker::Exploits.ios.sample    #=> "జ్ఞ‌ా"
+EvilFaker::Exploits.irc.sample    #=> "DCC SEND STARTKEYLOGGER 0 0 0"
+```
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Numeric</strong> — 2 subtypes</summary>
+
+```ruby
+EvilFaker::Numeric.numeric.sample          #=> "1.000.000,00"
+EvilFaker::Numeric.unicode_numbers.sample  #=> "１２３"
+```
+
+</details>
+
+<details>
+<summary><strong>EvilFaker::Email</strong> — 2 subtypes</summary>
+
+Faker-style parity for emails, but edge cases instead of realistic ones:
+syntactically valid addresses that break naive regexes, and invalid ones
+that get accepted anyway by permissive validators.
+
+```ruby
+EvilFaker::Email.valid.sample    #=> "Jacco/van=Tuijl@address.com"
+EvilFaker::Email.invalid.sample  #=> ".email@address.com"
+```
+
+</details>
+
+<details>
+<summary><strong>Flat namespaces</strong> — no subtypes, just <code>.all</code> / <code>.sample</code></summary>
+
+```ruby
+EvilFaker::Reserved.sample   #=> "(null)"
+EvilFaker::Filenames.sample  #=> "simple-backdoor.php"
+EvilFaker::Profanity.sample  #=> "Lightwater Country Park"
+EvilFaker::Rtl.sample        #=> "הָיְתָהtestالصفحات التّحول"
+EvilFaker::Zalgo.sample      #=> "Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮"
+EvilFaker::Terminal.sample   #=> "The quic\b\b\b\b\b\bk brown fo\a\a\a\a\a\a\a\a\a\a\ax... [Beeeep]"
+```
+
+</details>

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 AFornio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/NOTICE.md

@@ -0,0 +1,196 @@
+# Attributions
+
+## Big List of Naughty Strings (BLNS)
+
+The adversarial string corpus vendored under `lib/evil_faker/data/` is derived from
+the **Big List of Naughty Strings**, curated by **Max Woolf (@minimaxir)** and
+contributors.
+
+- Source: https://github.com/minimaxir/big-list-of-naughty-strings
+- License: MIT
+
+The MIT license text below applies to the BLNS data.
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2015-2020 Max Woolf
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+## PayloadsAllTheThings
+
+The adversarial string corpus vendored under
+`lib/evil_faker/data/groups/payloads_all_the_things/` is derived from
+**PayloadsAllTheThings**, curated by **Swissky (@swisskyrepo)** and
+contributors. Only the folders that ship a real `Intruder`/`Intruders`
+directory of plain-text payloads were vendored; the rest of the repo is
+Markdown documentation, not data.
+
+- Source: https://github.com/swisskyrepo/PayloadsAllTheThings
+- License: MIT
+
+Origin of each vendored file (`lib/evil_faker/data/groups/payloads_all_the_things/<path>`):
+
+| Vendored as | Upstream path |
+|---|---|
+| `injection/sql.txt` | `SQL Injection/Intruder/*.txt` |
+| `injection/nosql.txt` | `NoSQL Injection/Intruder/*.txt` |
+| `injection/ldap.txt` | `LDAP Injection/Intruder/*.txt` |
+| `injection/script.txt` | `XSS Injection/Intruders/*.txt` |
+| `injection/xxe.txt` | `XXE Injection/Intruders/*.txt` |
+| `injection/ssti.txt` | `Server Side Template Injection/Intruder/*.txt` |
+| `injection/command.txt` | `Command Injection/Intruder/*.txt` |
+| `injection/file_inclusion.txt` | `File Inclusion/Intruders/*.txt` |
+| `injection/directory_traversal.txt` | `Directory Traversal/Intruder/*.txt` |
+| `injection/open_redirect.txt` | `Open Redirect/Intruder/*.txt` |
+| `routes/admin_interfaces.txt` | `Insecure Management Interface/Intruder/springboot_actuator.txt` |
+| `headers/cache_deception.txt` | `Web Cache Deception/Intruders/param_miner_lowercase_headers.txt` |
+
+The MIT license text below applies to the PayloadsAllTheThings data.
