evil_faker 0.1.0

data/scripts/blns_build_corpus.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+# Regenerates the per-group corpus files from lib/evil_faker/data/blns.txt
+# (Big List of Naughty Strings, MIT, Max Woolf -- github.com/minimaxir/big-list-of-naughty-strings).
+#
+# Output: lib/evil_faker/data/groups/blns/<namespace>.txt            (single-topic namespaces)
+#         lib/evil_faker/data/groups/blns/<namespace>/<slug>.txt     (namespaces with several sub-groups)
+#
+# Nested under blns/ because that's the source -- other sources get their own
+# sibling folder (groups/payloads_all_the_things/, groups/intruder_payloads/),
+# never mixed into this one.
+#
+# Usage:  ruby scripts/blns_build_corpus.rb
+
+ROOT    = File.expand_path("..", __dir__)
+OUT_DIR = File.join(ROOT, "lib/evil_faker/data/groups/blns")
+
+BLNS_SOURCE = File.join(ROOT, "lib/evil_faker/data/blns.txt")
+
+# Map: namespace -> { slug -> [title patterns] }.
+# Patterns are matched as case-insensitive substrings against a section's title.
+# Order matters: the first (namespace, slug) whose patterns match wins.
+GROUPS = {
+  "injection" => {
+    "script" => ["Script Injection"],
+    "sql" => ["SQL Injection"],
+    "server_code" => ["Server Code Injection"],
+    "command" => ["Command Injection"],
+    "xxe" => ["XXE Injection"],
+    "interpolation" => ["Unwanted Interpolation"],
+    "file_inclusion" => ["File Inclusion"],
+    "jinja2" => ["jinja2 injection"]
+  },
+  "exploits" => {
+    "cves" => ["Known CVEs"],
+    "irc" => ["IRC specific"],
+    "human" => ["Human injection"],
+    "ios" => ["iOS Vulnerabilities"]
+  },
+  "emoji" => {
+    "emoji" => ["Emoji"],
+    "regional" => ["Regional Indicator"],
+    "emoticons" => ["Japanese Emoticons"]
+  },
+  "numeric" => {
+    "numeric" => ["Numeric Strings"],
+    "unicode_numbers" => ["Unicode Numbers"]
+  },
+  "reserved" => { "reserved" => ["Reserved Strings"] },
+  "rtl" => { "rtl" => ["Right-To-Left"] },
+  "zalgo" => { "zalgo" => ["Zalgo"] },
+  "filenames" => { "filenames" => ["MSDOS/Windows Special Filenames"] },
+  "profanity" => { "profanity" => ["Scunthorpe"] },
+  "terminal" => { "terminal" => ["Terminal escape codes"] },
+  # Catch-all for unicode weirdness: anything that breaks by rendering/encoding, not an attack.
+  # Kept last: its patterns are broad and would swallow more specific sections above.
+  "unicode" => {
+    "special" => ["Special Characters"],
+    "controls" => ["Non-whitespace C0", "Non-whitespace C1", "Unicode additional control"],
+    "whitespace" => ["Whitespace:"],
+    "bom" => ["Byte order marks"],
+    "symbols" => ["Unicode Symbols", "Special Unicode Characters Union"],
+    "accents" => ["Unicode Subscript/Superscript/Accents"],
+    "quotes" => ["Quotation Marks"],
+    "two_byte" => ["Two-Byte Characters", "two-byte letters"],
+    "lowercase" => ["Changing length when lowercased"],
+    "scripts" => ["Ogham", "Persian special characters"],
+    "trick" => ["Trick Unicode"],
+    "upsidedown" => ["Unicode Upsidedown"],
+    "font" => ["Unicode font"]
+  }
+}.freeze
+
+# Namespaces with exactly one slug get a flat file (groups/<namespace>.txt) instead
+# of a folder with a single file in it.
