mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-05-04 19:16:12 +02:00
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
https://github.com/swisskyrepo/PayloadsAllTheThings
4e1077c25e
|
||
|---|---|---|
| AWS Amazon Bucket S3 | ||
| CRLF injection | ||
| CSV injection | ||
| CVE Exploits | ||
| File Inclusion - Path Traversal | ||
| Insecured source code management | ||
| Java Deserialization | ||
| LDAP injection | ||
| LaTeX injection | ||
| Methodology and Resources | ||
| NoSQL injection | ||
| OAuth | ||
| Open redirect | ||
| PHP juggling type | ||
| PHP serialization | ||
| Remote commands execution | ||
| SQL injection | ||
| SSRF injection | ||
| Server Side Template injections | ||
| Tar commands execution | ||
| Traversal directory | ||
| Upload insecure files | ||
| Web cache deception | ||
| XPATH injection | ||
| XSS injection | ||
| XXE injections | ||
| .gitignore | ||
| README.md | ||
Payloads All The Things
A list of useful payloads and bypasses for Web Application Security.
Feel free to improve with your payloads and techniques !
I <3 pull requests :)
You can also contribute with a beer IRL or 
Every section contains:
- README.md - vulnerability description and how to exploit it
- Intruders - a set of files to give to Burp Intruder
- Some exploits
You might also like :
- Methodology and Resources
- CVE Exploits
- Apache Struts 2 CVE-2017-5638.py
- Apache Struts 2 CVE-2017-9805.py
- Drupalgeddon2 CVE-2018-7600.rb
- Heartbleed CVE-2014-0160.py
- Shellshock CVE-2014-6271.py
- Tomcat CVE-2017-12617.py
Tools
- Kali Linux
- Web Developer
- Hackbar - Not compatible with Firefox Quantum
- Burp Proxy
- Fiddler
- DirBuster
- GoBuster
- Knockpy
- SQLmap
- Nikto
- Nessus
- Recon-ng
- Wappalyzer
- Metasploit
- OpenVAS
Online Challenges
- Hack The Box
- Root-Me
- Zenk-Security
- W3Challs
- NewbieContest
- Vulnhub
- The Cryptopals Crypto Challenges
- Penetration Testing Practice Labs
- alert(1) to win
- Hacksplaining
- HackThisSite
- PentesterLab : Learn Web Penetration Testing: The Right Way
- Hackers.gg
Bug Bounty
Docker
| Command | Link |
|---|---|
docker pull remnux/metasploit |
docker-metasploit |
docker pull paoloo/sqlmap |
docker-sqlmap |
docker pull kalilinux/kali-linux-docker |
official Kali Linux |
docker pull owasp/zap2docker-stable |
official OWASP ZAP |
docker pull wpscanteam/wpscan |
official WPScan |
docker pull infoslack/dvwa |
Damn Vulnerable Web Application (DVWA) |
docker pull danmx/docker-owasp-webgoat |
OWASP WebGoat Project docker image |
docker pull opendns/security-ninjas |
Security Ninjas |
docker pull ismisepaul/securityshepherd |
OWASP Security Shepherd |
docker-compose build && docker-compose up |
OWASP NodeGoat |
docker pull citizenstig/nowasp |
OWASP Mutillidae II Web Pen-Test Practice Application |
docker pull bkimminich/juice-shop |
OWASP Juice Shop |
More resources
Book's list:
- Web Hacking 101
- OWASP Testing Guide v4
- Penetration Testing: A Hands-On Introduction to Hacking
- The Hacker Playbook 2: Practical Guide to Penetration Testing
- The Mobile Application Hacker’s Handbook
- Black Hat Python: Python Programming for Hackers and Pentesters
- Metasploit: The Penetration Tester's Guide
- The Database Hacker's Handbook, David Litchfield et al., 2005
- The Shellcoders Handbook by Chris Anley et al., 2007
- The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zovi, 2009
- The Web Application Hackers Handbook by D. Stuttard, M. Pinto, 2011
- iOS Hackers Handbook by Charlie Miller et al., 2012
- Android Hackers Handbook by Joshua J. Drake et al., 2014
- The Browser Hackers Handbook by Wade Alcorn et al., 2014
- The Mobile Application Hackers Handbook by Dominic Chell et al., 2015
- Car Hacker's Handbook by Craig Smith, 2016
Blogs/Websites
- http://blog.zsec.uk/101-web-testing-tooling/
- https://blog.innerht.ml
- https://blog.zsec.uk
- https://www.exploit-db.com/google-hacking-database
- https://www.arneswinnen.net
- https://forum.bugcrowd.com/t/researcher-resources-how-to-become-a-bug-bounty-hunter/1102