imadeanai-blog - Tumblr blog

imadeanai-blog · 8 years ago

Text

# Reserved Strings # # Strings which may be used elsewhere in code

undefined undef null NULL (null) nil NIL true false True False None \ \

# Numeric Strings # # Strings which can be interpreted as numeric

0 1 1.00 $1.00 ½ 1E2 1E02 1E+02 -1 -1.00 -$1.00 -½ -1E2 -1E02 -1E+02 1/0 0/0 -2147483648/-1 -9223372036854775808/-1 0.00 0..0 . 0.0.0 0,00 0,,0 , 0,0,0 0.0/0 1.0/0.0 0.0/0.0 1,0/0,0 0,0/0,0 –1 - -. -, 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 NaN Infinity -Infinity INF 1#INF -1#IND 1#QNAN 1#SNAN 1#IND 0x0 0xffffffff 0xffffffffffffffff 0xabad1dea 123456789012345678901234567890123456789 1,000.00 1 000.00 1'000.00 1,000,000.00 1 000 000.00 1'000'000.00 1.000,00 1 000,00 1'000,00 1.000.000,00 1 000 000,00 1'000'000,00 01000 08 09 2.2250738585072011e-308

# Special Characters # # Strings which contain common special ASCII characters (may need to be escaped)

,./;’[]-= <>?:“{}|_+ !@#$%^&*()`~

# Unicode Symbols # # Strings which contain common unicode symbols (e.g. smart quotes)

Ω≈ç√∫˜µ≤≥÷ åß∂ƒ©˙∆˚¬…æ œ∑´®†¥¨ˆøπ“‘ ¡™£¢∞§¶•ªº–≠ ¸˛Ç◊ı˜Â¯˘¿ ÅÍÎÏ˝ÓÔÒÚÆ☃ Œ„´‰ˇÁ¨ˆØ∏”’ `⁄€‹›ﬁﬂ‡°·‚—± ⅛⅜⅝⅞ ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя ٠١٢٣٤٥٦٧٨٩

# Unicode Subscript/Superscript # # Strings which contain unicode subscripts/superscripts; can cause rendering issues

⁰⁴⁵ ₀₁₂ ⁰⁴⁵₀₁₂

# Quotation Marks # # Strings which contain misplaced quotation marks; can cause encoding errors

’ ” “ ”“ ’”’ “”“”’“ ”’“’”“”“ <foo val=“bar” /> <foo val=“bar” /> <foo val=”bar“ /> <foo val=`bar’ />

# Two-Byte Characters # # Strings which contain two-byte characters: can cause rendering issues or character-length issues

“c’†‚³‚ٌ‚ة‚ ‚°‚ؤ‰؛‚³‚¢ ƒpپ[ƒeƒBپ[‚ضچs‚©‚ب‚¢‚© کaگ»ٹ؟Œê •”—ژٹi »çب¸°ْاذ؟ّ ¾îاذ؟¬±¸¼ز ھBآ÷¸¦ إ¸°ي ؟آ ¼„½أ¸ا°ْ œ؛´ظ¸® Œc¹و°¢اد قنüهخ،ùتêآهقùت研د¼ل¶ ؟ï¶ُ¹ظإن¸£ 𠜎𠜱𠝹𠱓𠱸𠲖𠳏

# Japanese Emoticons # # Strings which consists of Japanese-style emoticons which are popular on the web

پR༼ຈل͜ຈ༽ة پR༼ຈل͜ຈ༽ة (،◕ پح ◕،) پM¨(´∀پMپ؟ __غ(,_,*) پE(پPپحپP)پE:*: ك¥✿پS╲(،◕‿◕،)╱✿¥ك ,پBپE:*:پEپK’( ☻ ω ☻ )پBپE:*:پEپK’ (╯°□°）╯︵ ┻━┻) (ةಥ‰vಥپjة „³„ھ„³ ( ͡° ͜ʖ ͡°)

# Emoji # # Strings which contain Emoji; should be the same behavior as two-byte characters, but not always

😍 👩🏽 👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 🐵 🙈 🙉 🙊 ❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 ✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟

# Unicode Numbers # # Strings which contain unicode numbers; if the code is localized, it should see the input as numeric

