A list of useful payloads and bypass for Web Application Security and Pentest/CTF https://github.com/swisskyrepo/PayloadsAllTheThings
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Swissky d484212de9
Merge pull request #447 from mschader/patch-5
4 days ago
.github DSRM Admin 10 months ago
API Key Leaks Update README.md 3 weeks ago
AWS Amazon Bucket S3 Fix AWS duplicated tool enumerate-iam 10 months ago
Account Takeover Office Attacks 8 months ago
CORS Misconfiguration Fix typos 10 months ago
CRLF Injection CORS and CRLF README.md updated 1 year ago
CSRF Injection Added referer header validation check in CSRF 4 months ago
CSV Injection Update README.md 7 months ago
CVE Exploits Fix typos 10 months ago
Command Injection Fixed arrow characters in shell prompts for clarity 3 weeks ago
Dependency Confusion Update README.md 2 months ago
Directory Traversal Update directory traversal wordlist 2 weeks ago
File Inclusion Backwards compatibility for Python 2 2 months ago
GraphQL Injection Dependency Confusion + LDAP 4 months ago
HTTP Parameter Pollution Update table 3 months ago
Insecure Deserialization Dependency Confusion + LDAP 4 months ago
Insecure Direct Object References Command injection rewritten 3 years ago
Insecure Management Interface Add Springboot Actuator RCE 12 months ago
Insecure Source Code Management Fix ToC 9 months ago
JSON Web Token DB2 Injection + ADCS 2 months ago
Kubernetes Add Kubernetes Pentest Methodology Part 3 9 months ago
LDAP Injection Dependency Confusion + LDAP 4 months ago
LaTeX Injection Update README.md 3 weeks ago
Methodology and Resources Update Windows - Persistence.md 1 week ago
NoSQL Injection add NoSQLi payload 5 months ago
OAuth Masscan + AD password in description + ZSH revshell bugfix + Mimikatz lsass.dmp 2 years ago
Open Redirect Update README.md 3 weeks ago
Race Condition Race Condition - First Draft 2 years ago
Request Smuggling Add PortSwigger http-desync reborn article 9 months ago
SAML Injection XSW 4 Fix #205 1 year ago
SQL Injection Update Oracle Sql injection.md add sql error 3 weeks ago
Server Side Request Forgery SSRF PDF PhantomJS 1 month ago
Server Side Template Injection Update ssti.fuzz 3 weeks ago
Tabnabbing Fix typos 10 months ago
Type Juggling AMSI + Trust 11 months ago
Upload Insecure Files File Upload Update 3 months ago
Web Cache Deception Fix(Docs): Correcting typos on the repo 1 year ago
Web Sockets Added: Cross-Site WebSocket Hijacking (CSWSH) 2 years ago
XPATH Injection Bind shell cheatsheet (Fix #194) 1 year ago
XSLT Injection AD mitigations 2 years ago
XSS Injection Update XSS README.md 3 weeks ago
XXE Injection Update XXE Injection 5 days ago
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 3 years ago
.gitignore Shell IPv6 + Sandbox credential 3 years ago
BOOKS.md add links books 1 week ago
CONTRIBUTING.md Upload Methodology 1 year ago
LICENSE Create License 2 years ago
README.md Update README.md 1 year ago
TWITTER.md Added gentilkiwi twitter 3 months ago
YOUTUBE.md Update YOUTUBE.md 1 year ago


Payloads All The Things Tweet

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I ❤️ pull requests :)

You can also contribute with a 🍻 IRL, or using the sponsor button.

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it, including several payloads
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

You want more ? Check the Books and Youtube videos selections.