+FLAT_NAMESPACES = %w[reserved rtl zalgo filenames profanity terminal].freeze
+
+# --- parse: raw BLNS section -> [strings] ---
+class SectionParser
+  attr_reader :sections
+
+  def initialize
+    @sections = []
+    @prev_comment = false
+    @current = nil
+  end
+
+  def feed(line)
+    if line.start_with?("#")
+      start_section(line) unless @prev_comment
+      @prev_comment = true
+    else
+      @prev_comment = false
+      @current[:strings] << line if @current && !line.empty?
+    end
+  end
+
+  private
+
+  def start_section(line)
+    @current = { title: line.sub(/^#\s*/, "").strip, strings: [] }
+    @sections << @current
+  end
+end
+
+def parse_sections(path)
+  parser = SectionParser.new
+  File.readlines(path, chomp: true).each { |line| parser.feed(line) }
+  parser.sections
+end
+
+# --- classify each section into a (namespace, slug) ---
+def classify(title)
+  GROUPS.each do |ns, slugs|
+    slugs.each do |slug, patterns|
+      return [ns, slug] if patterns.any? { |p| title.downcase.include?(p.downcase) }
+    end
+  end
+  nil
+end
+
+sections = parse_sections(BLNS_SOURCE)
+
+buckets = Hash.new { |h, k| h[k] = Hash.new { |hh, kk| hh[kk] = [] } }
+unmatched = []
+sections.each do |sec|
+  ns_slug = classify(sec[:title])
+  if ns_slug
+    buckets[ns_slug.first][ns_slug.last].concat(sec[:strings])
+  else
+    unmatched << sec[:title]
+  end
+end
+
+# --- write one file per (namespace, slug), no headers: the path is the group ---
+require "fileutils"
+# Wipe first: a section BLNS removes/renames must not leave a stale file behind
+# for Base's subtype auto-discovery to pick up.
+FileUtils.rm_rf(OUT_DIR)
+FileUtils.mkdir_p(OUT_DIR)
+
+buckets.each do |ns, slugs|
+  flat = FLAT_NAMESPACES.include?(ns)
+  FileUtils.mkdir_p(File.join(OUT_DIR, ns)) unless flat
+
+  slugs.each do |slug, strings|
+    path = flat ? File.join(OUT_DIR, "#{ns}.txt") : File.join(OUT_DIR, ns, "#{slug}.txt")
+    File.open(path, "w") { |f| strings.each { |s| f.puts s } }
+    printf("  %<path>-40s %<count>3d strings\n", path: path.sub("#{OUT_DIR}/", ""), count: strings.size)
+  end
+end
+
+puts
+if unmatched.empty?
+  puts "OK: all sections classified."
+else
+  puts "UNCLASSIFIED (#{unmatched.size}):"
+  unmatched.each { |t| puts "  - #{t[0, 70]}" }
+end

data/scripts/fuzzdb_build_corpus.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+# Vendors fuzzdb-project/fuzzdb's attack/ folder into
+# lib/evil_faker/data/groups/fuzzdb/. Only attack/ is vendored -- discovery/,
+# wordlists-misc/, wordlists-user-passwd/, web-backdoors/, docs/ and regex/
+# are recon wordlists/tooling, out of scope (same criterion used for every
+# other source: adversarial field input, not discovery/credential wordlists).
+#
+# fuzzdb has no declared license (no LICENSE file, license: null via the
+# GitHub API), same gap as IntruderPayloads -- vendored anyway per explicit
+# call. See NOTICE.md.
+#
+# Heavy overlap with payloads_all_the_things/ is expected and accepted: that
+# source's SQL/traversal/command lists were themselves copied from fuzzdb
+# (several files share the exact same name, e.g. traversals-8-deep-exotic-
+# encoding.txt). Base already dedupes within a merged subtype's file list
+# isn't performed across files at read time, but each importer dedupes its
+# own output, so cross-source duplicate lines just mean a slightly larger
+# corpus, not broken data.
+#
+# attack/file-upload/malicious-images/ is skipped: real binary POC files
+# (images, an EICAR test string file), not text payloads.