１２３ ١٢٣

# Right-To-Left Strings # # Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew)

ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر الحدود أي بعد, معاملة بولندا، الإطلاق عل إيو. בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ הָיְתָהtestالصفحات التّحول ﷽ ﷺ

# Unicode Spaces # # Strings which contain unicode space characters with special properties (c.f. https://www.cs.tut.fi/~jkorpela/chars/spaces.html)

  ᠎ ،، ␣ ␢ ␡

# Trick Unicode # # Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf)

‪‪test‪ ‫test‫

test

test⁠test‫ ⁦test⁧

# Zalgo Text # # Strings which contain "corrupted” text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net)

Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ͏͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ ̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔ل̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞̠̫̰ ̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙̻̝f ̪̰̰̗̖̭̘͘c̦͍̲̞��̩̙ḥ͚a̮͎̟̙͜ơ̩̹͎s̤.̝̝ ҉Z̡̖̜͖̰̣͉̜a͖̰͙̬͡l̲̫̳͍̩g̡̟̼̱͚̞̬ͅo̗͜.̟ ̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣l̴͔̰̤̟͔ḽ̫.͕ Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮

# Unicode Upsidedown # # Strings which contain unicode with an “upsidedown” effect (via http://www.upsidedowntext.com)

ےɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs ‘ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ 00ےƖ$-

# Unicode font # # Strings which contain bold/italic/etc. versions of normal characters

£ش£è£ه £ٌ£ُ£é£م£ë £â£ٍ£ï£÷£î £و£ï£ّ £ê£ُ£ي£ً£َ £ï£ِ£ه£ٍ £ô£è£ه £ى£ل£ْ£ù £ن£ï£ç 𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 ⒯⒣⒠ ©ف©ل©ص©د©× ©خ©ق©غ©م©ع ©ز©غ©ن ©ض©ل©ظ©ـ©ك ©غ©â©ر©ق ©à©ش©ر ©ط©ح©و©ه ©ذ©غ©س

# Script Injection # # Strings which attempt to invoke a benign script injection; shows vulnerability to XSS

# SQL Injection # # Strings which can cause a SQL injection if inputs are not sanitized

1;DROP TABLE users 1’; DROP TABLE users– 1 ’ OR 1=1 – 1 ’ OR '1’='1

% _

# Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153)

- – –version –help $USER /dev/null; touch /tmp/blns.fail ; echo `touch /tmp/blns.fail` $(touch /tmp/blns.fail) @{[system “touch /tmp/blns.fail”]}

# Command Injection (Ruby) # # Strings which can call system commands within Ruby/Rails applications

eval(“puts 'hello world’”) System(“ls -al /”) `ls -al /` Kernel.exec(“ls -al /”) Kernel.exit(1) %x('ls -al /’)

# XXE Injection (XML) # # String which can reveal system files when parsed by a badly configured XML parser

<?xml version=“1.0” encoding=“ISO-8859-1”?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM “file:///etc/passwd” >]><foo>&xxe;</foo>

# Unwanted Interpolation # # Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just represent the wrong string.

$HOME $ENV{'HOME’} %d %s {0} %*.*s

# File Inclusion # # Strings which can cause user to pull in files that should not be a part of a web server

../../../../../../../../../../../etc/passwd%00 ../../../../../../../../../../../etc/hosts

# Known CVEs and Vulnerabilities # # Strings that test for known vulnerabilities

() { 0; }; touch /tmp/blns.shellshock1.fail; () { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; }

# MSDOS/Windows Special Filenames # # Strings which are reserved characters in MSDOS/Windows

CON PRN AUX CLOCK$ NUL A: ZZ: COM1 LPT1 LPT2 LPT3 COM2 COM3 COM4

# Scunthorpe Problem # # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)

Scunthorpe General Hospital Penistone Community Church Lightwater Country Park Jimmy Clitheroe Horniman Museum shitake mushrooms RomansInSussex.co.uk http://www.cum.qc.ca/ Craig Cockburn, Software Specialist Linda Callahan Dr. Herman I. Libshitz magna cum laude Super Bowl XXX medieval erection of parapets evaluate mocha expression Arsenal canal classic Tyson Gay basement

# Human injection # # Strings which may cause human to reinterpret worldview

If you’re reading this, you’ve been in a coma for almost 20 years now. We’re trying a new technique. We don’t know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.

