5.3AI Fuzzing Categories

Category 1: SQL Injection Payloads

AI generates injection strings tailored to the field context:

[
  {"name": "'; SELECT * FROM users; --", "price": 10},
  {"name": "1 OR 1=1", "price": 10},
  {"name": "admin'--", "price": 10},
  {"name": "1; DROP TABLE products", "price": 10},
  {"name": "' UNION SELECT password FROM users WHERE '1'='1", "price": 10}
]

Category 2: XSS Payloads

[
  {"name": "<script>alert('xss')</script>", "price": 10},
  {"name": "<img src=x onerror=alert(1)>", "price": 10},
  {"name": "javascript:alert(1)", "price": 10},
  {"name": "{{7*7}}", "price": 10},
  {"name": "${7*7}", "price": 10}
]

Category 3: Boundary Values

[
  {"name": "", "price": 0},
  {"name": "A", "price": 0.01},
  {"name": "A".repeat(200), "price": 99999999.99},
  {"name": "A".repeat(201), "price": -0.01},
  {"name": "A".repeat(10000), "price": 1e308}
]

Category 4: Type Confusion

[
  {"name": 12345, "price": "not a number"},
  {"name": true, "price": false},
  {"name": null, "price": null},
  {"name": ["array"], "price": {"object": true}},
  {"name": "", "price": ""}
]

Category 5: Unicode Edge Cases

[
  {"name": "Test\u200BProduct", "price": 10},
  {"name": "Test\u202EProduct", "price": 10},
  {"name": "Test\u0000Product", "price": 10},
  {"name": "\uD800\uDC00", "price": 10},
  {"name": "Test\u200B\u200B\u200B", "price": 10}
]

• \u200B = zero-width space (invisible character in display)
• \u202E = right-to-left override (can reverse text display)
• \u0000 = null byte (can truncate strings in C-based systems)

Category 6: Business Logic

[
  {"name": "Widget", "price": 0.001, "quantity": -1},
  {"name": "Widget", "price": 0, "discount_percent": 101},
  {"name": "Widget", "price": 10, "quantity": 2147483647},
  {"name": "Widget", "price": 10, "ship_date": "1970-01-01"},
  {"name": "Widget", "price": 10, "ship_date": "9999-12-31"}
]

Category 7: Authorization Bypass (IDOR)

[
  {"product_id": "other-users-product-id"},
  {"user_id": "admin-user-id"},
  {"order_id": "../../../etc/passwd"},
  {"id": "0"},
  {"id": "-1"}
]