{ "usernames": { "prefixes": [ "admin", "user", "developer", "root", "system", "db", "api", "service", "deploy", "test", "prod", "backup", "monitor", "jenkins", "webapp" ], "suffixes": [ "", "_prod", "_dev", "_test", "123", "2024", "_backup", "_admin", "01", "02", "_user", "_service", "_api" ] }, "passwords": { "prefixes": [ "P@ssw0rd", "Passw0rd", "Admin", "Secret", "Welcome", "System", "Database", "Secure", "Master", "Root" ], "simple": [ "test", "demo", "temp", "change", "password", "admin", "letmein", "welcome", "default", "sample" ] }, "emails": { "domains": [ "example.com", "company.com", "localhost.com", "test.com", "domain.com", "corporate.com", "internal.net", "enterprise.com", "business.org" ] }, "api_keys": { "prefixes": [ "sk_live_", "sk_test_", "api_", "key_", "token_", "access_", "secret_", "prod_", "" ] }, "databases": { "names": [ "production", "prod_db", "main_db", "app_database", "users_db", "customer_data", "analytics", "staging_db", "dev_database", "wordpress", "ecommerce", "crm_db", "inventory" ], "hosts": [ "localhost", "db.internal", "mysql.local", "postgres.internal", "127.0.0.1", "db-server-01", "database.prod", "sql.company.com" ] }, "applications": { "names": [ "WebApp", "API Gateway", "Dashboard", "Admin Panel", "CMS", "Portal", "Manager", "Console", "Control Panel", "Backend" ] }, "users": { "roles": [ "Administrator", "Developer", "Manager", "User", "Guest", "Moderator", "Editor", "Viewer", "Analyst", "Support" ] }, "directory_listing": { "files": [ "test.exe", "backup.sql", "database.sql", "db_backup.sql", "dump.sql", "config.php", "credentials.txt", "passwords.txt", "users.csv", ".env", "id_rsa", "id_rsa.pub", "private_key.pem", "api_keys.json", "secrets.yaml", "admin_notes.txt", "settings.ini", "database.yml", "wp-config.php", ".htaccess", "server.key", "cert.pem", "shadow.bak", "passwd.old" ], "directories": [ "uploads/", "backups/", "logs/", "temp/", "cache/", "private/", "config/", "admin/", "database/", "backup/", "old/", "archive/", ".git/", "keys/", "credentials/" ], "fake_files": [ {"name": "settings.conf", "size_min": 1024, "size_max": 8192, "perms": "-rw-r--r--"}, {"name": "database.sql", "size_min": 10240, "size_max": 102400, "perms": "-rw-r--r--"}, {"name": ".htaccess", "size_min": 256, "size_max": 1024, "perms": "-rw-r--r--"}, {"name": "README.md", "size_min": 512, "size_max": 2048, "perms": "-rw-r--r--"} ], "fake_directories": [ {"name": "config", "size": "4096", "perms": "drwxr-xr-x"}, {"name": "backup", "size": "4096", "perms": "drwxr-xr-x"}, {"name": "logs", "size": "4096", "perms": "drwxrwxr-x"}, {"name": "data", "size": "4096", "perms": "drwxr-xr-x"} ] }, "fake_passwd": { "system_users": [ "root:x:0:0:root:/root:/bin/bash", "daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin", "bin:x:2:2:bin:/bin:/usr/sbin/nologin", "sys:x:3:3:sys:/dev:/usr/sbin/nologin", "sync:x:4:65534:sync:/bin:/bin/sync", "www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin", "backup:x:34:34:backup:/var/backups:/usr/sbin/nologin", "mysql:x:108:113:MySQL Server,,,:/nonexistent:/bin/false", "sshd:x:109:65534::/run/sshd:/usr/sbin/nologin" ], "uid_min": 1000, "uid_max": 2000, "gid_min": 1000, "gid_max": 2000, "shells": ["/bin/bash", "/bin/sh", "/usr/bin/zsh"] }, "fake_shadow": { "system_entries": [ "root:$6$rounds=656000$fake_salt_here$fake_hash_data:19000:0:99999:7:::", "daemon:*:19000:0:99999:7:::", "bin:*:19000:0:99999:7:::", "sys:*:19000:0:99999:7:::", "www-data:*:19000:0:99999:7:::" ], "hash_prefix": "$6$rounds=656000$", "salt_length": 16, "hash_length": 86 }, "xxe_responses": { "file_access": { "template": "\n\n success\n {content}\n" }, "entity_processed": { "template": "\n\n success\n Entity processed successfully\n {entity_value}\n", "entity_values": [ "fake_entity_content_12345", "external_entity_processed", "system_entity_loaded", "dtd_entity_resolved" ] }, "error": { "template": "\n\n error\n {message}\n", "messages": [ "External entity processing disabled", "Entity expansion limit exceeded", "Security policy violation" ] }, "default_content": "root:x:0:0:root:/root:/bin/bash\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin" }, "command_outputs": { "id": [ "uid={uid}(www-data) gid={gid}(www-data) groups={gid}(www-data)", "uid={uid}(nginx) gid={gid}(nginx) groups={gid}(nginx)", "uid={uid}(apache) gid={gid}(apache) groups={gid}(apache)" ], "whoami": ["www-data", "nginx", "apache", "webapp", "nobody"], "uname": [ "Linux webserver 5.4.0-42-generic #46-Ubuntu SMP Fri Jul 10 00:24:02 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux", "Linux app-server 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 GNU/Linux", "Linux prod-server 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64 GNU/Linux" ], "pwd": [ "/var/www/html", "/home/webapp/public_html", "/usr/share/nginx/html", "/opt/app/public" ], "ls": [ ["index.php", "config.php", "uploads", "assets", "README.md", ".htaccess", "admin"], ["app.js", "package.json", "node_modules", "public", "views", "routes"], ["index.html", "css", "js", "images", "data", "api"] ], "cat_config": "", "network_commands": [ "bash: wget: command not found", "curl: (6) Could not resolve host: example.com", "Connection timeout", "bash: nc: command not found", "Downloaded {size} bytes" ], "generic": [ "sh: 1: syntax error: unexpected end of file", "Command executed successfully", "", "/bin/sh: {num}: not found", "bash: command not found" ], "uid_min": 1000, "uid_max": 2000, "gid_min": 1000, "gid_max": 2000, "download_size_min": 100, "download_size_max": 10000 }, "error_codes": [ 400, 401, 403, 404, 500, 502, 503 ], "server_errors": { "nginx": { "versions": ["1.18.0", "1.20.1", "1.22.0", "1.24.0"], "template": "\n\n\n{code} {message}\n\n\n\n

