ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 10:26:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
2,023 Commits 2 Branches 6 Tags 31 MiB
Python 83.8%
Ruby 6.3%
ASP.NET 3.8%
XSLT 2.6%
Classic ASP 1.4%
Other 1.9%
9932059563
Go to file
Swissky 9932059563 YAML Deserialization
2024-11-17 20:48:10 +01:00
_LEARNING_AND_SOCIALS Update _template_vuln page 2024-11-13 13:39:19 +01:00
_template_vuln Update _template_vuln page 2024-11-13 13:39:19 +01:00
.github Github Action - Markdown Linting for PR 2024-11-13 12:29:42 +01:00
Account Takeover Fix markdown style issues in Account Takeover 2024-11-13 15:30:33 +01:00
API Key Leaks SQL Injection - Methodology 2024-11-15 14:48:58 +01:00
Business Logic Errors Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
Clickjacking Fix invalid spaces indents 2024-11-13 14:08:26 +01:00
Client Side Path Traversal Normalize page header for Web Socket, XSLT, XSS, XXE 2024-11-10 21:15:44 +01:00
Command Injection Challenges added for CRLF, Command Injection, File Inclusion 2024-11-12 19:01:34 +01:00
CORS Misconfiguration Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
CRLF Injection Challenges added for CRLF, Command Injection, File Inclusion 2024-11-12 19:01:34 +01:00
Cross-Site Request Forgery Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
CSV Injection Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
CVE Exploits Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
Denial of Service Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
Dependency Confusion Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
Directory Traversal Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
DNS Rebinding Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
DOM Clobbering Normalize page header for CSRF, DNS, DOS, Dependencies 2024-11-10 11:18:46 +01:00
File Inclusion Challenges added for CRLF, Command Injection, File Inclusion 2024-11-12 19:01:34 +01:00
Google Web Toolkit Normalize page header for GraphQL, Deserialization, SCM 2024-11-10 14:37:48 +01:00
GraphQL Injection Challenges added for CRLF, Command Injection, File Inclusion 2024-11-12 19:01:34 +01:00
Headless Browser Normalize page header for GraphQL, Deserialization, SCM 2024-11-10 14:37:48 +01:00
Hidden Parameters Normalize page header for GraphQL, Deserialization, SCM 2024-11-10 14:37:48 +01:00
HTTP Parameter Pollution References added for GWT, GraphQL, HTTP, Headless 2024-11-06 23:32:18 +01:00
Insecure Deserialization YAML Deserialization 2024-11-17 20:48:10 +01:00
Insecure Direct Object References Normalize page header for GraphQL, Deserialization, SCM 2024-11-10 14:37:48 +01:00
Insecure Management Interface Fix invalid spaces indents 2024-11-13 14:08:26 +01:00
Insecure Randomness Normalize page header for GraphQL, Deserialization, SCM 2024-11-10 14:37:48 +01:00
Insecure Source Code Management Fix invalid spaces indents 2024-11-13 14:08:26 +01:00
Java RMI Fix invalid spaces indents 2024-11-13 14:08:26 +01:00
JSON Web Token Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
LaTeX Injection Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
LDAP Injection Fix invalid spaces indents 2024-11-13 14:08:26 +01:00
Mass Assignment Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
Methodology and Resources Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
NoSQL Injection Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
OAuth Misconfiguration Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
Open Redirect Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
ORM Leak Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
Prompt Injection References updated for NoSQL, OAuth, ORM, Prompt, RegEx 2024-11-07 16:20:58 +01:00
Prototype Pollution Normalize page header for JWT, LDAP, LaTeX, OAuth, ORM 2024-11-10 15:28:12 +01:00
Race Condition Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
Regular Expression Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
Request Smuggling Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
SAML Injection Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
Server Side Include Injection Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
Server Side Request Forgery Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
Server Side Template Injection Normalize page header for SSTI, SAML, SSI 2024-11-10 19:14:16 +01:00
SQL Injection YAML Deserialization 2024-11-17 20:48:10 +01:00
Tabnabbing Normalize page header for SQLi, Upload, Cache Deception 2024-11-10 20:49:52 +01:00
Type Juggling Challenges added for CRLF, Command Injection, File Inclusion 2024-11-12 19:01:34 +01:00
Upload Insecure Files Normalize page header for SQLi, Upload, Cache Deception 2024-11-10 20:49:52 +01:00
Web Cache Deception Normalize page header for SQLi, Upload, Cache Deception 2024-11-10 20:49:52 +01:00
Web Sockets Normalize page header for Web Socket, XSLT, XSS, XXE 2024-11-10 21:15:44 +01:00
XPATH Injection Normalize page header for Web Socket, XSLT, XSS, XXE 2024-11-10 21:15:44 +01:00
XSLT Injection Normalize page header for Web Socket, XSLT, XSS, XXE 2024-11-10 21:15:44 +01:00
XSS Injection Fix invalid spaces indents 2024-11-13 14:08:26 +01:00
XXE Injection Normalize page header for Web Socket, XSLT, XSS, XXE 2024-11-10 21:15:44 +01:00
Zip Slip Fix markdown style issues in Account Takeover 2024-11-13 15:30:33 +01:00
.gitignore YAML Deserialization 2022-09-16 16:37:40 +02:00
CONTRIBUTING.md CONTRIBUTING page updates - adding rules 2024-11-13 14:24:09 +01:00
custom.css CSS - Update style color + Blind SQL Oracle 2023-12-10 13:27:21 +01:00
LICENSE Create License 2019-05-25 16:27:35 +02:00
mkdocs.yml SSTI references updates 2024-11-03 20:54:01 +01:00
README.md Fix typos 2024-09-16 18:05:54 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques !
I ❤️ pull requests :)

You can also contribute with a 🍻 IRL, or using the sponsor button

Sponsor Tweet

An alternative display version is available at PayloadsAllTheThingsWeb.

📖 Documentation

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it, including several payloads
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the other projects from the AllTheThings family :

You want more ? Check the Books and Youtube channel selections.

🧑‍💻 Contributions

Be sure to read CONTRIBUTING.md

Thanks again for your contribution! ❤️

🍻 Sponsors

This project is proudly sponsored by these companies: