wanderer/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-11-07 05:18:46 +01:00
Code Issues Releases Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF https://github.com/swisskyrepo/PayloadsAllTheThings
2,122 Commits 2 Branches 7 Tags 65 MiB
Python 83.8%
Ruby 6.3%
ASP.NET 3.8%
XSLT 2.6%
Classic ASP 1.4%
Other 1.9%
master
Go to file
Swissky 5c0ee4c6d9 SQL injection hashed password + MSSQL links
2025-11-02 18:21:19 +01:00
_LEARNING_AND_SOCIALS Markdown Linting - Source Code, JWT, RMI, LDAP, LaTeX 2025-03-26 16:48:22 +01:00
_template_vuln Update _template_vuln page 2024-11-13 13:39:19 +01:00
.github Update GitHub Actions 2025-10-01 14:52:10 +02:00
Account Takeover Fix several typos 2025-07-29 15:34:52 +02:00
API Key Leaks Markdown Linting - API, Business Logic, Clickjacking 2025-03-24 16:16:58 +01:00
Brute Force Rate Limit Markdown Fix Lint 2025-10-05 18:54:42 +02:00
Business Logic Errors Rounding Errors 2025-08-03 16:32:40 +02:00
Clickjacking Markdown Linting - API, Business Logic, Clickjacking 2025-03-24 16:16:58 +01:00
Client Side Path Traversal Markdown Linting - CORS, CRLF, CSPT, CSRF, Command Injection 2025-03-24 16:52:42 +01:00
Command Injection Lint fix 2025-08-14 11:09:47 +02:00
CORS Misconfiguration Markdown Linting - CORS, CRLF, CSPT, CSRF, Command Injection 2025-03-24 16:52:42 +01:00
CRLF Injection Markdown Linting - CORS, CRLF, CSPT, CSRF, Command Injection 2025-03-24 16:52:42 +01:00
Cross-Site Request Forgery Markdown Linting - CORS, CRLF, CSPT, CSRF, Command Injection 2025-03-24 16:52:42 +01:00
CSV Injection Fix several typos 2025-07-29 15:34:52 +02:00
CVE Exploits Markdown Linting - CSV, CVE, DBS, LFI, GWT, GraphQL 2025-03-26 16:22:53 +01:00
Denial of Service XXE - Fix typo 2025-03-17 17:02:00 +01:00
Dependency Confusion Markdown Linting - CSV, CVE, DBS, LFI, GWT, GraphQL 2025-03-26 16:22:53 +01:00
Directory Traversal Markdown Linting - CSV, CVE, DBS, LFI, GWT, GraphQL 2025-03-26 16:22:53 +01:00
DNS Rebinding Markdown Linting - CSV, CVE, DBS, LFI, GWT, GraphQL 2025-03-26 16:22:53 +01:00
DOM Clobbering Virtual Hosts + Encoding and Transformations 2025-08-12 20:59:36 +02:00
Encoding Transformations SQL injection - Fix linting errors 2025-08-13 12:07:35 +02:00
External Variable Modification External Variable Modification 2025-03-07 12:15:00 +01:00
File Inclusion Fix broken links 2025-03-27 11:16:36 +01:00
Google Web Toolkit Markdown Linting - CSV, CVE, DBS, LFI, GWT, GraphQL 2025-03-26 16:22:53 +01:00
GraphQL Injection Brute Force and Rate Limit 2025-10-05 18:51:11 +02:00
Headless Browser Reverse Proxy Misconfigurations 2025-07-24 14:06:52 +02:00
Hidden Parameters Markdown Linting - Parameters, Browsers, Deserialization Randomness 2025-03-26 16:33:07 +01:00
HTTP Parameter Pollution Markdown Linting - Parameters, Browsers, Deserialization Randomness 2025-03-26 16:33:07 +01:00
Insecure Deserialization Rounding Errors 2025-08-03 16:32:40 +02:00
Insecure Direct Object References Markdown Linting - Parameters, Browsers, Deserialization Randomness 2025-03-26 16:33:07 +01:00
Insecure Management Interface Markdown Linting - Parameters, Browsers, Deserialization Randomness 2025-03-26 16:33:07 +01:00
Insecure Randomness Rounding Errors 2025-08-03 16:32:40 +02:00
Insecure Source Code Management Markdown Linting - Source Code, JWT, RMI, LDAP, LaTeX 2025-03-26 16:48:22 +01:00
Java RMI Markdown Linting - Source Code, JWT, RMI, LDAP, LaTeX 2025-03-26 16:48:22 +01:00
JSON Web Token Markdown Linting - Source Code, JWT, RMI, LDAP, LaTeX 2025-03-26 16:48:22 +01:00
LaTeX Injection Markdown Linting - Source Code, JWT, RMI, LDAP, LaTeX 2025-03-26 16:48:22 +01:00
LDAP Injection Markdown Linting - Source Code, JWT, RMI, LDAP, LaTeX 2025-03-26 16:48:22 +01:00
Mass Assignment Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
