ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
367 Commits 2 Branches 6 Tags 31 MiB
Python 83.8%
Ruby 6.3%
ASP.NET 3.8%
XSLT 2.6%
Classic ASP 1.4%
Other 1.9%
d0f14cbfde
Go to file
Swissky d0f14cbfde
Merge pull request #66 from cclauss/patch-1 
Use print() function in both Python 2 and Python 3
2019-04-27 01:02:09 +02:00
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
AWS Amazon Bucket S3 Fixed a typing mistake 2019-03-15 16:09:58 +02:00
Command Injection Command injection rewritten 2019-04-21 19:50:50 +02:00
CRLF Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CSRF Injection Linux Privesc - /etc/passwd writable 2019-04-07 23:40:36 +02:00
CSV Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CVE Exploits SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
Directory Traversal SSRF AWS Elastic Beanstak 2019-04-21 18:51:32 +02:00
File Inclusion Command injection rewritten 2019-04-21 19:50:50 +02:00
GraphQL Injection Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Deserialization Added CTF writeup in reference section 2019-03-20 12:19:25 +05:30
Insecure Direct Object References Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Management Interface Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Source Code Management GoGitDumper + MySQL summary rewrite 2019-04-15 00:49:56 +02:00
JSON Web Token SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LDAP Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Methodology and Resources mitm6 + ntlmrelayx 2019-04-21 14:08:18 +02:00
NoSQL Injection add JSON headers 2019-04-24 22:59:24 +02:00
OAuth Fix name's capitalization 2019-03-07 00:07:55 +01:00
Open Redirect Fix name's capitalization 2019-03-07 00:07:55 +01:00
SAML Injection SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
Server Side Request Forgery SSRF Google Cloud - add ssh key 2019-04-22 11:35:07 +02:00
Server Side Template Injection sudo_inject + SSTI FreeMarker + Lin PrivEsc passwords 2019-04-14 21:01:14 +02:00
SQL Injection MSQL UDF sys_exec + SSRF IP: 127.1 and 127.0.1 2019-04-20 20:23:40 +02:00
Type Juggling Fix name's capitalization 2019-03-07 00:07:55 +01:00
Upload Insecure Files Update README.md 2019-04-08 22:49:50 +02:00
Web Cache Deception Fix name's capitalization 2019-03-07 00:07:55 +01:00
Web Sockets Use print() function in both Python 2 and Python 3 2019-04-26 14:35:16 -04:00
XPATH Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
XSS Injection Fixed link for google CSP bypass 2019-04-16 11:37:59 +01:00
XXE Injection Add XXE inside SVG 2019-03-24 03:27:12 +08:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
README.md Fix name's capitalization 2019-03-07 00:07:55 +01:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube