// the find
minimaxir/big-list-of-naughty-strings
The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
A flat file of ~500 strings that tend to break software — SQL injection attempts, unicode edge cases, format strings, reserved keywords, emoji, right-to-left overrides, and more. It's a fuzzing seed list for QA, not a security testing framework. Most useful for finding the dumb bugs that comprehensive unit tests miss because nobody thought to type ﷽ into a text field.
The categorization is genuinely thoughtful — strings are grouped by failure mode (SQL injection, XSS, unicode, null bytes, format strings, etc.) so you can pick which class of bugs you're hunting. Both a raw text file and a parsed JSON array are provided, so integration into any test runner is trivial. The base64 variants are a nice addition for cases where you need to test encoded payloads. Package maintainers have wrapped it for Node, .NET, PHP, and C++, which means you can pull it as a dependency rather than copy-pasting.
Last meaningful update was 2024 but the strings themselves feel frozen circa 2015 — modern attack surfaces like prompt injection, GraphQL introspection abuse, and SSRF payloads are absent. The 255-character length cap stated in CONTRIBUTING is a real limitation; many real-world truncation and buffer bugs only surface with longer inputs. There's no severity or category tagging in the JSON, so if you want to run only the XSS strings you're back to reading the commented text file. The Python tooling in `scripts/` is minimal enough that calling it a 'package' is generous.