Methodology and Resources Update Web Attack Surface.md 2025-10-02 10:50:07 +02:00
NoSQL Injection Update NoSQL.txt 2025-04-21 16:59:08 +07:00
OAuth Misconfiguration Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
Open Redirect Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
ORM Leak Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
Prompt Injection Update README.md 2025-08-06 22:30:25 +03:00
Prototype Pollution Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
Race Condition Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
Regular Expression Markdown Linting - Mass Assignment, NoSQL, OAuth, Redirect 2025-03-26 17:06:01 +01:00
Request Smuggling Markdown Linting - SSI, SSRF, SSTI 2025-03-26 17:49:42 +01:00
Reverse Proxy Misconfigurations Reverse Proxy Misconfigurations 2025-07-24 14:06:52 +02:00
SAML Injection Markdown Linting - SSI, SSRF, SSTI 2025-03-26 17:49:42 +01:00
Server Side Include Injection Markdown Linting - SSI, SSRF, SSTI 2025-03-26 17:49:42 +01:00
Server Side Request Forgery Lint fix 2025-08-14 11:09:47 +02:00
Server Side Template Injection fix(markdown): add blank lines around fenced code blocks to satisfy MD031 2025-08-13 18:29:00 +00:00
SQL Injection SQL injection hashed password + MSSQL links 2025-11-02 18:21:19 +01:00
Tabnabbing Markdown Linting - SQL, Juggling, XSLT, XSS, Zip 2025-03-26 20:53:03 +01:00
Type Juggling SQL injection - Generic Bypass (Space) 2025-07-26 22:54:45 +02:00
Upload Insecure Files Virtual Hosts + Encoding and Transformations 2025-08-12 20:59:36 +02:00
Virtual Hosts Virtual Hosts + Encoding and Transformations 2025-08-12 20:59:36 +02:00
Web Cache Deception 2025-04-04 Add Detecting Web Cache Deception Content 2025-04-04 00:20:27 +08:00
Web Sockets Headless Browser + JSON Jackson 2025-07-02 22:23:13 +02:00
XPATH Injection Markdown Linting - SQL, Juggling, XSLT, XSS, Zip 2025-03-26 20:53:03 +01:00
XSLT Injection Markdown Linting - SQL, Juggling, XSLT, XSS, Zip 2025-03-26 20:53:03 +01:00
XSS Injection PDO Prepared Statements 2025-07-26 15:21:23 +02:00
XXE Injection XXE - Fix typo 2025-03-17 17:02:00 +01:00
Zip Slip Markdown Linting - SQL, Juggling, XSLT, XSS, Zip 2025-03-26 20:53:03 +01:00
.gitignore YAML Deserialization 2022-09-16 16:37:40 +02:00
CONTRIBUTING.md Fix broken links 2025-03-27 11:16:36 +01:00
custom.css CSS - Update style color + Blind SQL Oracle 2023-12-10 13:27:21 +01:00
DISCLAIMER.md Markdown Linting - Methodology 2025-03-24 16:00:54 +01:00
LICENSE Create License 2019-05-25 16:27:35 +02:00
mkdocs.yml chore(docs): fix MkDocs edit link and polish README grammar 2025-09-19 15:13:54 +05:30
README.md chore(docs): fix MkDocs edit link and polish README grammar 2025-09-19 15:13:54 +05:30

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques!

You can also contribute with a 🍻 IRL, or using the sponsor button.

Sponsor Tweet

An alternative display version is available at PayloadsAllTheThingsWeb.

banner

📖 Documentation

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it, including several payloads
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the other projects from the AllTheThings family :

You want more? Check the Books and YouTube channel selections.

🧑‍💻 Contributions

Be sure to read CONTRIBUTING.md

sponsors-list

Thanks again for your contribution! ❤️

🍻 Sponsors

This project is proudly sponsored by these companies.

Logo Description
sponsor-serpapi SerpApi is a real time API to access Google search results. It solves the issues of having to rent proxies, solving captchas, and JSON parsing.
sponsor-projectdiscovery ProjectDiscovery - Detect real, exploitable vulnerabilities. Harness the power of Nuclei for fast and accurate findings without false positives.
sponsor-vaadata VAADATA - Ethical Hacking Services