+#
+# attack/xss/JHADDIX_XSS_WITH_CONTEXT.doc.txt is skipped: it's prose
+# ("Exploit Name: ... Exploit String: ... Exploit Description: ...") not
+# one payload per line -- importing it raw would inject description text
+# as if it were a payload.
+#
+# Requires the `gh` CLI, authenticated (`gh auth status`).
+#
+# Usage:  ruby scripts/fuzzdb_build_corpus.rb
+
+require "open3"
+require "fileutils"
+require "json"
+
+ROOT = File.expand_path("..", __dir__)
+OUT_DIR = File.join(ROOT, "lib/evil_faker/data/groups/fuzzdb")
+REPO = "fuzzdb-project/fuzzdb"
+
+SKIP_FILES = ["README.md", "Readme.md", "docs.http-method-defs.html", "JHADDIX_XSS_WITH_CONTEXT.doc.txt"].freeze
+
+# upstream attack/ folder -> [EvilFaker namespace, subtype]. Multiple folders
+# can feed the same subtype (they're concatenated).
+SOURCES = {
+  "attack/sql-injection/detect" => %w[injection sql],
+  "attack/sql-injection/exploit" => %w[injection sql],
+  "attack/sql-injection/payloads-sql-blind" => %w[injection sql],
+  "attack/xss" => %w[injection script],
+  "attack/html_js_fuzz" => %w[injection script],
+  "attack/xml" => %w[injection xxe],
+  "attack/os-cmd-execution" => %w[injection command],
+  "attack/string-expansion" => %w[injection command],
+  "attack/lfi" => %w[injection file_inclusion],
+  "attack/path-traversal" => %w[injection directory_traversal],
+  "attack/redirect" => %w[injection open_redirect],
+  "attack/no-sql-injection" => %w[injection nosql],
+  "attack/ldap" => %w[injection ldap],
+  "attack/server-side-include" => %w[injection server_side_include],
+  "attack/all-attacks" => %w[injection generic],
+  "attack/xpath" => %w[injection xpath],
+  "attack/integer-overflow" => %w[injection integer_overflow],
+  "attack/rfi" => %w[injection rfi],
+  "attack/ip" => %w[injection ssrf],
+  "attack/json" => %w[injection json],
+  "attack/format-strings" => %w[injection format_strings],
+  "attack/authentication" => %w[injection magic_hashes],
+  "attack/disclosure-source" => %w[injection source_disclosure],
+  "attack/file-upload" => %w[injection file_upload_bypass],
+  "attack/control-chars" => %w[injection type_confusion],
+  "attack/business-logic" => %w[routes debug_params],
+  "attack/disclosure-directory" => %w[routes directory_indexing],
+  "attack/os-dir-indexing" => %w[routes directory_indexing],
+  "attack/disclosure-localpaths/unix" => %w[routes local_paths],
+  "attack/http-protocol" => %w[headers protocol],
+  "attack/mimetypes" => %w[headers mimetypes]
+}.freeze
+
+# folder -> plain filename (no subtype bucket), merged into existing flat/
+# subtyped namespaces from other sources.
+MERGE_SOURCES = {
+  "attack/control-chars/terminal-escape-codes.txt" => %w[terminal], # flat: EvilFaker::Terminal
+  "attack/control-chars/imessage.txt" => %w[exploits ios],
+  "attack/unicode/specialchars.txt" => %w[unicode special],
+  "attack/unicode/two-byte-chars.txt" => %w[unicode two_byte],
+  "attack/unicode/upsidedown.txt" => %w[unicode upsidedown],
+  "attack/unicode/corrupted.txt" => %w[unicode trick],
+  "attack/unicode/naughty-unicode.txt" => %w[unicode bad_chars],
+  "attack/unicode/emoji.txt" => %w[emoji emoji],
+  "attack/unicode/japanese-emoticon.txt" => %w[emoji emoticons],
+  "attack/unicode/regionalindicators.txt" => %w[emoji regional],
+  "attack/unicode/right-to-left.txt" => %w[rtl] # flat: EvilFaker::Rtl
+}.freeze
+
+# a NEW namespace, Faker-parity: valid/invalid edge-case emails instead of
+# realistic ones.
