mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2025-01-22 03:08:50 +00:00
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
bountybugbountybypasscheatsheetenumerationhackinghacktoberfestmethodologypayloadpayloadspenetration-testingpentestprivilege-escalationredteamsecurityvulnerabilityweb-application
3b957de607
Add more examples and sections to `Insecure Deserialization/Python.md` and create a new test file `test_python_md.py`. * **Insecure Deserialization/Python.md**: - Add examples of vulnerable code snippets and their secure alternatives for `pickle` and `PyYAML`. - Include a section on common pitfalls and how to avoid them when using deserialization in Python. - Provide a list of tools and libraries that can help detect and prevent insecure deserialization in Python applications. - Add references to relevant documentation, articles, and research papers for further reading. - Include a section on how to test for insecure deserialization vulnerabilities in Python applications, including both manual and automated testing techniques. * **test_python_md.py**: - Import the `unittest` and `re` modules. - Create a test case that reads the `Insecure Deserialization/Python.md` file. - Extract the Python code blocks from the markdown file. - Execute each code block and check for any exceptions. --- For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/swisskyrepo/PayloadsAllTheThings?shareId=XXXX-XXXX-XXXX-XXXX). |
||
|---|---|---|
| _LEARNING_AND_SOCIALS | ||
| _template_vuln | ||
| .github | ||
| Account Takeover | ||
| API Key Leaks | ||
| Business Logic Errors | ||
| Clickjacking | ||
| Client Side Path Traversal | ||
| Command Injection | ||
| CORS Misconfiguration | ||
| CRLF Injection | ||
| Cross-Site Request Forgery | ||
| CSV Injection | ||
| CVE Exploits | ||
| Denial of Service | ||
| Dependency Confusion | ||
| Directory Traversal | ||
| DNS Rebinding | ||
| DOM Clobbering | ||
| File Inclusion | ||
| Google Web Toolkit | ||
| GraphQL Injection | ||
| Headless Browser | ||
| Hidden Parameters | ||
| HTTP Parameter Pollution | ||
| Insecure Deserialization | ||
| Insecure Direct Object References | ||
| Insecure Management Interface | ||
| Insecure Randomness | ||
| Insecure Source Code Management | ||
| Java RMI | ||
| JSON Web Token | ||
| LaTeX Injection | ||
| LDAP Injection | ||
| Mass Assignment | ||
| Methodology and Resources | ||
| NoSQL Injection | ||
| OAuth Misconfiguration | ||
| Open Redirect | ||
| ORM Leak | ||
| Prompt Injection | ||
| Prototype Pollution | ||
| Race Condition | ||
| Regular Expression | ||
| Request Smuggling | ||
| SAML Injection | ||
| Server Side Include Injection | ||
| Server Side Request Forgery | ||
| Server Side Template Injection | ||
| SQL Injection | ||
| Tabnabbing | ||
| Type Juggling | ||
| Upload Insecure Files | ||
| Web Cache Deception | ||
| Web Sockets | ||
| XPATH Injection | ||
| XSLT Injection | ||
| XSS Injection | ||
| XXE Injection | ||
| Zip Slip | ||
| .gitignore | ||
| CONTRIBUTING.md | ||
| custom.css | ||
| DISCLAIMER.md | ||
| LICENSE | ||
| mkdocs.yml | ||
| README.md | ||
| test_python_md.py | ||
Payloads All The Things
A list of useful payloads and bypasses for Web Application Security.
Feel free to improve with your payloads and techniques !
I ❤️ pull requests :)
You can also contribute with a 🍻 IRL, or using the sponsor button
An alternative display version is available at PayloadsAllTheThingsWeb.
📖 Documentation
Every section contains the following files, you can use the _template_vuln folder to create a new chapter:
- README.md - vulnerability description and how to exploit it, including several payloads
- Intruder - a set of files to give to Burp Intruder
- Images - pictures for the README.md
- Files - some files referenced in the README.md
You might also like the other projects from the AllTheThings family :
- InternalAllTheThings - Active Directory and Internal Pentest Cheatsheets
- HardwareAllTheThings - Hardware/IOT Pentesting Wiki
You want more ? Check the Books and Youtube channel selections.
🧑💻 Contributions
Be sure to read CONTRIBUTING.md
Thanks again for your contribution! ❤️
🍻 Sponsors
This project is proudly sponsored by these companies:
