The most comprehensive open dictionary of attack patterns, predictable resource locations, and regex for black-box application security testing.
FuzzDB is an open-source dictionary of attack patterns, predictable resource locations, and regex patterns for black-box application security testing. It provides security testers and developers with comprehensive payloads and resources to identify vulnerabilities like SQL injection, XSS, and directory traversal through fault injection and response analysis.
Security professionals, penetration testers, and developers performing dynamic application security testing (DAST) who need reliable payload dictionaries for black-box testing.
FuzzDB offers the most comprehensive and categorized collection of attack patterns and predictable resources, making it an essential tool for effective security testing without requiring a proprietary scanner.
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes categorized payloads for various attacks like SQL injection and XSS, with specific examples such as 56 null byte patterns, as noted in the README's attack section.
Provides dictionaries of predictable file paths sorted by platform and application, making brute force testing more efficient, as described in the discovery directory.
Contains regex patterns to match server responses for error messages and sensitive data like credit cards, enhancing vulnerability detection in testing workflows.
Designed for use with popular tools like OWASP Zap and Burp Suite, with documented usage hints and extensions available, as highlighted in the integration notes.
The README warns that antivirus software may alert on FuzzDB files, requiring whitelisting, which can complicate deployment and usage in secured environments.
Users must clone and update the Git repository manually; it's not a packaged tool, adding overhead for maintenance and integration compared to plug-and-play solutions.
FuzzDB is a dataset, not a scanner, so it requires external tools or custom code to execute tests, limiting out-of-the-box functionality and increasing initial setup time.