mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-18 20:15:14 +02:00
254 lines
3.7 KiB
Text
254 lines
3.7 KiB
Text
|
# libFuzzer dictionary for the Nyx fuzz targets.
|
||
|
|
#
|
||
|
|
# Each entry is a quoted string libFuzzer can splice into mutations. We bias
|
||
|
|
# toward tokens that unlock new tree-sitter / CFG / taint paths across the
|
||
|
|
# 10 supported languages, plus the synthetic helper names registered by
|
||
|
|
# `cross_file_taint` so call-site mutations resolve against `GlobalSummaries`
|
||
|
|
# instead of bouncing off as unknown calls.
|
||
|
|
#
|
||
|
|
# Format: one entry per line, `name="..."` or `"..."`. Lines starting with
|
||
|
|
# `#` are comments. C-style escapes (`\xNN`, `\n`, `\\`, `\"`) are honored.
|
||
|
|
|
||
|
|
# ── Punctuation / structural tokens ────────────────────────────────────
|
||
|
|
"{"
|
||
|
|
"}"
|
||
|
|
"("
|
||
|
|
")"
|
||
|
|
"["
|
||
|
|
"]"
|
||
|
|
";"
|
||
|
|
","
|
||
|
|
"."
|
||
|
|
"::"
|
||
|
|
"->"
|
||
|
|
"=>"
|
||
|
|
":="
|
||
|
|
":"
|
||
|
|
"="
|
||
|
|
"=="
|
||
|
|
"!="
|
||
|
|
"<="
|
||
|
|
">="
|
||
|
|
"&&"
|
||
|
|
"||"
|
||
|
|
"+"
|
||
|
|
"-"
|
||
|
|
"*"
|
||
|
|
"/"
|
||
|
|
"%"
|
||
|
|
"<"
|
||
|
|
">"
|
||
|
|
"!"
|
||
|
|
"&"
|
||
|
|
"|"
|
||
|
|
"^"
|
||
|
|
"~"
|
||
|
|
"?"
|
||
|
|
"#"
|
||
|
|
"@"
|
||
|
|
|
||
|
|
# ── Cross-language keywords ────────────────────────────────────────────
|
||
|
|
"if"
|
||
|
|
"else"
|
||
|
|
"elif"
|
||
|
|
"while"
|
||
|
|
"for"
|
||
|
|
"do"
|
||
|
|
"return"
|
||
|
|
"break"
|
||
|
|
"continue"
|
||
|
|
"switch"
|
||
|
|
"case"
|
||
|
|
"default"
|
||
|
|
"true"
|
||
|
|
"false"
|
||
|
|
"null"
|
||
|
|
"nil"
|
||
|
|
"None"
|
||
|
|
"undefined"
|
||
|
|
"void"
|
||
|
|
"int"
|
||
|
|
"float"
|
||
|
|
"double"
|
||
|
|
"char"
|
||
|
|
"bool"
|
||
|
|
"string"
|
||
|
|
"var"
|
||
|
|
"let"
|
||
|
|
"const"
|
||
|
|
"static"
|
||
|
|
"public"
|
||
|
|
"private"
|
||
|
|
"protected"
|
||
|
|
"new"
|
||
|
|
"this"
|
||
|
|
"self"
|
||
|
|
"super"
|
||
|
|
"class"
|
||
|
|
"struct"
|
||
|
|
"enum"
|
||
|
|
"interface"
|
||
|
|
"trait"
|
||
|
|
"impl"
|
||
|
|
"module"
|
||
|
|
"package"
|
||
|
|
"import"
|
||
|
|
"from"
|
||
|
|
"use"
|
||
|
|
"as"
|
||
|
|
"function"
|
||
|
|
"def"
|
||
|
|
"fn"
|
||
|
|
"func"
|
||
|
|
"sub"
|
||
|
|
"end"
|
||
|
|
"begin"
|
||
|
|
"try"
|
||
|
|
"catch"
|
||
|
|
"except"
|
||
|
|
"finally"
|
||
|
|
"raise"
|
||
|
|
"throw"
|
||
|
|
"throws"
|
||
|
|
"async"
|
||
|
|
"await"
|
||
|
|
"yield"
|
||
|
|
"lambda"
|
||
|
|
"match"
|
||
|
|
"with"
|
||
|
|
"in"
|
||
|
|
"of"
|
||
|
|
"is"
|
||
|
|
"not"
|
||
|
|
"and"
|
||
|
|
"or"
|
||
|
|
|
||
|
|
# ── Common literals / format strings ───────────────────────────────────
|
||
|
|
"\"\""
|
||
|
|
"\"x\""
|
||
|
|
"\"%s\""
|
||
|
|
"\"%d\""
|
||
|
|