+EMAIL_SOURCES = {
+  "attack/email/valid-email-addresses.txt" => "valid",
+  "attack/email/invalid-email-addresses.txt" => "invalid"
+}.freeze
+
+def gh_json(path)
+  out, status = Open3.capture2("gh", "api", "repos/#{REPO}/contents/#{path}")
+  raise "gh api failed for #{path}" unless status.success?
+
+  JSON.parse(out)
+end
+
+def gh_raw(path)
+  out, status = Open3.capture2(
+    "gh", "api", "-H", "Accept: application/vnd.github.raw", "repos/#{REPO}/contents/#{path}"
+  )
+  raise "gh api failed for #{path}" unless status.success?
+
+  out
+end
+
+def clean(lines)
+  lines.reject { |l| l.strip.empty? || l.start_with?("#") }.uniq
+end
+
+def write_grouped(namespace, slug, lines)
+  FileUtils.mkdir_p(File.join(OUT_DIR, namespace))
+  File.write(File.join(OUT_DIR, namespace, "#{slug}.txt"), lines.join("\n") << "\n")
+  printf("  %<path>-28s -> %<count>5d lines\n", path: "#{namespace}/#{slug}", count: lines.size)
+end
+
+def write_flat(namespace, lines)
+  File.write(File.join(OUT_DIR, "#{namespace}.txt"), lines.join("\n") << "\n")
+  printf("  %<path>-28s -> %<count>5d lines\n", path: namespace, count: lines.size)
+end
+
+FileUtils.mkdir_p(OUT_DIR)
+
+buckets = Hash.new { |h, k| h[k] = [] }
+
+SOURCES.each do |folder, (namespace, slug)|
+  files = gh_json(folder).select do |e|
+    e["type"] == "file" && e["name"].end_with?(".txt") && !SKIP_FILES.include?(e["name"])
+  end
+  buckets[[namespace, slug]].concat(files.flat_map { |e| gh_raw("#{folder}/#{e["name"]}").lines(chomp: true) })
+end
+
+MERGE_SOURCES.each do |path, dest|
+  lines = gh_raw(path).lines(chomp: true)
+  if dest.size == 1
+    buckets[[:flat, dest.first]].concat(lines)
+  else
+    buckets[dest].concat(lines)
+  end
+end
+
+buckets.each do |key, lines|
+  if key.first == :flat
+    write_flat(key.last, clean(lines))
+  else
+    namespace, slug = key
+    write_grouped(namespace, slug, clean(lines))
+  end
+end
+
+EMAIL_SOURCES.each do |path, slug|
+  write_grouped("email", slug, clean(gh_raw(path).lines(chomp: true)))
+end
+
+puts "\nDone. Run scripts/generate_namespaces.rb next to wire up any new subtypes."

data/scripts/generate_namespaces.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+# Generates one Ruby class per namespace found under lib/evil_faker/data/groups/,
+# with an explicit `subtype` line for each sub-group file it finds -- plus one
+# class per source (e.g. EvilFaker::Blns), exposing that source's full corpus
+# unsorted by category.
+#
+# Reads namespace/subtype/source names straight off the filesystem (not off
+# any *_build_corpus.rb script), so it works no matter which source(s)
+# populated data/groups -- a namespace is whatever top-level entry (file or
+# folder) exists under any groups/<source>/, and its subtypes are whatever
+# .txt files live inside it.
+#
+# Usage:  ruby scripts/generate_namespaces.rb
+# Run after any of the scripts/*_build_corpus.rb importers.
