ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
112 Commits 2 Branches 6 Tags 31 MiB
Python 83.8%
Ruby 6.3%
ASP.NET 3.8%
XSLT 2.6%
Classic ASP 1.4%
Other 1.9%
4892dc6577
Go to file
soffensive 4892dc6577 Further payload added
2018-01-26 13:31:52 +01:00
AWS Amazon Bucket S3 Update README.md 2017-08-01 08:37:04 +10:00
CRLF injection CRLF injection updated 2017-05-29 20:41:05 +02:00
CSV injection Fix in juggling type + CSV injection 2016-10-20 10:50:12 +07:00
CVE Shellshock Heartbleed Struts2 Tomcat CVE-2017-12617 2017-10-10 10:19:14 +02:00
File Inclusion - Path Traversal SVG XSS + SSRF enclosed alphanumerics 2017-11-19 14:01:36 +01:00
Insecured source code management Multiple update - LFI/RCE via phpinfo, Struts2 v2 2017-09-13 23:55:29 +02:00
LDAP injection More intruders folder - for BurpSuite 2017-07-30 13:42:32 +02:00
Methodology and Resources Mimikatz + Credential Windows + XXE update 2017-12-06 20:40:29 +01:00
NoSQL injection Further payload added 2018-01-26 13:31:52 +01:00
OAuth Add CSRF to OAuth2 2017-10-16 08:41:43 +02:00
Open redirect File inclusion - more intruders 2017-10-21 16:48:17 +02:00
PHP juggling type Fix in juggling type + CSV injection 2016-10-20 10:50:12 +07:00
PHP serialization PHP object injection 2016-10-20 11:02:19 +07:00
Remote commands execution Upload .htaccess to PHP code exec 2017-10-09 23:17:31 +02:00
Server Side Template injections More Burp Intruder file - SQLi + Path traversal + XSS 2017-08-06 01:12:41 +02:00
SQL injection MySQL - Code exec 2017-11-09 09:05:50 +01:00
SSRF injection SSRF Ip script + DDL & Execute Windows 2017-11-24 09:57:48 +01:00
Tar commands execution Clean project - Renamed and added PHP juggling type 2016-10-20 10:22:24 +07:00
Traversal directory LDAP & XPATH injection + Small fixes and payloads 2017-07-14 23:40:31 +02:00
Upload insecure files MySQL - Code exec 2017-11-09 09:05:50 +01:00
Web cache deception Typo fix in Web cache 2017-02-27 20:06:40 +01:00
XPATH injection LDAP & XPATH injection + Small fixes and payloads 2017-07-14 23:40:31 +02:00
XSS injection Mimikatz + Credential Windows + XXE update 2017-12-06 20:40:29 +01:00
XXE injections Mimikatz + Credential Windows + XXE update 2017-12-06 20:40:29 +01:00
.gitignore Methodology added, XSS payloads updated,little fix 2016-11-06 12:42:50 +07:00
README.md Methodology updated - Dorks, Subdomains, Nmap 2017-05-01 22:40:36 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

Tools

Docker

More resources

Book's list:

Blogs/Websites

Youtube

Practice

Bug Bounty