# Terminal escape codes # # Strings which punish the fools who use cat/type on this file

Roses are [0;31mred[0m, violets are [0;34mblue. Hope you enjoy terminal hue But now…[20Cfor my greatest trick…[8m The quick brown fo x… [Beeeep]

# iOS Vulnerability # # Strings which crashed iMessage in iOS versions 8.3 and earlier

Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣبك

<?xml version=“1.0” encoding=“UTF-8”?><alphabetFile xsi:schemaLocation=“urn:schemas-microsoft-com:tabletpc:alphabet.v1 Alphabet.xsd” xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance” xmlns=“urn:schemas-microsoft-com:tabletpc:alphabet.v1”><trainer family=“latin” comment=“Dutch - All” id=“19”><symbol id=“A” confusables=“atÂ*”/><symbol id=“Á” confusables=“ÄÂÀA”/><symbol id=“À” confusables=“ÂÄàÁ”/><symbol id=“Â” confusables=“ÀâÁÄ”/><symbol id=“Ä” confusables=“ÀÁÂä”/><symbol id=“B” confusables=“bD31”/><symbol id=“C” confusables=“c([e”/><symbol id=“Ç” confusables=“çG§E”/><symbol id=“D” confusables=“dBPb”/><symbol id=“E” confusables=“eFÉt”/><symbol id=“É” confusables=“ÊËEÈ”/><symbol id=“È” confusables=“ÉÊËE”/><symbol id=“Ê” confusables=“ÈÉEê”/><symbol id=“Ë” confusables=“ÈÉëÊ”/><symbol id=“F” confusables=“fIE±”/><symbol id=“G” confusables=“gÇ6E”/><symbol id=“H” confusables=“htN#”/><symbol id=“I” confusables=“l1/i”/><symbol id=“Í” confusables=“íiÏI”/><symbol id=“Î” confusables=“îiÍT”/><symbol id=“Ï” confusables=“ïiÍI”/><symbol id=“J” confusables=“Ij]3”/><symbol id=“K” confusables=“kRHr”/><symbol id=“L” confusables=“l<2h”/><symbol id=“M” confusables=“mNnH”/><symbol id=“N” confusables=“nMwW”/><symbol id=“O” confusables=“0o°Ó”/><symbol id=“Ó” confusables=“óÖöo”/><symbol id=“Ö” confusables=“ö°Óó”/><symbol id=“P” confusables=“pDBT”/><symbol id=“Q” confusables=“qOo°”/><symbol id=“R” confusables=“rKkN”/><symbol id=“S” confusables=“s5g$”/><symbol id=“T” confusables=“t+±F”/><symbol id=“U” confusables=“u4vK”/><symbol id=“Ú” confusables=“úÜÛü”/><symbol id=“Û” confusables=“ûúÚü”/><symbol id=“Ü” confusables=“üÛäÚ”/><symbol id=“V” confusables=“vruU”/><symbol id=“W” confusables=“wnuN”/><symbol id=“X” confusables=“x*t+”/><symbol id=“Y” confusables=“y¥4x”/><symbol id=“Z” confusables=“z2ra”/><symbol id=“a” confusables=“Aádq”/><symbol id=“á” confusables=“àäâÁ”/><symbol id=“à” confusables=“âäÀ°”/><symbol id=“â” confusables=“àÂä°”/><symbol id=“ä” confusables=“Äà°ö”/><symbol id=“b” confusables=“lBf5”/><symbol id=“c” confusables=“C(e<”/><symbol id=“ç” confusables=“Ç§GE”/><symbol id=“d” confusables=“aA8&”/><symbol id=“e” confusables=“éclè”/><symbol id=“é” confusables=“èëeê”/><symbol id=“è” confusables=“éêëe”/><symbol id=“ê” confusables=“èéeë”/><symbol id=“ë” confusables=“èéïê”/><symbol id=“f” confusables=“tFG£”/><symbol id=“g” confusables=“9Gqy”/><symbol id=“h” confusables=“knbL”/><symbol id=“i” confusables=“íIïj”/><symbol id=“í” confusables=“ÍiïI”/><symbol id=“î” confusables=“ÎiïT”/><symbol