Naughty KeyboardInjections test values
Strings that show whether a field treats input as data or as code: quotes, markup, templates and paths. 11 values, each with what it breaks and what a correct application does instead.
Type them one at a time with AltShiftN
in the palette, or take them all into a script with nkb emit injections.
The palette marks these values offensive. They are classic checks for escaping, none of them is an exploit for a known vulnerability, and nothing is typed until you press a shortcut. Use them only on systems you are allowed to test.
Single quote
injections/single-quote
'
'
- 1 grapheme
- 1 code point
- 1 byte
- 1 UTF-16 unit
- What it breaks
- The most effective one-character test: a field that passes it unescaped into an SQL query ends the string early, and the page shows a database error.
- What a correct application does
- Stored and returned as one character, and shown as one character.
Bold tags
injections/angle-brackets
<b>test</b>
<b>test</b>
- 11 graphemes
- 11 code points
- 11 bytes
- 11 UTF-16 units
- What it breaks
- Markup in a text field is either escaped on display or rendered, and bold text on the page means the field escapes nothing.
- What a correct application does
- Displayed as literal text, with the tags visible to the user.
Script tag
injections/script-tag
<script>alert(1)</script>
<script>alert(1)</script>
- 25 graphemes
- 25 code points
- 25 bytes
- 25 UTF-16 units
- What it breaks
- The canonical check for output escaping: a dialog that says 1, or text that vanishes, means the value reached the page as code somewhere it is shown.
- What a correct application does
- Displayed as literal text everywhere the value is shown, including lists and exports.
Image with an error handler
injections/img-onerror
<imgsrc=xonerror=alert(1)>
<img src=x onerror=alert(1)>
- 28 graphemes
- 28 code points
- 28 bytes
- 28 UTF-16 units
- What it breaks
- Catches a filter that removes script tags by name and lets an attribute that runs code through, so the value runs as soon as the broken image loads.
- What a correct application does
- Displayed as literal text.
Template expression in double braces
injections/template-braces
{{7*7}}
{{7*7}}
- 7 graphemes
- 7 code points
- 7 bytes
- 7 UTF-16 units
- What it breaks
- Template engines such as Jinja, Twig and Angular evaluate double braces, so 49 on the page means user input reached a template as code.
- What a correct application does
- Displayed exactly as typed, with the braces visible.
Template expression with a dollar sign
injections/template-dollar
${7*7}
${7*7}
- 6 graphemes
- 6 code points
- 6 bytes
- 6 UTF-16 units
- What it breaks
- JavaScript template literals, Java expression languages and Freemarker evaluate a dollar sign and braces, so 49 means the value reached one of them as code.
- What a correct application does
- Displayed exactly as typed.
Path that climbs out of its folder
injections/path-traversal
../../etc/passwd
../../etc/passwd
- 16 graphemes
- 16 code points
- 16 bytes
- 16 UTF-16 units
- What it breaks
- A file name joined to a folder without normalising the path climbs out of it, so the application reads or writes a file it was never meant to reach.
- What a correct application does
- Rejected, or normalised so the result stays inside the intended folder.
Path that climbs out with backslashes
injections/path-traversal-win
..\..\windows\win.ini
..\\..\\windows\\win.ini
- 21 graphemes
- 21 code points
- 21 bytes
- 21 UTF-16 units
- What it breaks
- Windows reads a backslash as a separator, and a validator that looks only for ../ lets the same climb through.
- What a correct application does
- Rejected or normalised, exactly like the form with forward slashes.
Quote and SQL comment
injections/sql-comment
admin'--
admin'--
- 8 graphemes
- 8 code points
- 8 bytes
- 8 UTF-16 units
- What it breaks
- A quote that ends the string and a comment that cuts off the rest of the query: the classic shape of a login query broken by unescaped input.
- What a correct application does
- Stored and displayed as an eight-character string.
Format specifiers
injections/format-string
%s%n%x
%s%n%x
- 6 graphemes
- 6 code points
- 6 bytes
- 6 UTF-16 units
- What it breaks
- Used as the format of printf in C, %x reads the stack and %n writes to memory, and a format call in a managed language that finds specifiers without arguments raises an error.
- What a correct application does
- Treated as literal text, never passed as a format string.
XML external entity
injections/xml-entity
<!DOCTYPEt[<!ENTITYeSYSTEM"file:///etc/passwd">]><t>&e;</t>
<!DOCTYPE t [<!ENTITY e SYSTEM "file:///etc/passwd">]><t>&e;</t>
- 64 graphemes
- 64 code points
- 64 bytes
- 64 UTF-16 units
- What it breaks
- An XML parser that resolves external entities replaces &e; with the file the declaration names, so imported content makes the server read its own files.
- What a correct application does
- External entities not resolved, and the value treated as text or rejected.