XSS, SQL Injection and Fuzzing Bar Code Cheat Sheet

Feel free to include my content in your page via my
RSS feed Follow @irongeek_adc

Help Irongeek.com pay for
bandwidth and research equipment:
Subscribestar or Patreon

Search Irongeek.com:

Affiliates:

Help Irongeek.com pay for bandwidth and research equipment:

XSS, SQL Injection and Fuzzing Bar Code Cheat Sheet XSS, SQL Injection and Fuzzing Bar Code Cheat Sheet

XSS, SQL Injection and Fuzzing Barcode Cheat Sheet

I was listening to an episode of Pauldotcom, and Mick mentioned something about attacks on systems via barcode. Because of the nature of barcodes, developers may not be expecting attacks from that vector and thus don�t sanitize their inputs properly. I had previously written "XSS, Command and SQL Injection vectors: Beyond the Form" so this was right up my alley. I constructed this page that lets you make barcodes in Code 93, Code 39, Code 39ext and Code 128A, B and C. I got the PHP libraries from these folks, which seem to be free for non profit use. If you don't give input to the form, the page just shows barcodes that can be useful for sort of "fuzzing" a system to see if the input is properly sanitized. If you have problems getting them to scan, adjust the bar size. The default tests are as follows:

<script>alert("test")</script>	This is of course the canonical XSS attack, for more interesting ones see here
' or 1=1 --	The the canonical SQL injection attack
'	Just a single quote to see if SQL queries break
--	Common SQL comment to see if queries break
"	Just a normal quote to see if SQL queries break
>	Lets see if HTML breaks
<	same as above, but opposite. :)
Can't print this	ASCII characters 31-16 for fuzzing to see what breaks
Can't print this	ASCII characters 15-0

Please only use on your own barcode reading system. By the way, please just ignore Clippy if you see him, he has to do with my IDS testing from before. If you want to make your own custom barcodes type in your string in the text area below, choose your options, and hit submit. If you just want to recode my bar codes leave the text area blank, choose your options, and hit submit. You can also type the decimal equivalent ASCII values as comma separated string, and it will ignore what is in the textarea.
If you want to just play around with individual characters, checkout our ASCII barcode chart.