+
+require "fileutils"
+
+ROOT            = File.expand_path("..", __dir__)
+GROUPS_ROOT     = File.join(ROOT, "lib/evil_faker/data/groups")
+OUT_DIR         = File.join(ROOT, "lib/evil_faker/groups")
+SOURCES_OUT_DIR = File.join(ROOT, "lib/evil_faker/sources")
+
+def camelize(name)
+  name.split("_").map(&:capitalize).join
+end
+
+# namespace name -> subtype names (empty for a flat, single-file namespace)
+namespace_subtypes = Hash.new { |h, k| h[k] = [] }
+
+Dir.children(GROUPS_ROOT).sort.each do |source|
+  source_dir = File.join(GROUPS_ROOT, source)
+
+  Dir.children(source_dir).sort.each do |entry|
+    path = File.join(source_dir, entry)
+
+    if File.directory?(path)
+      ns = entry
+      subtypes = Dir.children(path).select { |f| f.end_with?(".txt") }.map { |f| File.basename(f, ".txt") }
+      namespace_subtypes[ns].concat(subtypes)
+    else
+      namespace_subtypes[File.basename(entry, ".txt")] # touch the key, no subtypes
+    end
+  end
+end
+
+FileUtils.rm_rf(OUT_DIR)
+FileUtils.mkdir_p(OUT_DIR)
+
+namespace_subtypes.sort.each do |ns, subtypes|
+  subtype_lines = subtypes.uniq.sort.map { |s| "    subtype :#{s}\n" }.join
+
+  File.write(File.join(OUT_DIR, "#{ns}.rb"), <<~RUBY)
+    # frozen_string_literal: true
+
+    module EvilFaker
+      # Generated by scripts/generate_namespaces.rb -- do not edit by hand.
+      class #{camelize(ns)} < Base
+        group "#{ns}"
+    #{subtype_lines.empty? ? "" : "\n#{subtype_lines}"}  end
+    end
+  RUBY
+  puts "  #{ns}.rb#{subtypes.empty? ? "" : " (#{subtypes.uniq.size} subtypes)"}"
+end
+
+puts "\nGenerated #{namespace_subtypes.size} namespace classes in lib/evil_faker/groups/"
+
+FileUtils.rm_rf(SOURCES_OUT_DIR)
+FileUtils.mkdir_p(SOURCES_OUT_DIR)
+
+sources = Dir.children(GROUPS_ROOT).sort
+
+sources.each do |source|
+  File.write(File.join(SOURCES_OUT_DIR, "#{source}.rb"), <<~RUBY)
+    # frozen_string_literal: true
+
+    module EvilFaker
+      # Generated by scripts/generate_namespaces.rb -- do not edit by hand.
+      class #{camelize(source)} < SourceBase
+        source "#{source}"
+      end
+    end
+  RUBY
+  puts "  #{source}.rb"
+end
+
+puts "\nGenerated #{sources.size} source classes in lib/evil_faker/sources/"

data/scripts/intruder_payloads_build_corpus.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+# Vendors a curated subset of 1N3/IntruderPayloads (MIT) into
+# lib/evil_faker/data/groups/intruder_payloads/.
+#
+# Skipped entirely: BurpAttacks/ (binary .burp ZIP exports, not text),
+# Plugins/ (.jar files), BurpBountyPayloads/ (JSON scanner-rule configs with
+# only 1-2 payloads each behind a lot of scanner metadata -- not worth a
+# parser for that little yield).
+#
+# Many FuzzLists/*.txt lines aren't standalone strings: they use the literal
+# token INJECTX as a placeholder where Burp Intruder would splice in a
+# payload from a *second* list. Those lines are meaningless out of context,
+# so every line containing "injectx" (case-insensitive) is dropped. Three
+# files are almost entirely such templates (xss_payloads_quick.txt,
+# xss_remote_payloads-http(s).txt) and are skipped outright, as are
+# grep_injectx.txt / payload_injectx.txt (pure template lists).
+#
+# Also skipped: dirbuster-*.txt / toplist-sorted.txt / passwords_*.txt /
+# usernames.txt / vulnerability_discovery.txt (recon/credential wordlists,
+# not adversarial field input) and url_payloads.txt (the author's own
+# callback domains, not generically reusable).
+#
+# Uploads/ is different: the malicious payload IS the filename (e.g.
+# `shell.php%00.jpg`), not file content -- so its entries are read from the
+# directory listing itself and merged into the flat EvilFaker::Filenames group.
