A list of useful payloads and bypass for Web Application Security and Pentest/CTF https://github.com/swisskyrepo/PayloadsAllTheThings
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Swissky 12ee527763
Merge pull request #500 from tarishard/master
4 days ago
.github DSRM Admin 1 year ago
API Key Leaks TruffleHog examples + Cortex XDR disable 1 month ago
AWS Amazon Bucket S3 Update README.md 6 months ago
Account Takeover Certifried CVE-2022-26923 1 week ago
CORS Misconfiguration Fix typos 1 year ago
CRLF Injection CORS and CRLF README.md updated 2 years ago
CSRF Injection Added referer header validation check in CSRF 11 months ago
CSV Injection Update README.md 1 year ago
CVE Exploits AD + Log4shell + Windows Startup 5 months ago
Command Injection added new bypass 2 months ago
DNS Rebinding Add DNS rebinding 7 months ago
Dependency Confusion Windows Management Instrumentation Event Subscription 4 weeks ago
Directory Traversal MSSQL Agent Command Execution 2 months ago
File Inclusion Graftcp Cheatsheet 5 months ago
GraphQL Injection Dependency Confusion + LDAP 11 months ago
HTTP Parameter Pollution Fixed typo 7 months ago
Insecure Deserialization Add warning about cPickle 1 month ago
Insecure Direct Object References Command injection rewritten 3 years ago
Insecure Management Interface Add Springboot Actuator RCE 2 years ago
Insecure Source Code Management Fix ToC 1 year ago
JSON Web Token DB2 Injection + ADCS 10 months ago
Java RMI samAccountName spoofing + Java RMI 5 months ago
Kubernetes Add kubescape to kubernetes tools 7 months ago
LDAP Injection Dependency Confusion + LDAP 11 months ago
LaTeX Injection LaTeX Injection catcode 3 months ago
Methodology and Resources WSUS Exploitation 1 week ago
NoSQL Injection NoSQLi: add POST with urlencoded body 7 months ago
OAuth Masscan + AD password in description + ZSH revshell bugfix + Mimikatz lsass.dmp 3 years ago
Open Redirect Update README.md 8 months ago
Race Condition Updated Race Condition README.md 1 month ago
Request Smuggling Add PortSwigger http-desync reborn article 1 year ago
SAML Injection Add ZAP Addon in Tools 3 weeks ago
SQL Injection Single quotes are messing with the command. 1 week ago
Server Side Request Forgery Added information on 307 and 308 redirects 4 days ago
Server Side Template Injection Update README.md 1 month ago
Tabnabbing Fix typos 1 year ago
Type Juggling AMSI + Trust 1 year ago
Upload Insecure Files SCCM deployment + JSON uploads 2 weeks ago
Web Cache Deception Fix(Docs): Correcting typos on the repo 2 years ago
Web Sockets Added: Cross-Site WebSocket Hijacking (CSWSH) 2 years ago
XPATH Injection Bind shell cheatsheet (Fix #194) 2 years ago
XSLT Injection AD mitigations 2 years ago
XSS Injection Updated README.md 1 month ago
XXE Injection Update XXE Injection 7 months ago
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 3 years ago
.gitignore Shell IPv6 + Sandbox credential 3 years ago
BOOKS.md Update BOOKS.md 4 months ago
CONTRIBUTING.md Upload Methodology 2 years ago
LICENSE Create License 3 years ago
README.md Contributions README 2 weeks ago
TWITTER.md Added gentilkiwi twitter 10 months ago
YOUTUBE.md Update YOUTUBE.md 2 years ago


Payloads All The Things Tweet

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I pull requests :)

You can also contribute with a 🍻 IRL, or using the sponsor button.

📖 Documentation

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it, including several payloads
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

You want more ? Check the Books and Youtube videos selections.

👨💻 Contributions

Thanks again for your contribution!