+
+```
+MIT License
+
+Copyright (c) 2019 Swissky
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## IntruderPayloads
+
+The adversarial string corpus vendored under
+`lib/evil_faker/data/groups/intruder_payloads/` is derived from
+**IntruderPayloads**, curated by **1N3** and contributors.
+
+- Source: https://github.com/1N3/IntruderPayloads
+- **License: none declared.** The repo has no `LICENSE` file, doesn't mention
+  a license in its README, and the GitHub API reports `license: null`. There
+  is no MIT (or other) grant backing this data, unlike BLNS and
+  PayloadsAllTheThings above. It was vendored anyway on explicit instruction
+  despite this gap -- flagging it here so the gap is visible, not silently
+  assumed away. Revisit before any public release of this gem if that's a
+  concern (e.g. contact the author for explicit permission, or drop this
+  source).
+
+Only `FuzzLists/` (plain-text payload lists) and `Uploads/` (malicious
+upload filenames) were vendored. `BurpAttacks/` (binary `.burp` ZIP exports),
+`Plugins/` (`.jar` files) and `BurpBountyPayloads/` (JSON scanner-rule
+configs with 1-2 payloads each behind a lot of unrelated metadata) were
+skipped.
+
+Origin of each vendored file (`lib/evil_faker/data/groups/intruder_payloads/<path>`):
+
+| Vendored as | Upstream path(s) |
+|---|---|
+| `injection/sql.txt` | `FuzzLists/sqli-error-based.txt`, `sqli-time-based.txt`, `sqli-union-select.txt`, `sqli_escape_chars.txt`, `auth_bypass.txt` |
+| `injection/script.txt` | `FuzzLists/xss_escape_chars.txt`, `xss_find_inject.txt`, `xss_funny_stored.txt`, `xss_grep.txt`, `xss_swf_fuzz.txt` |
+| `injection/file_inclusion.txt` | `FuzzLists/lfi.txt` |
+| `injection/directory_traversal.txt` | `FuzzLists/traversal.txt`, `traversal-short.txt` |
+| `injection/xxe.txt` | `FuzzLists/xml-attacks.txt` |
+| `injection/command.txt` | `FuzzLists/command_exec.txt` |
+| `injection/server_side_include.txt` | `FuzzLists/ssi_quick.txt` |
+| `injection/overflow.txt` | `FuzzLists/overflow.txt`, `overflow-dos.txt` |
+| `injection/generic.txt` | `FuzzLists/basic_fuzz.txt`, `full_fuzz.txt`, `quick_fuzz.txt` |
+| `unicode/bad_chars.txt` | `FuzzLists/bad_chars.txt` |
+| `filenames.txt` (merged into flat `EvilFaker::Filenames`) | `Uploads/` (directory entry names themselves are the payload) |
+
+Every source line containing the literal token `INJECTX` (a Burp Intruder
+substitution placeholder, meaningless without the second payload it would be
+spliced with) was dropped rather than vendored as-is.
+
+## fuzzdb
+
+The adversarial string corpus vendored under
+`lib/evil_faker/data/groups/fuzzdb/` is derived from **fuzzdb**, curated by the
+**fuzzdb-project** and contributors.
+
+- Source: https://github.com/fuzzdb-project/fuzzdb
+- **License: none declared.** Same gap as IntruderPayloads above -- no
+  `LICENSE` file, `license: null` via the GitHub API. Vendored anyway on
+  explicit instruction. Revisit before any public release of this gem if
+  that's a concern.
+
+Only `attack/` was vendored (adversarial field payloads); `discovery/`,
+`wordlists-misc/`, `wordlists-user-passwd/`, `web-backdoors/`, `docs/` and
+`regex/` are recon wordlists/tooling, out of scope for this gem. Within
+`attack/`, `file-upload/malicious-images/` (real binary POC files, including
+an EICAR test string) and `xss/JHADDIX_XSS_WITH_CONTEXT.doc.txt` (prose
+write-up, not one payload per line) were skipped.