+#
+# Requires the `gh` CLI, authenticated (`gh auth status`).
+#
+# Usage:  ruby scripts/intruder_payloads_build_corpus.rb
+
+require "open3"
+require "fileutils"
+require "json"
+
+ROOT = File.expand_path("..", __dir__)
+OUT_DIR = File.join(ROOT, "lib/evil_faker/data/groups/intruder_payloads")
+REPO = "1N3/IntruderPayloads"
+
+# FuzzLists/<file> -> [EvilFaker namespace, subtype], merged file-by-file
+# (unlike PayloadsAllTheThings, sources here are individual files, not
+# whole folders).
+FUZZLIST_SOURCES = {
+  "sqli-error-based.txt" => %w[injection sql],
+  "sqli-time-based.txt" => %w[injection sql],
+  "sqli-union-select.txt" => %w[injection sql],
+  "sqli_escape_chars.txt" => %w[injection sql],
+  "auth_bypass.txt" => %w[injection sql],
+  "xss_escape_chars.txt" => %w[injection script],
+  "xss_find_inject.txt" => %w[injection script],
+  "xss_funny_stored.txt" => %w[injection script],
+  "xss_grep.txt" => %w[injection script],
+  "xss_swf_fuzz.txt" => %w[injection script],
+  "lfi.txt" => %w[injection file_inclusion],
+  "traversal.txt" => %w[injection directory_traversal],
+  "traversal-short.txt" => %w[injection directory_traversal],
+  "xml-attacks.txt" => %w[injection xxe],
+  "command_exec.txt" => %w[injection command],
+  "ssi_quick.txt" => %w[injection server_side_include],
+  "overflow.txt" => %w[injection overflow],
+  "overflow-dos.txt" => %w[injection overflow],
+  "bad_chars.txt" => %w[unicode bad_chars],
+  "basic_fuzz.txt" => %w[injection generic],
+  "full_fuzz.txt" => %w[injection generic],
+  "quick_fuzz.txt" => %w[injection generic]
+}.freeze
+
+def gh_json(path)
+  out, status = Open3.capture2("gh", "api", "repos/#{REPO}/contents/#{path}")
+  raise "gh api failed for #{path}" unless status.success?
+
+  JSON.parse(out)
+end
+
+def gh_raw(path)
+  out, status = Open3.capture2(
+    "gh", "api", "-H", "Accept: application/vnd.github.raw", "repos/#{REPO}/contents/#{path}"
+  )
+  raise "gh api failed for #{path}" unless status.success?
+
+  out
+end
+
+def clean(lines)
+  lines.reject { |l| l.strip.empty? || l.start_with?("#") || l.match?(/injectx/i) }.uniq
+end
+
+def write(namespace, slug, lines)
+  FileUtils.mkdir_p(File.join(OUT_DIR, namespace))
+  File.write(File.join(OUT_DIR, namespace, "#{slug}.txt"), lines.join("\n") << "\n")
+  printf("  %<path>-28s -> %<count>5d lines\n", path: "#{namespace}/#{slug}", count: lines.size)
+end
+
+# Flat namespace (EvilFaker::Filenames has no subtypes) -> file goes straight at
+# groups/intruder_payloads/<namespace>.txt, not nested in a subtype folder.
+def write_flat(namespace, lines)
+  File.write(File.join(OUT_DIR, "#{namespace}.txt"), lines.join("\n") << "\n")
+  printf("  %<path>-28s -> %<count>5d lines\n", path: namespace, count: lines.size)
+end
+
+FileUtils.mkdir_p(OUT_DIR)
+
+buckets = Hash.new { |h, k| h[k] = [] }
+FUZZLIST_SOURCES.each do |file, (namespace, slug)|
+  buckets[[namespace, slug]].concat(gh_raw("FuzzLists/#{file}").lines(chomp: true))
+end
+buckets.each { |(namespace, slug), lines| write(namespace, slug, clean(lines)) }
+
+upload_names = gh_json("Uploads").select { |e| e["type"] == "file" }.map { |e| e["name"] }
+write_flat("filenames", upload_names.reject(&:empty?).uniq)
+
+puts "\nDone. Run scripts/generate_namespaces.rb next to wire up any new subtypes."

