OT but is there a way to see projects with the most stars on github?
This one seems to be skyrocketing.
Oh here we go, and lookie who is at the top: https://github.com/trending
Show HN: Big List of Naughty Strings for testing user-input data
51–60 of 80 posts
Re: Show HN: Big List of Naughty Strings for testing user-input data
#52One fun (and very interesting) string is EICAR[0]. I worked for an antivirus company once and we had the EICAR string for testing but couldn't check it into source control because it triggered the AV software which we dogfooded... Is it naughty to include it here? X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* [0] https://en.wikipedia.org/wiki/EICAR_test_file
Fun times indeed. Windows defender picks up a test.txt with those contents as malicious (and closes the file handle causing Notepad to misbehave) but if you add a space between EI and CAR it doesn't see anything.
Edit: Seriously, Microsoft?
Category: Virus
Description: This program is dangerous and replicates by infecting other files.
Recommended action: Remove this software immediately.
Items: file:C:\Users\Adam\Desktop\test.txt
Re: Show HN: Big List of Naughty Strings for testing user-input data
#53Great list. A few questions:
* How could this be used to test 'corrupt' characters? Isn't the process of savign the file itself as UTF-8 un-corrupt...the file?
* Is there some recommended way to group these into "strings that should pass validation" versus "strings that should fail"... or is that too application-specific?
Re: Show HN: Big List of Naughty Strings for testing user-input data
#54One fun (and very interesting) string is EICAR[0]. I worked for an antivirus company once and we had the EICAR string for testing but couldn't check it into source control because it triggered the AV software which we dogfooded... Is it naughty to include it here? X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* [0] https://en.wikipedia.org/wiki/EICAR_test_file
Fun times indeed. Windows defender picks up a test.txt with those contents as malicious (and closes the file handle causing Notepad to misbehave) but if you add a space between EI and CAR it doesn't see anything. Edit: Seriously, Microsoft? Category: Virus Description: This program is dangerous and replicates by infecting other files. Recommended action: Remove this software immediately. Items: file:C:\Users\Adam\Des…
Microsoft is doing the right thing. The whole point of that string is to trigger such behaviour. It's so you can use it to test that your antivirus is working.
Re: Show HN: Big List of Naughty Strings for testing user-input data
#55OT but is there a way to see projects with the most stars on github? This one seems to be skyrocketing. Oh here we go, and lookie who is at the top: https://github.com/trending
Re: Show HN: Big List of Naughty Strings for testing user-input data
#56For more great examples of "naughty" strings see the Twitter @glitchr_ account.
https://twitter.com/glitchr_
Re: Show HN: Big List of Naughty Strings for testing user-input data
#57This should be really handy for fuzz testing, nice work!
Re: Show HN: Big List of Naughty Strings for testing user-input data
#58I absolutely love strange unicode strings. It's handy if you ever want to find out what a server's running. One time, I put a bunch of emoji's in a GET param of a Google site, then got a big Java error page. I had no idea Google ran Java.
Edit: Another one that tends to be fun is [] in the param, like http://example.com/?get[]=[].
And you can things inside, like http://example.com/?get['"%05
Re: Show HN: Big List of Naughty Strings for testing user-input data
#59Complete AI is no the hardest problem in CS, parsing text is. Joking aside this reminded me of that CSS vulnerability that allowed attackers to read peoples mails: http://scarybeastsecurity.blogspot.com/2009/12/generic-cross...
Re: Show HN: Big List of Naughty Strings for testing user-input data
#60Earlier quoted context omitted.
Fun times indeed. Windows defender picks up a test.txt with those contents as malicious (and closes the file handle causing Notepad to misbehave) but if you add a space between EI and CAR it doesn't see anything. Edit: Seriously, Microsoft? Category: Virus Description: This program is dangerous and replicates by infecting other files. Recommended action: Remove this software immediately. Items: file:C:\Users\Adam\Des…
Microsoft is doing the right thing. The whole point of that string is to trigger such behaviour. It's so you can use it to test that your antivirus is working.
Should it really tell the user that it's a dangerous file? Although if it didn't, malicious files could use that to their advantage.