+
+Heavy overlap with the PayloadsAllTheThings data is expected and accepted:
+that source's SQL/traversal/command lists were themselves originally copied
+from fuzzdb (several files share the exact upstream filename, e.g.
+`traversals-8-deep-exotic-encoding.txt`). Vendored anyway per explicit
+instruction to prioritize coverage over de-duplication across sources.
+
+Origin of each vendored file (`lib/evil_faker/data/groups/fuzzdb/<path>`):
+
+| Vendored as | Upstream path(s) |
+|---|---|
+| `injection/sql.txt` | `attack/sql-injection/detect,exploit,payloads-sql-blind/*.txt` |
+| `injection/script.txt` | `attack/xss/*.txt` (minus the doc.txt), `attack/html_js_fuzz/*.txt` |
+| `injection/xxe.txt` | `attack/xml/xml-attacks.txt` |
+| `injection/command.txt` | `attack/os-cmd-execution/*.txt`, `attack/string-expansion/shell-expansion.txt` |
+| `injection/file_inclusion.txt` | `attack/lfi/*.txt` |
+| `injection/directory_traversal.txt` | `attack/path-traversal/*.txt` |
+| `injection/open_redirect.txt` | `attack/redirect/*.txt` |
+| `injection/nosql.txt` | `attack/no-sql-injection/mongodb.txt` |
+| `injection/ldap.txt` | `attack/ldap/ldap-injection.txt` |
+| `injection/server_side_include.txt` | `attack/server-side-include/server-side-includes-generic.txt` |
+| `injection/generic.txt` | `attack/all-attacks/*.txt` |
+| `injection/xpath.txt` | `attack/xpath/xpath-injection.txt` |
+| `injection/integer_overflow.txt` | `attack/integer-overflow/integer-overflows.txt` |
+| `injection/rfi.txt` | `attack/rfi/rfi.txt` |
+| `injection/ssrf.txt` | `attack/ip/localhost.txt` |
+| `injection/json.txt` | `attack/json/JSON_Fuzzing.txt` |
+| `injection/format_strings.txt` | `attack/format-strings/format-strings.txt` |
+| `injection/magic_hashes.txt` | `attack/authentication/php_magic_hashes.fuzz.txt` |
+| `injection/source_disclosure.txt` | `attack/disclosure-source/*.txt` |
+| `injection/file_upload_bypass.txt` | `attack/file-upload/*.txt` (minus `malicious-images/`) |
+| `injection/type_confusion.txt` | `attack/control-chars/HexValsAllBytes.txt`, `NullByteRepresentations.txt`, `true.txt` |
+| `routes/debug_params.txt` | `attack/business-logic/*.txt` |
+| `routes/directory_indexing.txt` | `attack/disclosure-directory/directory-indexing-generic.txt`, `attack/os-dir-indexing/directory-indexing.txt` |
+| `routes/local_paths.txt` | `attack/disclosure-localpaths/unix/*.txt` |
+| `headers/protocol.txt` | `attack/http-protocol/*.txt` (minus README/html) |
+| `headers/mimetypes.txt` | `attack/mimetypes/MimeTypes.txt` |
+| `email/valid.txt` | `attack/email/valid-email-addresses.txt` |
+| `email/invalid.txt` | `attack/email/invalid-email-addresses.txt` |
+| merged into flat `EvilFaker::Terminal` | `attack/control-chars/terminal-escape-codes.txt` |
+| merged into `EvilFaker::Exploits.ios` | `attack/control-chars/imessage.txt` |
+| merged into `EvilFaker::Unicode.special/two_byte/upsidedown/trick/bad_chars` | `attack/unicode/specialchars.txt`, `two-byte-chars.txt`, `upsidedown.txt`, `corrupted.txt`, `naughty-unicode.txt` |
+| merged into `EvilFaker::Emoji.emoji/emoticons/regional` | `attack/unicode/emoji.txt`, `japanese-emoticon.txt`, `regionalindicators.txt` |
+| merged into flat `EvilFaker::Rtl` | `attack/unicode/right-to-left.txt` |

data/README.md

@@ -0,0 +1,156 @@
+<div align="center">
+
+# EvilFaker 💎
+
+**Adversarial input for Ruby — like Faker, but evil.**
+
+[![Gem Version](https://badge.fury.io/rb/evil_faker.svg)](https://badge.fury.io/rb/evil_faker)
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%203.2.0-red.svg)](https://www.ruby-lang.org)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE.txt)
+
+</div>
+
+Faker gives you data that looks real. EvilFaker gives you data that fights back:
+the strings that have historically broken software.