id=“ï” confusables=“Ïi"í”/><symbol id=“j” confusables=“Ji;I”/><symbol id=“k” confusables=“Kh4t”/><symbol id=“l” confusables=“I1L(”/><symbol id=“m” confusables=“MnNw”/><symbol id=“n” confusables=“Nmhu”/><symbol id=“o” confusables=“0O°ó”/><symbol id=“ó” confusables=“ÓöoÖ”/><symbol id=“ö” confusables=“Ö°óä”/><symbol id=“p” confusables=“P1rB”/><symbol id=“q” confusables=“g9QG”/><symbol id=“r” confusables=“vznV”/><symbol id=“s” confusables=“S5g9”/><symbol id=“t” confusables=“E+£T”/><symbol id=“u” confusables=“U4na”/><symbol id=“ú” confusables=“Úüûá”/><symbol id=“û” confusables=“Ûúüâ”/><symbol id=“ü” confusables=“Üäûú”/><symbol id=“v” confusables=“VurU”/><symbol id=“w” confusables=“Wunv”/><symbol id=“x” confusables=“X*t+”/><symbol id=“y” confusables=“Y4xJ”/><symbol id=“z” confusables=“Z2ra”/><symbol id=“0” confusables=“oO°d”/><symbol id=“1” confusables=“Il’/”/><symbol id=“2” confusables=“zZr1”/><symbol id=“3” confusables=“J}sI”/><symbol id=“4” confusables=“uyUY”/><symbol id=“5” confusables=“sSJg”/><symbol id=“6” confusables=“Gbtf”/><symbol id=“7” confusables=“Jf1Z”/><symbol id=“8” confusables=“P°o±”/><symbol id=“9” confusables=“gqGy”/><symbol id=“_” confusables=“-.=~”/><symbol id=“-” confusables=“.~rn”/><symbol id=“(” confusables=“lCcL”/><symbol id=“[” confusables=“C(Ec”/><symbol id=“{” confusables=“E[lL”/><symbol id=“„” confusables=“"1±,”/><symbol id=“)” confusables=“J]I,”/><symbol id=“]” confusables=“JI3,”/><symbol id=“}” confusables=“3J,I”/><symbol id=“’” confusables=“,1.I”/><symbol id=“!” confusables=“l?tf”/><symbol id=“”“ confusables="„1±,”/><symbol id=“#” confusables=“*¥Ht”/><symbol id=“%” confusables=“o09q”/><symbol id=“&” confusables=“*R8r”/><symbol id=“*” confusables=“#A¥t”/><symbol id=“,” confusables=“’.1J”/><symbol id=“.” confusables=“-’;á”/><symbol id=“/” confusables=“1lI’”/><symbol id=“:” confusables=“;.’!”/><symbol id=“;” confusables=“:ij±”/><symbol id=“?” confusables=“!721”/><symbol id=“@” confusables=“aQde”/><symbol id=“" confusables="l1I’”/><symbol id=“~” confusables=“nr-v”/><symbol id=“+” confusables=“tT±*”/><symbol id=“<” confusables=“cClL”/><symbol id=“=” confusables=“±<ex”/><symbol id=“>” confusables=“7,s)”/><symbol id=“±” confusables=“I¥€F”/><symbol id=“$” confusables=“§BsD”/><symbol id=“£” confusables=“Ef€t”/><symbol id=“¥” confusables=“EI±#”/><symbol id=“€” confusables=“E£et”/><symbol id=“§” confusables=“$çs5”/><symbol id=“°” confusables=“o0O.”/><phraseCue>Schrijf de zin hierboven eenmaal over.</phraseCue><phraseSet id=“PhraseSet1”><phrase>76% Van de studenten is geslaagd; 14% is gezakt.</phrase><phrase>“Kóm hier! Nú!” riep Yvonne naar haar zoon Zeno.</phrase><phrase>Mijn telefoonnummer is: 020 - 526 55 87.</phrase><phrase>Ik ben geboren te ’s-Gravenhage op 25/04/1973.</phrase><phrase>Wachtwoorden met een *,{,},\,[ of ] zijn ongeldig.</phrase><phrase>Welkom bij ING: Je wachtwoord is *Eylül~Göx*.</phrase><phrase>Haar website is http://www.ELIZABETH~BISCHOF.com.