mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-18 18:36:10 +00:00
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
bountybugbountybypasscheatsheetenumerationhackinghacktoberfestmethodologypayloadpayloadspenetration-testingpentestprivilege-escalationredteamsecurityvulnerabilityweb-application
aef5bb864a
Added 3 yahoo jsonp endpoints * https://ads.yap.yahoo.com/nosdk/wj/v1/getAds.do?cb=alert(1337) * https://mempf.yahoo.co.jp/offer?position=h&callback=alert(1337) * https://suggest-shop.yahooapis.jp/Shopping/Suggest/V1/suggester?callback=alert(1)//&appid=dj0zaiZpPVkwMDJ1RHlqOEdwdCZzPWNvbnN1bWVyc2VjcmV0Jng9M2Y- |
||
|---|---|---|
| _template_vuln | ||
| .github | ||
| API Key Leaks | ||
| AWS Amazon Bucket S3 | ||
| Command Injection | ||
| CORS Misconfiguration | ||
| CRLF Injection | ||
| CSRF Injection | ||
| CSV Injection | ||
| CVE Exploits | ||
| Directory Traversal | ||
| File Inclusion | ||
| GraphQL Injection | ||
| Insecure Deserialization | ||
| Insecure Direct Object References | ||
| Insecure Management Interface | ||
| Insecure Source Code Management | ||
| JSON Web Token | ||
| Kubernetes | ||
| LaTeX Injection | ||
| LDAP Injection | ||
| Methodology and Resources | ||
| NoSQL Injection | ||
| OAuth | ||
| Open Redirect | ||
| SAML Injection | ||
| Server Side Request Forgery | ||
| Server Side Template Injection | ||
| SQL Injection | ||
| Type Juggling | ||
| Upload Insecure Files | ||
| Web Cache Deception | ||
| Web Sockets | ||
| XPATH Injection | ||
| XSS Injection | ||
| XXE Injection | ||
| .gitignore | ||
| BOOKS.md | ||
| LICENSE | ||
| README.md | ||
| YOUTUBE.md | ||
Payloads All The Things
A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I ❤️ pull requests :)
You can also contribute with a 🍻 IRL
Every section contains the following files, you can use the _template_vuln folder to create a new chapter:
- README.md - vulnerability description and how to exploit it
- Intruder - a set of files to give to Burp Intruder
- Images - pictures for the README.md
- Files - some files referenced in the README.md
You might also like the Methodology and Resources folder :
-
- Active Directory Attack.md
- Linux - Persistence.md
- Linux - Privilege Escalation.md
- Metasploit - Cheatsheet.md
- Methodology and enumeration.md
- Network Pivoting Techniques.md
- Network Discovery.md
- Reverse Shell Cheatsheet.md
- Subdomains Enumeration.md
- Windows - Download and Execute.md
- Windows - Mimikatz.md
- Windows - Persistence.md
- Windows - Post Exploitation Koadic.md
- Windows - Privilege Escalation.md
- Windows - Using credentials.md
-
- Apache Struts 2 CVE-2013-2251 CVE-2017-5638 CVE-2018-11776_.py
- Apache Struts 2 CVE-2017-9805.py
- Apache Struts 2 CVE-2018-11776.py
- Docker API RCE.py
- Drupalgeddon2 CVE-2018-7600.rb
- Heartbleed CVE-2014-0160.py
- JBoss CVE-2015-7501.py
- Jenkins CVE-2015-8103.py
- Jenkins CVE-2016-0792.py
- Rails CVE-2019-5420.rb
- Shellshock CVE-2014-6271.py
- Tomcat CVE-2017-12617.py
- WebLogic CVE-2016-3510.py
- WebLogic CVE-2017-10271.py
- WebLogic CVE-2018-2894.py
- WebSphere CVE-2015-7450.py
You want more ? Check the Books and Youtube videos selections.