Response Templating - Naughty Strings

WireMock Cloud provides a naughtyString helper that returns strings from the Big List of Naughty Strings (BLNS). The list contains strings that commonly cause problems in software, such as SQL injection, right-to-left text, zero-width characters, emoji and Zalgo text. Using the helper in a stub means every client test that calls it exercises these cases without any extra setup.

{
  "request": { "method": "GET", "url": "/user" },
  "response": {
    "status": 200,
    "headers": { "Content-Type": "application/json" },
    "body": "{ \"name\": {{{toJson (naughtyString category='sql-injection')}}} }",
    "transformers": ["response-template"]
  }
}

These are real payloads. The XSS, SQL injection and command injection strings reach whatever consumes the mock, including logs, databases and browsers. That is the point, but only point clients at these stubs in environments where that is safe.

The list is built in to WireMock Cloud, so there is nothing to install or download. The stub needs response templating enabled, as with any other helper.

Choosing a string

By default the helper picks a random string from the whole list. The category and index parameters narrow the choice.

{{naughtyString}}
{{naughtyString category='Emoji'}}
{{naughtyString category='sql-injection'}}
{{naughtyString index=42}}
{{naughtyString category='Emoji' index=0}}
{{naughtyString index=(randomInt lower=0 upper=10)}}

Parameter	Meaning
`category`	Limits the choice to one category. Matched case-insensitively, by either heading (`SQL Injection`) or slug (`sql-injection`).
`index`	Returns a fixed entry instead of a random one, counted from 0 within the whole list or within `category`. Use it when you need the same string every time, for example in a repeatable test.

With neither parameter, the helper picks at random from all 516 strings.

Errors

Bad input renders an error string in the response, in the same way as WireMock’s built-in helpers:

An unknown category gives [ERROR: Unknown BLNS category 'x'. Known: reserved-strings, …].
An index outside the range gives [ERROR: BLNS index 600 is out of range 0-515]. The index does not wrap around, so a typo can’t quietly return the wrong string.

Browsing the list

To see every string in every category, with the index you would use to select it, open the hosted mock API at blns.wiremockapi.cloud/naughty/strings. It returns the whole list as plain text, grouped by category, with each category’s indexes starting at 0. You can also build your own version. To see which string you get at each index, use a stub that prints a category with the range and each helpers. This one prints every string in sql-injection:

{{#each (range 0 7)}}
{{this}}: {{{toJson (naughtyString category='sql-injection' index=this)}}}
{{/each}}

Which gives this response:

"1;DROP TABLE users"
"1'; DROP TABLE users-- 1"
"' OR 1=1 -- 1"
"' OR '1'='1"
"'; EXEC sp_MSForEachTable 'DROP TABLE ?'; --"
" "
"%"
"_"

The upper bound of range is inclusive, so use the category’s string count from the table below minus one. A bound that is too high is harmless: the extra lines show the out-of-range error, which is a handy way to confirm where a category ends. Remove the category parameter and use range 0 515 to print the whole list. The output is long, because it includes the 236 script injection strings. Some strings contain characters that are invisible or render oddly, such as zero-width characters. Their indexes can look empty or identical in the response, so treat the output as a guide to which index you want rather than a faithful view of every byte.

JSON bodies

WireMock Cloud does not escape helper output, so a naughty string placed directly into JSON will often break it. Quotes, backslashes and control characters are the usual culprits. Wrap the helper in the toJson helper, which adds the surrounding quotes and escapes the value. Use triple braces and leave the value unquoted:

{ "name": {{{toJson (naughtyString)}}} }

Every string in the list comes back from this pattern as valid JSON that parses to the original string. Use this in the response body, not jsonBody. Inside a jsonBody string value ("name": "{{{toJson …}}}") the quotes are doubled up and the result is invalid JSON.

Categories

Use either the category name or its slug as the category parameter.

Category	Slug	Strings
Reserved Strings	`reserved-strings`	19
Numeric Strings	`numeric-strings`	71
Special Characters	`special-characters`	9
Unicode Symbols	`unicode-symbols`	11
Unicode Subscript/Superscript/Accents	`unicode-subscript-superscript-accents`	4
Quotation Marks	`quotation-marks`	11
Two-Byte Characters	`two-byte-characters`	10
Special Unicode Characters Union	`special-unicode-characters-union`	1
Changing length when lowercased	`changing-length-when-lowercased`	2
Japanese Emoticons	`japanese-emoticons`	12
Emoji	`emoji`	13
Unicode Numbers	`unicode-numbers`	2
Right-To-Left Strings	`right-to-left-strings`	7
Ogham Text	`ogham-text`	2
Trick Unicode	`trick-unicode`	5
Zalgo Text	`zalgo-text`	5
Unicode Upsidedown	`unicode-upsidedown`	2
Unicode font	`unicode-font`	8
Script Injection	`script-injection`	236
SQL Injection	`sql-injection`	8
Server Code Injection	`server-code-injection`	9
Command Injection (Ruby)	`command-injection-ruby`	7
Unwanted Interpolation	`unwanted-interpolation`	9
File Inclusion	`file-inclusion`	2
Known CVEs and Vulnerabilities	`known-cves-and-vulnerabilities`	4
MSDOS/Windows Special Filenames	`msdos-windows-special-filenames`	15
Scunthorpe Problem	`scunthorpe-problem`	22
Human injection	`human-injection`	1
Terminal escape codes	`terminal-escape-codes`	3
iOS Vulnerabilities	`ios-vulnerabilities`	6

Concepts

Tutorials

How-to Guides

Reference

Response Templating - Naughty Strings

Choosing a string

Errors

Browsing the list

JSON bodies

Categories

Attribution

​Choosing a string

​Errors

​Browsing the list

​JSON bodies

​Categories

​Attribution

Choosing a string

Errors

Browsing the list

JSON bodies

Categories

Attribution