</phrase><phrase>Ivo wist niet dat Zoë en Ines zussen zijn.</phrase><phrase>Mijn e-mailadres is Maartje@Möllen_Krüllern.nl.</phrase><phrase>Île-de-France betekent Eiland van Frankrijk?</phrase><phrase>Mijn adres is Ieperlaan 84, 5233 RH ’s-Hertogenbosch.</phrase><phrase>Rijen Q->U en W->X voor het Lütfü concert zijn vol.</phrase><phrase>De meester noteerde: 5+8 < 9+8 > 6+1.</phrase><phrase>Café en enquête zijn vernederlandste Franse woorden.</phrase><phrase>De bankier noteerde: € 1 = $ 1,5877 = ¥ 168,97.</phrase><phrase>Het symbool voor de Japanse yen is '¥’.</phrase><phrase>In 2001 boekte hij een 6% winst van £ 800.000.</phrase><phrase>De Britse £ versterkt, maar de Amerikaanse $ verzwakt.</phrase><phrase>Vóór ons coördinatiegesprek was Max nog in orde.</phrase><phrase>De geïmproviseerde trip naar Ethiopië was vreselijk.</phrase><phrase>“SCHUIF AAN IN DEZE RIJ A.U.B.,” schreef Hélène.</phrase><phrase>Tom las de 6 laatste letters van het alfabet: 'UVWXYZ’.</phrase><phrase>“Waarom is Adèle niet geïnteresseerd?” schreef Pol.</phrase><phrase>Ik heb maar een páár koekjes; ik wil een héle zak!</phrase><phrase>De letters à, â, ç en ê komen veel voor in het Frans.</phrase><phrase>“Onze financiële situatie is een rámp!” riep Lea.</phrase><phrase>De kaart kost £ 4. Kan je me £ 1 lenen? </phrase><phrase>De geïmporteerde crème uit Bäretswil kost € 4.</phrase><phrase>“Zít!” riepen Xander en Adelaïde samen.</phrase><phrase>Gaan Benoît en François deze zomer naar Alstätten?</phrase><phrase>De code voor de voordeur is: [#TUK&VO_PUQ&CY].</phrase><phrase>Het symbool ’@’ noemt men een apenstaartje.</phrase><phrase>Stuur het naar haar e-mailadres: Píx_Tà[email protected].</phrase><phrase>5° Celsius is ± 41° Fahrenheit.</phrase><phrase>€ 5 is tegenwoordig ± $ 8 of ± ¥ 845 waard.</phrase><phrase>De 'tilde’ of ’~’ wordt vaak gebruikt in computertaal.</phrase><phrase>Is dit correct: (5+3) < (8-2) en (6-1) < (8+9) ?</phrase><phrase>De 'backslash’ is de benaming voor het leesteken ’'.</phrase><phrase>Het document is opgeslagen onder C:\Mijn documenten\Jo.</phrase><phrase>Volgende tekens noemt men 'haakjes’: ( ), [ ], { }.</phrase><phrase>'Château’ is het Franse woord voor 'kasteel’.</phrase><phrase>“Búk je!” riep Dominique.</phrase><phrase>Jacob is alleen; zijn vrouw heeft hem verlaten.</phrase><phrase>Een verzoek aan Vera & Bulkjens is in behandeling.</phrase><phrase>De leerkracht fysica noteerde: 5°C = …°F?</phrase><phrase>De accolades { en } noemt men ook gekrulde haakjes. </phrase><phrase>Mijn mama’s telefoonnummer is: 0569 349 998.</phrase><phrase>'ALLES = € 1’ staat in het groot op zijn winkel.</phrase><phrase>Dag Annie, alles goed met je?</phrase><phrase>Bas is een echte grapjas.</phrase></phraseSet><phraseSet id=“PhraseSet2”><phrase>Sla het bestand a.u.b. op onder C:\QUOT_INFO_3~8\fin.</phrase><phrase>“Zít! Nú!” riep Noël naar zijn hond Rémy.