"\"%v\""
|
||
|
|
"\"{}\""
|
||
|
|
"`x`"
|
||
|
|
"'x'"
|
||
|
|
"0"
|
||
|
|
"1"
|
||
|
|
"-1"
|
||
|
|
"0x0"
|
||
|
|
"0xff"
|
||
|
|
|
||
|
|
# ── Security-flavored function names (sources, sinks, sanitizers) ──────
|
||
|
|
"exec"
|
||
|
|
"eval"
|
||
|
|
"system"
|
||
|
|
"popen"
|
||
|
|
"shell_exec"
|
||
|
|
"passthru"
|
||
|
|
"spawn"
|
||
|
|
"execSync"
|
||
|
|
"execFile"
|
||
|
|
"Runtime.getRuntime"
|
||
|
|
"Process"
|
||
|
|
"Command"
|
||
|
|
"query"
|
||
|
|
"execute"
|
||
|
|
"executeQuery"
|
||
|
|
"prepare"
|
||
|
|
"raw_query"
|
||
|
|
"mysql_query"
|
||
|
|
"mysqli_query"
|
||
|
|
"pg_query"
|
||
|
|
"sqlite_query"
|
||
|
|
"unserialize"
|
||
|
|
"pickle.loads"
|
||
|
|
"yaml.load"
|
||
|
|
"json.loads"
|
||
|
|
"readObject"
|
||
|
|
"deserialize"
|
||
|
|
"escape"
|
||
|
|
"escapeshellarg"
|
||
|
|
"escapeshellcmd"
|
||
|
|
"htmlspecialchars"
|
||
|
|
"htmlentities"
|
||
|
|
"escape_html"
|
||
|
|
"sanitize"
|
||
|
|
"strip_tags"
|
||
|
|
"prepareStatement"
|
||
|
|
"PreparedStatement"
|
||
|
|
"parseFromString"
|
||
|
|
"setAttribute"
|
||
|
|
"innerHTML"
|
||
|
|
"document.write"
|
||
|
|
"window.location"
|
||
|
|
"location.href"
|
||
|
|
|
||
|
|
# ── Sources (taint origins) ────────────────────────────────────────────
|
||
|
|
"req.body"
|
||
|
|
"req.query"
|
||
|
|
"req.params"
|
||
|
|
"request.GET"
|
||
|
|
"request.POST"
|
||
|
|
"request.args"
|
||
|
|
"request.form"
|
||
|
|
"$_GET"
|
||
|
|
"$_POST"
|
||
|
|
"$_REQUEST"
|
||
|
|
"$_COOKIE"
|
||
|
|
"params"
|
||
|
|
"argv"
|
||
|
|
"stdin"
|
||
|
|
"getenv"
|
||
|
|
"env::var"
|
||
|
|
"os.environ"
|
||
|
|
"ENV"
|
||
|
|
"Console.ReadLine"
|
||
|
|
"input"
|
||
|
|
"raw_input"
|
||
|
|
"fgets"
|
||
|
|
"scanf"
|
||
|
|
"gets"
|
||
|
|
"http.Get"
|
||
|
|
"http.Post"
|
||
|
|
"reqwest::get"
|
||
|
|
"fetch"
|
||
|
|
"axios.get"
|
||
|
|
"file_get_contents"
|
||
|
|
"readFileSync"
|
||
|
|
|
||
|
|
# ── Common injection payload markers ───────────────────────────────────
|
||
|
|
"<script>"
|
||
|
|
"</script>"
|
||
|
|
"javascript:"
|
||
|
|
"onerror="
|
||
|
|
"onload="
|
||
|
|
"' OR '1'='1"
|
||
|
|
"'; DROP TABLE"
|
||
|
|
"UNION SELECT"
|
||
|
|
"--"
|
||
|
|
"/*"
|
||
|
|
"*/"
|
||
|
|
"../"
|
||
|
|
"..\\\\"
|
||
|
|
"/etc/passwd"
|
||
|
|
"file://"
|
||
|
|
"http://169.254.169.254"
|
||
|
|
"ldap://"
|
||
|
|
|
||
|
|
# ── Synthetic helpers used by `cross_file_taint` ───────────────────────
|
||
|
|
"nyx_taint_source"
|
||
|
|
"nyx_sanitize"
|
||
|
|
"nyx_dangerous_sink"
|
||
|
|
"nyx_pass_through"
|
||
|
|
|
||
|
|
# ── Tricky parser edge cases ───────────────────────────────────────────
|
||
|
|
"\"\\xff\\xff\""
|
||
|
|
"\"\\u0000\""
|
||
|
|
"\"\\n\\r\\t\""
|
||
|
|
"\"\\xc3\\x28\""
|
||
|
|
"<?php"
|
||
|
|
"?>"
|
||
|
|
"<?xml"
|
||
|
|
"#!/bin/sh"
|
||
|
|
"\"\\\\\""
|