+
+```ruby
+EvilFaker::Injection.sql.sample   #=> "' OR 1=1 -- 1"
+EvilFaker::Zalgo.sample           #=> "Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤"
+EvilFaker::Unicode.quotes.sample  #=> "<foo val=“bar” />"
+EvilFaker::Emoji.sample           #=> "👨‍🦰"
+```
+
+Emoji that get truncated by a `utf8` MySQL column. Right-to-left overrides that
+flip your layout. Zalgo that overflows its line. Reserved Windows filenames.
+SQL, XSS, XXE, LDAP, SSTI, and 20 other kinds of injection payload.
+
+## Installation
+
+```ruby
+# Gemfile
+group :development, :test do
+  gem "evil_faker"
+end
+```
+
+## Quickstart
+
+Every namespace answers to the same three methods:
+
+```ruby
+EvilFaker::Reserved.all        # every string in the group (Array)
+EvilFaker::Reserved.sample     # one at random
+EvilFaker::Reserved.sample(3)  # three at random
+```
+
+Namespaces that bundle several kinds of input expose **subtypes**, same API:
+
+```ruby
+EvilFaker::Injection.sql       # only the SQL payloads
+EvilFaker::Injection.script    # only the XSS payloads
+EvilFaker::Injection.sql.sample
+```
+
+The full list of namespaces, subtypes, and real sample output lives in
+**[GENERATORS.md](GENERATORS.md)** so this README stays readable.
+
+## Where the data comes from
+
+EvilFaker doesn't generate strings on the fly — it vendors them from four
+public wordlists that have been breaking real software for years:
+
+| Source | Contributes |
+|---|---|
+| [Big List of Naughty Strings](https://github.com/minimaxir/big-list-of-naughty-strings) — Max Woolf | Emoji, RTL overrides, zalgo, unicode edge cases, base injection payloads |
+| [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) — Swissky & contributors | Deep SQL/XSS/XXE/SSTI/LDAP/NoSQL payloads, admin routes, cache-deception headers |
+| [IntruderPayloads](https://github.com/1N3/IntruderPayloads) — 1N3 & contributors | More SQL/XSS/traversal/command payloads, malicious upload filenames |
+| [fuzzdb](https://github.com/fuzzdb-project/fuzzdb) — fuzzdb-project | XPath, RFI, SSRF, JSON, format strings, magic hashes, valid/invalid emails |
+
+When more than one source has data for the same group, `.all` and every
+subtype method return **all of it, concatenated** — nothing gets dropped in
+favor of another source. `EvilFaker::Injection.sql`, for example, merges four
+separate files into 2,776 lines (8 from BLNS, 661 from fuzzdb, 753 from
+IntruderPayloads, 1,354 from PayloadsAllTheThings).
+
+The one thing that doesn't happen automatically is cross-source dedup: each
+source de-dupes its own file at vendor time, but two sources that happen to
+share the same payload aren't checked against each other (fuzzdb and
+PayloadsAllTheThings overlap a lot, since the latter originally copied
+several fuzzdb files). Call `.uniq` yourself if that matters for your case.
+
+Per-file origin and license details live in [NOTICE.md](NOTICE.md) — worth a
+read before you ship this anywhere public, since two of the four sources
+(IntruderPayloads, fuzzdb) don't declare a license upstream.