</phrase><phrase>39,5 °C komt overeen met ± 103°F.</phrase><phrase>Hij bezit ± € 70.583; dat is ± ¥ 7.532.952.</phrase><phrase>Dit was de examenvraag: (5x9) + (7-3) + (40/4) = …? </phrase><phrase>'GELIEVE TE WACHTEN’ stond er op het bord. </phrase><phrase>Quinten is eenzaam; Simone heeft hem verlaten.</phrase><phrase>Iedereen is welkom; ik hoop echter dat Jan wegblijft.</phrase><phrase>Blokhaakjes zien er als volgt uit: [ en ].</phrase><phrase>Zijn Gökce en Ergüvenç afkomstig uit Turkije?</phrase><phrase>Toets a.u.b. volgende code in: [*ä&î~~êâ4*].</phrase><phrase>François wordt dit jaar tweeënveertig.</phrase><phrase>Op het eind van mijn carrière verdiende ik $ 175.664. </phrase><phrase>“Móói! Zeg nu eens, gelooft Thérèse echt in elfen?” </phrase><phrase>Aïda weegt maar 54,2 kg.; ideaal voor een mannequin.</phrase><phrase>Er zijn veel 16- en 17-jarige cocaïneverslaafden.</phrase><phrase>Dit is volgens Jean-Pièrre geïmiteerde Leidse klei.</phrase><phrase>Faeröer spreek je als volgt uit: [fêêr-eu-er].</phrase><phrase>Bäretswil is een dorpje in het Zwitserse kanton Zürich.</phrase><phrase>“Nou, dá’s straf! $ 40 is níks!” riep José uit.</phrase><phrase>Hij legde uit: “Als 8+9 > 5-1 dan is 5-1 < 8+9.”</phrase><phrase>Hélène heeft € 1.337,50 geïnvesteerd; dat is $ 2.116,37.</phrase><phrase>“Noemt men ( ), [ ], { } en < > haakjes?” vroeg ze.</phrase><phrase>Aimé en Eugène hebben één e-mailadres: [email protected].</phrase><phrase>“Húp, húp, dánsen!” zong Benoît uit volle borst.</phrase><phrase>De website van Yvo’s zaak is http://Château_St_Miq.com.</phrase><phrase>'GEEN VUURWAPENS A.U.B’ staat er op de deur.</phrase><phrase>Xander en Yvonne Lootens wonen in ’s-Gravenhage.</phrase><phrase>H&M boekte in 2007 15% winst (ongeveer € 69.000).</phrase><phrase>Karoline Van Wanten is qua uiterlijk perfect.</phrase><phrase>“Dat is ídeaal!” riepen Max en Yolanda.</phrase><phrase>De Engelsman gaf me slechts £ 1 i.p.v. £ 2 terug.</phrase><phrase>£ 1 is momenteel ¥ 211,463 waard.</phrase><phrase>Neem minstens ¥ 7.532 mee voor je trip naar Japan.</phrase><phrase>Het was snikheet in Qatar, ongeveer 40°C.</phrase><phrase>Robs adres is: 4500 Aqualaan 2X, 3583 Paal.</phrase><phrase>Een e-mailadres bevat steeds volgend teken:’@’.</phrase><phrase>Zoek het document onder D:\K&U{123}K&X{123}\yvo.</phrase><phrase>“C'est à moi, pas à toi,” schreef ze in het Frans.</phrase><phrase>“Een aquaduct is een brug,” schreef de leerling.</phrase><phrase>“5+5=10,” legde hij zijn dochter uit.</phrase><phrase>De V&D kende een verlies van 5,6%.</phrase><phrase>De nummers 3 t/m 27 mogen binnenkomen.</phrase><phrase>Is dit correct: 5% van 100 > 2% van 200? </phrase><phrase>Stuur een e-mail naar “[email protected]” zei hij.</phrase><phrase>Deze groep gaat naar Rome.</phrase><phrase>Zijn dochter is getrouwd met Rob Boschuyt.</phrase><phrase>Wie komt jou afhalen vanavond?</phrase><phrase>“Als 7+3=10, dan is 10-7=3” zei de j

