fuzzdb

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

1,357

626

1,357

View on GitHub

Top Related Projects

SecLists

57,590

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

PayloadsAllTheThings

60,720

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

fuzzdb

8,198

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

IntruderPayloads

3,699

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

wfuzz

5,916

Web application fuzzer

sql-injection-payload-list

4,906

🎯 SQL Injection Payload List

Quick Overview

FuzzDB is a comprehensive collection of attack patterns and primitives for security testing and fuzzing. It serves as a resource for application security testing and research, containing various payloads, wordlists, and regex patterns commonly used in security assessments and penetration testing.

Pros

Extensive collection of attack patterns and payloads
Regularly updated with new content
Well-organized directory structure for easy navigation
Useful for both manual and automated security testing

Cons

Large repository size may be overwhelming for beginners
Some payloads may be outdated or less relevant for modern applications
Lacks detailed documentation on how to use specific payloads effectively
May require additional tools or scripts to fully utilize the content

Getting Started

To use FuzzDB in your security testing:

Clone the repository:

git clone https://github.com/tennc/fuzzdb.git

Navigate to the desired category folder (e.g., attack, discovery, wordlists-user-passwd)
Use the files in your preferred security testing tool or script. For example, to use a wordlist with a tool like dirb:
```
dirb http://example.com /path/to/fuzzdb/discovery/predictable-filepaths/filename-dirname-bruteforce.txt
```

For custom scripts, you can read and process the files programmatically. Here's a Python example to read a wordlist:

with open('/path/to/fuzzdb/wordlist-file.txt', 'r') as f:
    wordlist = f.read().splitlines()

for word in wordlist:
    # Use the word in your security testing logic
    print(word)

Remember to use FuzzDB responsibly and only on systems you have permission to test.

Competitor Comparisons

SecLists

57,590

Pros of SecLists

More comprehensive and regularly updated content
Better organization with clear categorization of wordlists
Larger community support and contributions

Cons of SecLists

Larger file size, potentially overwhelming for some users
May include redundant or less relevant data for specific use cases

Code Comparison

SecLists:

admin
administrator
root
user
guest

fuzzdb:

admin
administrator
root
test
guest

Summary

SecLists offers a more extensive collection of wordlists and payloads, making it suitable for a wide range of security testing scenarios. Its well-organized structure and active community support contribute to its popularity. However, the sheer volume of data might be excessive for some users.

fuzzdb, while smaller in size, provides a more focused set of fuzzing payloads. It may be preferable for users who need a lightweight solution or are looking for specific types of payloads.

Both repositories serve as valuable resources for security professionals, with SecLists being more comprehensive and fuzzdb offering a more targeted approach. The choice between the two depends on the specific requirements of the user's security testing needs.

PayloadsAllTheThings

60,720

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Pros of PayloadsAllTheThings

More comprehensive and diverse payload collection
Better organized with clear categories and subcategories
Regularly updated with new techniques and payloads

Cons of PayloadsAllTheThings

Larger repository size, potentially overwhelming for beginners
Less focused on specific fuzzing techniques

Code Comparison

PayloadsAllTheThings (SQL Injection):

' OR '1'='1
' OR 1=1--
' UNION SELECT NULL,NULL,NULL--

fuzzdb (SQL Injection):

'
"
1'1
1 exec sp_

Both repositories provide valuable resources for security testing and penetration testing. PayloadsAllTheThings offers a more extensive collection of payloads and techniques across various categories, making it suitable for a wide range of security testing scenarios. It's well-organized and frequently updated, providing users with the latest attack vectors.

fuzzdb, on the other hand, focuses more on fuzzing techniques and provides a more concise set of payloads. It may be more approachable for beginners or those specifically interested in fuzzing.

