mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-18 10:26:09 +00:00
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
bountybugbountybypasscheatsheetenumerationhackinghacktoberfestmethodologypayloadpayloadspenetration-testingpentestprivilege-escalationredteamsecurityvulnerabilityweb-application
273da9e1b5
Add JSON simple paylaod with autosubmit form. Using autosubmit form instead of AJax, allow to bypass some protection like the Standard Enhanced Tracking Protection in Firfefox, which will refuse to send cookie with cross-site Ajax request (tested with Firefox 115.0.2esr),. |
||
|---|---|---|
| _LEARNING_AND_SOCIALS | ||
| _template_vuln | ||
| .github | ||
| Account Takeover | ||
| API Key Leaks | ||
| Argument Injection | ||
| AWS Amazon Bucket S3 | ||
| Business Logic Errors | ||
| CICD | ||
| Command Injection | ||
| CORS Misconfiguration | ||
| CRLF Injection | ||
| CSRF Injection | ||
| CSV Injection | ||
| CVE Exploits | ||
| Dependency Confusion | ||
| Directory Traversal | ||
| DNS Rebinding | ||
| Dom Clobbering | ||
| File Inclusion | ||
| GraphQL Injection | ||
| HTTP Parameter Pollution | ||
| Insecure Deserialization | ||
| Insecure Direct Object References | ||
| Insecure Management Interface | ||
| Insecure Randomness | ||
| Insecure Source Code Management | ||
| Java RMI | ||
| JSON Web Token | ||
| Kubernetes | ||
| LaTeX Injection | ||
| LDAP Injection | ||
| Mass Assignment | ||
| Methodology and Resources | ||
| NoSQL Injection | ||
| OAuth Misconfiguration | ||
| Open Redirect | ||
| Prompt Injection | ||
| Prototype Pollution | ||
| Race Condition | ||
| Request Smuggling | ||
| SAML Injection | ||
| Server Side Include Injection | ||
| Server Side Request Forgery | ||
| Server Side Template Injection | ||
| SQL Injection | ||
| Tabnabbing | ||
| Type Juggling | ||
| Upload Insecure Files | ||
| Web Cache Deception | ||
| Web Sockets | ||
| XPATH Injection | ||
| XSLT Injection | ||
| XSS Injection | ||
| XXE Injection | ||
| .gitignore | ||
| CONTRIBUTING.md | ||
| custom.css | ||
| LICENSE | ||
| mkdocs.yml | ||
| README.md | ||
Payloads All The Things
A list of useful payloads and bypasses for Web Application Security.
Feel free to improve with your payloads and techniques !
I ❤️ pull requests :)
You can also contribute with a 🍻 IRL, or using the sponsor button
An alternative display version is available at PayloadsAllTheThingsWeb.
📖 Documentation
Every section contains the following files, you can use the _template_vuln folder to create a new chapter:
- README.md - vulnerability description and how to exploit it, including several payloads
- Intruder - a set of files to give to Burp Intruder
- Images - pictures for the README.md
- Files - some files referenced in the README.md
You might also like the Methodology and Resources folder :
- Methodology and Resources
- Active Directory Attack.md
- Cloud - AWS Pentest.md
- Cloud - Azure Pentest.md
- Cobalt Strike - Cheatsheet.md
- Linux - Evasion.md
- Linux - Persistence.md
- Linux - Privilege Escalation.md
- Metasploit - Cheatsheet.md
- Methodology and enumeration.md
- Network Pivoting Techniques.md
- Network Discovery.md
- Reverse Shell Cheatsheet.md
- Subdomains Enumeration.md
- Windows - AMSI Bypass.md
- Windows - DPAPI.md
- Windows - Download and Execute.md
- Windows - Mimikatz.md
- Windows - Persistence.md
- Windows - Privilege Escalation.md
- Windows - Using credentials.md
You want more ? Check the Books and Youtube videos selections.
👨💻 Contributions
Be sure to read CONTRIBUTING.md
Thanks again for your contribution! ❤️
🧙♂️ Sponsors
This project is proudly sponsored by these companies.
