A curated list of strings likely to cause issues when used as user-input data, for automated and manual QA testing.
The Big List of Naughty Strings is a curated collection of strings that are likely to cause issues when used as user-input data. It helps developers and QA engineers test software for input validation problems, edge cases, and potential security vulnerabilities. The list includes problematic Unicode characters, special symbols, and other strings that can trigger errors or unexpected behavior.
Software developers, QA engineers, and security testers who need to validate how their applications handle unusual or malicious user input.
It provides a ready-made, community-vetted set of test cases that save time compared to manually crafting edge-case inputs, and helps catch bugs that might otherwise slip through standard testing.
The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes problematic strings like Unicode characters, emojis, and SQL injection attempts, as evidenced by the categorized sections in blns.txt for thorough testing.
Provided as both newline-delimited TXT and JSON array files, with a Python script for generation, simplifying use in automated test suites.
Open to contributions with guidelines, ensuring the list stays updated with real-world problematic strings found by users.
Targets actual issues like zero-width spaces causing server errors, as shown in the Twitter example, improving software robustness.
Merely a list of strings; developers must manually write test cases or integrate it into their own frameworks, adding overhead.
Maintainer restricts very-long strings and harmful entries like EICAR test string to preserve usability, potentially missing edge cases.
Discloses it's not a substitute for formal security testing, so critical vulnerabilities might require additional tools like OWASP ZAP.