ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 10:26:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
377 Commits 2 Branches 6 Tags 31 MiB
Python 83.8%
Ruby 6.3%
ASP.NET 3.8%
XSLT 2.6%
Classic ASP 1.4%
Other 1.9%
506014dd5f
Go to file
Alexis VIALARET 506014dd5f
Some link's markdown was broken
2019-05-24 17:15:33 +02:00
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
AWS Amazon Bucket S3 Fixed a typing mistake 2019-03-15 16:09:58 +02:00
Command Injection Remove http:// prefix for DNS queries 2019-05-07 18:14:49 +02:00
CRLF Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CSRF Injection Linux Privesc - /etc/passwd writable 2019-04-07 23:40:36 +02:00
CSV Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CVE Exploits SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
Directory Traversal SSRF AWS Elastic Beanstak 2019-04-21 18:51:32 +02:00
File Inclusion RFI - Windows SMB allow_url_include = "Off" 2019-05-12 22:23:55 +02:00
GraphQL Injection Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Deserialization Added CTF writeup in reference section 2019-03-20 12:19:25 +05:30
Insecure Direct Object References Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Management Interface Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Source Code Management XSS without parenthesis, semi-colon + Lontara 2019-05-15 21:55:17 +02:00
JSON Web Token SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LDAP Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Methodology and Resources XSS without parenthesis, semi-colon + Lontara 2019-05-15 21:55:17 +02:00
NoSQL Injection add JSON headers 2019-04-24 22:59:24 +02:00
OAuth Masscan + AD password in description + ZSH revshell bugfix + Mimikatz lsass.dmp 2019-05-12 21:34:09 +02:00
Open Redirect Fix name's capitalization 2019-03-07 00:07:55 +01:00
SAML Injection XSLT in SAML 2019-04-28 13:06:59 +02:00
Server Side Request Forgery XSS without parenthesis, semi-colon + Lontara 2019-05-15 21:55:17 +02:00
Server Side Template Injection sudo_inject + SSTI FreeMarker + Lin PrivEsc passwords 2019-04-14 21:01:14 +02:00
SQL Injection Some link's markdown was broken 2019-05-24 17:15:33 +02:00
Type Juggling Fix name's capitalization 2019-03-07 00:07:55 +01:00
Upload Insecure Files Update README.md 2019-04-08 22:49:50 +02:00
Web Cache Deception Fix name's capitalization 2019-03-07 00:07:55 +01:00
Web Sockets Use print() function in both Python 2 and Python 3 2019-04-26 14:35:16 -04:00
XPATH Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
XSS Injection XSS without parenthesis, semi-colon + Lontara 2019-05-15 21:55:17 +02:00
XXE Injection Add XXE inside SVG 2019-03-24 03:27:12 +08:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
BOOKS.md README rewrite : BOOKS and YOUTUBE 2019-05-12 22:43:42 +02:00
README.md Fix YOUTUBE and BOOKS links 2019-05-12 22:59:22 +02:00
YOUTUBE.md Fix YOUTUBE and BOOKS links 2019-05-12 22:59:22 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I ❤️ pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

You want more ? Check the Books and Youtube videos selections.