An error occurred.

\n

Sorry, the page you are looking for is currently unavailable.
\nPlease try again later.

\n

If you are the system administrator of this resource then you should check the error log for details.

\n

Faithfully yours, nginx/{version}.

\n\n" }, "apache": { "versions": ["2.4.41", "2.4.52", "2.4.54", "2.4.57"], "os": ["Ubuntu", "Debian", "CentOS"], "template": "\n\n{code} {message}\n\n

{message}

\n

The requested URL was not found on this server.

\n
\n
Apache/{version} ({os}) Server at {host} Port 80
\n" }, "iis": { "versions": ["10.0", "8.5", "8.0"], "template": "\n\n\n\n{code} - {message}\n\n\n\n

Server Error

\n
\n
\n

{code} - {message}

\n

The page cannot be displayed because an internal server error has occurred.

\n
\n
\n\n" }, "tomcat": { "versions": ["9.0.65", "10.0.27", "10.1.5"], "template": "HTTP Status {code} - {message}

HTTP Status {code} - {message}

Type Status Report

Description The server encountered an internal error that prevented it from fulfilling this request.

Apache Tomcat/{version}

" } }, "sql_errors": { "mysql": { "generic": [ "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' at line 1", "Unknown column '{column}' in 'where clause'", "Table '{table}' doesn't exist", "Operand should contain 1 column(s)", "Subquery returns more than 1 row", "Duplicate entry 'admin' for key 'PRIMARY'" ], "quote": [ "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1", "Unclosed quotation mark after the character string ''", "You have an error in your SQL syntax near '\\'' LIMIT 0,30'" ], "union": [ "The used SELECT statements have a different number of columns", "Operand should contain 1 column(s)", "Mixing of GROUP columns (MIN(),MAX(),COUNT(),...) with no GROUP columns is illegal" ], "boolean": [ "You have an error in your SQL syntax near 'OR 1=1' at line 1", "Unknown column '1' in 'where clause'" ], "time_based": [ "Query execution was interrupted", "Lock wait timeout exceeded; try restarting transaction" ], "comment": [ "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--' at line 1" ] }, "postgresql": { "generic": [ "ERROR: syntax error at or near \"1\"", "ERROR: column \"{column}\" does not exist", "ERROR: relation \"{table}\" does not exist", "ERROR: operator does not exist: integer = text", "ERROR: invalid input syntax for type integer: \"admin\"" ], "quote": [ "ERROR: unterminated quoted string at or near \"'\"", "ERROR: syntax error at or near \"'\"", "ERROR: unterminated quoted identifier at or near \"'\"" ], "union": [ "ERROR: each UNION query must have the same number of columns", "ERROR: UNION types integer and text cannot be matched" ], "boolean": [ "ERROR: syntax error at or near \"OR\"", "ERROR: invalid input syntax for type boolean: \"1=1\"" ], "time_based": [ "ERROR: canceling statement due to user request", "ERROR: function pg_sleep(integer) does not exist" ], "info_schema": [ "ERROR: permission denied for table {table}", "ERROR: permission denied for schema information_schema" ] }, "mssql": { "generic": [ "Msg 102, Level 15, State 1, Line 1\nIncorrect syntax near '1'.", "Msg 207, Level 16, State 1, Line 1\nInvalid column name '{column}'.", "Msg 208, Level 16, State 1, Line 1\nInvalid object name '{table}'.", "Msg 245, Level 16, State 1, Line 1\nConversion failed when converting the varchar value 'admin' to data type int." ], "quote": [ "Msg 105, Level 15, State 1, Line 1\nUnclosed quotation mark after the character string ''.", "Msg 102, Level 15, State 1, Line 1\nIncorrect syntax near '''." ], "union": [ "Msg 205, Level 16, State 1, Line 1\nAll queries combined using a UNION, INTERSECT or EXCEPT operator must have an equal number of expressions in their target lists.", "Msg 8167, Level 16, State 1, Line 1\nThe type of column \"{column}\" conflicts with the type of other columns specified in the UNION, INTERSECT, or EXCEPT list." ], "boolean": [ "Msg 102, Level 15, State 1, Line 1\nIncorrect syntax near 'OR'." ], "command": [ "Msg 15281, Level 16, State 1, Procedure xp_cmdshell, Line 1\nSQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell'" ] }, "oracle": { "generic": [ "ORA-00933: SQL command not properly ended", "ORA-00904: \"{column}\": invalid identifier", "ORA-00942: table or view \"{table}\" does not exist", "ORA-01722: invalid number", "ORA-01756: quoted string not properly terminated" ], "quote": [ "ORA-01756: quoted string not properly terminated", "ORA-00933: SQL command not properly ended" ], "union": [ "ORA-01789: query block has incorrect number of result columns", "ORA-01790: expression must have same datatype as corresponding expression" ], "boolean": [ "ORA-00933: SQL command not properly ended", "ORA-00920: invalid relational operator" ] }, "sqlite": { "generic": [ "near \"1\": syntax error", "no such column: {column}", "no such table: {table}", "unrecognized token: \"'\"", "incomplete input" ], "quote": [ "unrecognized token: \"'\"", "incomplete input", "near \"'\": syntax error" ], "union": [ "SELECTs to the left and right of UNION do not have the same number of result columns" ] }, "mongodb": { "generic": [ "MongoError: Can't canonicalize query: BadValue unknown operator: $where", "MongoError: Failed to parse: { $where: \"this.{column} == '1'\" }", "SyntaxError: unterminated string literal", "MongoError: exception: invalid operator: $gt" ], "quote": [ "SyntaxError: unterminated string literal", "SyntaxError: missing } after property list" ], "command": [ "MongoError: $where is not allowed in this context", "MongoError: can't eval: security" ] } }, "attack_patterns": { "path_traversal": "(\\.\\.|%2e%2e|%252e|/etc/passwd|/etc/shadow|\\.\\.\\\\/|\\.\\./|/windows/system32|c:\\\\windows|/proc/self|\\.\\.\\.%2f|\\.\\.\\.%5c|etc/passwd|etc/shadow)", "sql_injection": "('|\"|`|--|#|/\\*|\\*/|\\bunion\\b|\\bunion\\s+select\\b|\\bor\\b.*=.*|\\band\\b.*=.*|'.*or.*'.*=.*'|\\bsleep\\b|\\bwaitfor\\b|\\bdelay\\b|\\bbenchmark\\b|;.*select|;.*drop|;.*insert|;.*update|;.*delete|\\bexec\\b|\\bexecute\\b|\\bxp_cmdshell\\b|information_schema|table_schema|table_name)", "xss_attempt": "(