1 note · View note

imadeanai-blog · 8 years ago

Text

# Reserved Strings # # Strings which may be used elsewhere in code

undefined undef null NULL (null) nil NIL true false True False None \ \\

# Numeric Strings # # Strings which can be interpreted as numeric

0 1 1.00 $1.00 1/2 1E2 1E02 1E+02 -1 -1.00 -$1.00 -1/2 -1E2 -1E02 -1E+02 1/0 0/0 -2147483648/-1 -9223372036854775808/-1 0.00 0..0 . 0.0.0 0,00 0,,0 , 0,0,0 0.0/0 1.0/0.0 0.0/0.0 1,0/0,0 0,0/0,0 --1 - -. -, 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 NaN Infinity -Infinity INF 1#INF -1#IND 1#QNAN 1#SNAN 1#IND 0x0 0xffffffff 0xffffffffffffffff 0xabad1dea 123456789012345678901234567890123456789 1,000.00 1 000.00 1'000.00 1,000,000.00 1 000 000.00 1'000'000.00 1.000,00 1 000,00 1'000,00 1.000.000,00 1 000 000,00 1'000'000,00 01000 08 09 2.2250738585072011e-308

# Special Characters # # Strings which contain common special ASCII characters (may need to be escaped)

,./;'[]\-= <>?:"{}|_+ !@#$%^&*()`~

# Unicode Symbols # # Strings which contain common unicode symbols (e.g. smart quotes)

# Unicode Subscript/Superscript # # Strings which contain unicode subscripts/superscripts; can cause rendering issues

⁰⁴⁵ ₀₁₂ ⁰⁴⁵₀₁₂

# Quotation Marks # # Strings which contain misplaced quotation marks; can cause encoding errors

' " '' "" '"' "''''"'" "'"'"''''" <foo val=“bar” /> <foo val=“bar” /> <foo val=”bar“ /> <foo val=`bar' />

# Two-Byte Characters # # Strings which contain two-byte characters: can cause rendering issues or character-length issues

# Japanese Emoticons # # Strings which consists of Japanese-style emoticons which are popular on the web

# Emoji # # Strings which contain Emoji; should be the same behavior as two-byte characters, but not always

# Unicode Numbers # # Strings which contain unicode numbers; if the code is localized, it should see the input as numeric

１２３ ١٢٣

# Right-To-Left Strings # # Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew)

# Unicode Spaces # # Strings which contain unicode space characters with special properties (c.f. https://www.cs.tut.fi/~jkorpela/chars/spaces.html)

  ᠎ ،، ␣ ␢ ␡

# Trick Unicode # # Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf)

‪‪test‪ ‫test‫

test

test⁠test‫ ⁦test⁧

# Zalgo Text # # Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net)

Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ͏͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ ̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔ل̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞̠̫̰ ̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙̻̝f ̪̰̰̗̖̭̘͘c̦͍̲̞͍̩̙ḥ͚a̮͎̟̙͜ơ̩̹͎s̤.̝̝ ҉Z̡̖̜͖̰̣͉̜a͖̰͙̬͡l̲̫̳͍̩g̡̟̼̱͚̞̬ͅo̗͜.̟ ̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣l̴͔̰̤̟͔ḽ̫.͕ Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮

# Unicode Upsidedown # # Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com)

ےɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ 00ےƖ$-

# Unicode font # # Strings which contain bold/italic/etc. versions of normal characters

# Script Injection # # Strings which attempt to invoke a benign script injection; shows vulnerability to XSS

# SQL Injection # # Strings which can cause a SQL injection if inputs are not sanitized

1;DROP TABLE users 1'; DROP TABLE users-- 1 ' OR 1=1 -- 1 ' OR '1'='1

% _

# Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153)

- -- --version --help $USER /dev/null; touch /tmp/blns.fail ; echo `touch /tmp/blns.fail` $(touch /tmp/blns.fail) @{[system "touch /tmp/blns.fail"]}

# Command Injection (Ruby) # # Strings which can call system commands within Ruby/Rails applications

eval("puts 'hello world'") System("ls -al /") `ls -al /` Kernel.exec("ls -al /") Kernel.exit(1) %x('ls -al /')

# XXE Injection (XML) # # String which can reveal system files when parsed by a badly configured XML parser

<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

$HOME $ENV{'HOME'} %d %s {0} %*.*s