The code examples demonstrate the different approaches: PayloadsAllTheThings provides more complex and varied SQL injection payloads, while fuzzdb offers simpler, more basic examples. Both can be useful depending on the specific testing requirements and the tester's experience level.

fuzzdb

8,198

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

Pros of fuzzdb

More active development with frequent updates and contributions
Larger and more diverse collection of fuzzing payloads
Better organization and categorization of payloads

Cons of fuzzdb

Potentially overwhelming for beginners due to the extensive collection
May include some outdated or less relevant payloads

Code comparison

fuzzdb:

/discovery/predictable-filepaths/filename-dirname-bruteforce/Extensions.Backup.txt
/discovery/predictable-filepaths/filename-dirname-bruteforce/Extensions.Common.txt
/discovery/predictable-filepaths/filename-dirname-bruteforce/File.Backup.txt

tennc/fuzzdb:

/dict/BURP-PayLoad/attack-payloads/all-attacks/all-attacks-unix.txt
/dict/BURP-PayLoad/attack-payloads/all-attacks/all-attacks-win.txt
/dict/BURP-PayLoad/attack-payloads/control-chars/control-chars.txt

Both repositories provide extensive collections of fuzzing payloads, but fuzzdb offers a more structured and actively maintained dataset. The tennc/fuzzdb repository, while still valuable, appears to have a different organization and may not be as frequently updated. The code comparison shows that fuzzdb focuses on predictable file paths and extensions, while tennc/fuzzdb includes more general attack payloads and control characters.

IntruderPayloads

3,699

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

Pros of IntruderPayloads

More focused on web application security testing payloads
Includes specific payloads for popular web technologies and frameworks
Regularly updated with new payloads and attack vectors

Cons of IntruderPayloads

Smaller overall collection compared to fuzzdb
Less comprehensive coverage of non-web security testing scenarios
May require more manual filtering for specific use cases

Code Comparison

IntruderPayloads example (SQL injection):

' OR '1'='1
' OR 1=1--
' UNION SELECT NULL,NULL,NULL--

fuzzdb example (SQL injection):

'
''
`
``
,
"
""
/
//
\
\\

Both repositories provide valuable resources for security testing and fuzzing. IntruderPayloads focuses more on web application security, offering targeted payloads for specific technologies. fuzzdb, on the other hand, provides a broader range of fuzzing data for various security testing scenarios.

IntruderPayloads is better suited for web application penetration testers looking for ready-to-use payloads, while fuzzdb offers a more comprehensive collection that can be adapted to a wider range of security testing needs.

Ultimately, the choice between the two depends on the specific requirements of your security testing project and the target environment.

wfuzz

5,916

Web application fuzzer

Pros of wfuzz

Active development with regular updates and contributions
Comprehensive web application fuzzing tool with multiple fuzzing techniques
Extensive documentation and usage examples

Cons of wfuzz

Steeper learning curve due to more complex functionality
Requires more setup and configuration compared to fuzzdb

Code comparison

wfuzz:

wfuzz -c -z file,wordlist/general/common.txt --hc 404 http://testphp.vulnweb.com/FUZZ

fuzzdb:

for word in $(cat fuzzdb/discovery/predictable-filepaths/filename-dirname-bruteforce/raft-large-directories.txt); do
    curl -s -o /dev/null -w "%{http_code}" http://example.com/$word
done

Summary

wfuzz is a more comprehensive web application fuzzing tool with active development and extensive documentation. It offers multiple fuzzing techniques but has a steeper learning curve. fuzzdb, on the other hand, is a simpler collection of fuzzing patterns and wordlists that can be easily integrated into custom scripts or other tools. While wfuzz provides a complete fuzzing solution, fuzzdb offers flexibility for users to create their own fuzzing workflows.

sql-injection-payload-list

4,906

🎯 SQL Injection Payload List

Pros of sql-injection-payload-list

Focused specifically on SQL injection payloads, providing a more targeted resource
Well-organized with payloads categorized by database type and injection technique
Regularly updated with new payloads and techniques

Cons of sql-injection-payload-list

Limited scope compared to fuzzdb, which covers a broader range of security testing scenarios
Fewer contributors and less community involvement
Lacks additional tools and scripts for payload generation or testing

Code Comparison

sql-injection-payload-list:

' OR '1'='1
' OR '1'='1'--
' OR '1'='1'#
' OR '1'='1'/*

fuzzdb:

'
''
`
``
,
"
""
/
//
\
\\

The sql-injection-payload-list repository focuses on complete SQL injection payloads, while fuzzdb provides a wider variety of special characters and syntax elements used in various types of injections.

Both repositories serve as valuable resources for security testing, with sql-injection-payload-list offering a more specialized approach to SQL injection testing, and fuzzdb providing a comprehensive collection of fuzzing payloads for multiple security testing scenarios.