+
+## Usage patterns
+
+### In your specs
+
+```ruby
+RSpec.describe "GET /search", type: :request do
+  EvilFaker::Injection.sql.each do |payload|
+    it "survives #{payload.inspect}" do
+      get "/search", params: { q: payload }
+
+      expect(response).to have_http_status(:ok)  # no 500
+      expect(User.count).to eq(3)                # table still there
+    end
+  end
+end
+```
+
+Sample large groups so the suite stays fast:
+
+```ruby
+EvilFaker::Injection.script.sample(10).each do |xss|
+  it "escapes #{xss.inspect}" do
+    # ...
+  end
+end
+```
+
+### In a factory
+
+```ruby
+factory :evil_faker_user, parent: :user do
+  name { EvilFaker::Unicode.sample }
+  bio  { EvilFaker::Zalgo.sample }
+end
+```
+
+### Forcing an exact value
+
+`sample` is random and unseeded — don't rely on it in a spec that needs to be
+reproducible. Use the Array you already have instead:
+
+```ruby
+EvilFaker::Injection.sql.first
+EvilFaker::Injection.sql.find { |s| s.include?("DROP") }
+```
+
+## Development
+
+```bash
+bin/setup                                             # install dependencies
+bundle exec rspec                                     # run the tests
+bundle exec rubocop                                    # lint
+bin/console                                            # IRB with evil_faker loaded
+ruby scripts/blns_build_corpus.rb                      # regenerate groups/blns from blns.txt
+ruby scripts/payloads_all_the_things_build_corpus.rb   # regenerate groups/payloads_all_the_things (needs gh CLI)
+ruby scripts/intruder_payloads_build_corpus.rb         # regenerate groups/intruder_payloads (needs gh CLI)
+ruby scripts/fuzzdb_build_corpus.rb                    # regenerate groups/fuzzdb (needs gh CLI)
+ruby scripts/generate_namespaces.rb                    # regenerate lib/evil_faker/groups from data/groups
+```
+
+`Base` discovers sources off the filesystem, not off a hardcoded list —
+adding a fifth source is just adding a `groups/<source>/` folder with files
+in the right shape and re-running `generate_namespaces.rb`.
+
+## Credits
+
+MIT-licensed corpus data from the four sources above, credits and full
+license text in [NOTICE.md](NOTICE.md).
+
+## License
+
+MIT. See [LICENSE.txt](LICENSE.txt).

data/Rakefile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]

data/lib/evil_faker/base.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module EvilFaker
+  # Base class for every namespace: reads its corpus from data/groups and
+  # exposes .all/.sample, plus .subtype for namespaces split into sub-groups.
+  class Base
+    DATA_DIR = File.expand_path("data/groups", __dir__)
+
+    class << self
+      # Declares this namespace's corpus, read from groups/<source>/<name>.txt.
+      def group(name)
+        @group = name
+      end
+
+      # Declares a sub-group living in groups/<source>/<group>/<name>.txt.
+      # Defines a method `name` that reads and concatenates it across every
+      # source that has a file at that path (multiple sources can contribute
+      # strings to the same subtype, e.g. blns/injection/sql.txt and
+      # payloads_all_the_things/injection/sql.txt both feed Injection.sql).
+      def subtype(name)
+        (@subtypes ||= []) << name
+        define_singleton_method(name) do
+          subtype_cache[name] ||= Dir.glob(
+            File.join(DATA_DIR, "*", @group.to_s, "#{name}.txt")
+          ).sort.flat_map { |path| File.readlines(path, chomp: true) }
+        end
+      end
+
+      def all
+        return @all ||= @subtypes.flat_map { |s| send(s) } if @subtypes
+
+        @all ||= Dir.glob(File.join(DATA_DIR, "*", "#{@group}.txt")).sort.flat_map do |path|
+          File.readlines(path, chomp: true)
+        end
+      end
+
+      def sample(count = nil)
+        return all.sample(count) if count
+
+        all.sample
+      end
+
+      private
+
+      def subtype_cache
+        @subtype_cache ||= {}
+      end
+    end
+  end
+end