data/scripts/payloads_all_the_things_build_corpus.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+# Vendors a curated subset of swisskyrepo/PayloadsAllTheThings (MIT) into
+# lib/evil_faker/data/groups/payloads_all_the_things/.
+#
+# Only folders that ship a real Intruder/Intruders directory of plain .txt
+# payloads are pulled in -- most of the repo's ~60 top-level folders are
+# Markdown write-ups with no payload list to vendor, so this is a hand-picked
+# allowlist, not a full mirror. Re-run to refresh; each namespace/slug's file
+# is fully replaced from upstream every time (dedup + drop blank/comment lines).
+#
+# Requires the `gh` CLI, authenticated (`gh auth status`).
+#
+# Usage:  ruby scripts/payloads_all_the_things_build_corpus.rb
+
+require "open3"
+require "fileutils"
+
+ROOT = File.expand_path("..", __dir__)
+OUT_DIR = File.join(ROOT, "lib/evil_faker/data/groups/payloads_all_the_things")
+REPO = "swisskyrepo/PayloadsAllTheThings"
+
+# upstream folder (with its Intruder/Intruders dir) -> [EvilFaker namespace, subtype]
+SOURCES = {
+  "SQL Injection/Intruder" => %w[injection sql],
+  "NoSQL Injection/Intruder" => %w[injection nosql],
+  "LDAP Injection/Intruder" => %w[injection ldap],
+  "XSS Injection/Intruders" => %w[injection script],
+  "XXE Injection/Intruders" => %w[injection xxe],
+  "Server Side Template Injection/Intruder" => %w[injection ssti],
+  "Command Injection/Intruder" => %w[injection command],
+  "File Inclusion/Intruders" => %w[injection file_inclusion],
+  "Directory Traversal/Intruder" => %w[injection directory_traversal],
+  "Open Redirect/Intruder" => %w[injection open_redirect],
+  # Not injection payloads (single field strings) -- these are wordlists, so
+  # they get their own namespaces instead of forcing them into Injection.
+  "Insecure Management Interface/Intruder" => %w[routes admin_interfaces],
+  "Web Cache Deception/Intruders" => %w[headers cache_deception]
+}.freeze
+
+def gh_json(path)
+  out, status = Open3.capture2("gh", "api", "repos/#{REPO}/contents/#{path}")
+  raise "gh api failed for #{path}" unless status.success?
+
+  require "json"
+  JSON.parse(out)
+end
+
+def gh_raw(path)
+  out, status = Open3.capture2(
+    "gh", "api", "-H", "Accept: application/vnd.github.raw", "repos/#{REPO}/contents/#{path}"
+  )
+  raise "gh api failed for #{path}" unless status.success?
+
+  out
+end
+
+def clean(lines)
+  lines.reject { |l| l.strip.empty? || l.start_with?("#") }.uniq
+end
+
+def write(namespace, slug, lines)
+  FileUtils.mkdir_p(File.join(OUT_DIR, namespace))
+  File.write(File.join(OUT_DIR, namespace, "#{slug}.txt"), lines.join("\n") << "\n")
+  printf("  %<path>-28s -> %<count>5d lines\n", path: "#{namespace}/#{slug}", count: lines.size)
+end
+
+SOURCES.each do |folder, (namespace, slug)|
+  entries = gh_json(folder).select { |e| e["type"] == "file" }
+  lines = entries.flat_map { |e| gh_raw("#{folder}/#{e["name"]}").lines(chomp: true) }
+  write(namespace, slug, clean(lines))
+end
+
+puts "\nDone. Run scripts/generate_namespaces.rb next to wire up any new subtypes."

data/sig/evil_faker.rbs

@@ -0,0 +1,4 @@
+module EvilFaker
+  VERSION: String
+  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+end