wanderer/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2026-03-09 21:58:26 +01:00
Code Issues Releases Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF https://github.com/swisskyrepo/PayloadsAllTheThings
2,174 Commits 2 Branches 7 Tags 82 MiB
Python 76.2%
ASP.NET 8.7%
XSLT 5.9%
Classic ASP 3.2%
PHP 3.1%
Other 2.8%
master
Go to file
Swissky 497fbe925b Archive external reference links via Wayback Machine 
Replace direct URLs in Markdown references with their
web.archive.org equivalents to prevent link rot.
2026-03-09 13:02:28 +01:00
_LEARNING_AND_SOCIALS Fix markdown linting 2025-11-15 17:36:38 +01:00
_template_vuln Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
.github chore: Update outdated GitHub Actions versions 2026-01-20 14:22:44 +01:00
Account Takeover Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
API Key Leaks Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Brute Force Rate Limit Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Business Logic Errors Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Clickjacking Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Client Side Path Traversal Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Command Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
CORS Misconfiguration Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
CRLF Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Cross-Site Request Forgery Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
CSS Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
CSV Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
CVE Exploits Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Denial of Service Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Dependency Confusion Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Directory Traversal Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
DNS Rebinding Markdown Linting - CSV, CVE, DBS, LFI, GWT, GraphQL 2025-03-26 16:22:53 +01:00
DOM Clobbering Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Encoding Transformations Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
External Variable Modification Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
File Inclusion Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Google Web Toolkit Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
GraphQL Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Headless Browser Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Hidden Parameters Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
HTTP Parameter Pollution Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Insecure Deserialization Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Insecure Direct Object References Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Insecure Management Interface Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Insecure Randomness Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Insecure Source Code Management Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Java RMI Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
JSON Web Token Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
LaTeX Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
LDAP Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Mass Assignment Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Methodology and Resources Update Web Attack Surface.md 2025-10-02 10:50:07 +02:00
NoSQL Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
OAuth Misconfiguration Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Open Redirect Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
ORM Leak Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Prompt Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Prototype Pollution Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Race Condition Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Regular Expression Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Request Smuggling Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Reverse Proxy Misconfigurations Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
SAML Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Server Side Include Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Server Side Request Forgery Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Server Side Template Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
SQL Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Tabnabbing Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Type Juggling Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Upload Insecure Files Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Virtual Hosts Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Web Cache Deception Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Web Sockets Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
XPATH Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
XS-Leak Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
XSLT Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
XSS Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
XXE Injection Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
Zip Slip Archive external reference links via Wayback Machine 2026-03-09 13:02:28 +01:00
.gitignore YAML Deserialization 2022-09-16 16:37:40 +02:00
CONTRIBUTING.md Fix broken links 2025-03-27 11:16:36 +01:00
custom.css CSS - Update style color + Blind SQL Oracle 2023-12-10 13:27:21 +01:00
DISCLAIMER.md Markdown Linting - Methodology 2025-03-24 16:00:54 +01:00
LICENSE Create License 2019-05-25 16:27:35 +02:00
mkdocs.yml chore(docs): fix MkDocs edit link and polish README grammar 2025-09-19 15:13:54 +05:30
README.md chore(docs): fix MkDocs edit link and polish README grammar 2025-09-19 15:13:54 +05:30

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques!

You can also contribute with a 🍻 IRL, or using the sponsor button.

Sponsor Tweet

An alternative display version is available at PayloadsAllTheThingsWeb.

banner

📖 Documentation

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it, including several payloads
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the other projects from the AllTheThings family :

You want more? Check the Books and YouTube channel selections.

🧑‍💻 Contributions

Be sure to read CONTRIBUTING.md

sponsors-list

Thanks again for your contribution! ❤️

🍻 Sponsors

This project is proudly sponsored by these companies.

Logo Description
sponsor-serpapi SerpApi is a real time API to access Google search results. It solves the issues of having to rent proxies, solving captchas, and JSON parsing.
sponsor-projectdiscovery ProjectDiscovery - Detect real, exploitable vulnerabilities. Harness the power of Nuclei for fast and accurate findings without false positives.
sponsor-vaadata VAADATA - Ethical Hacking Services