daffainfo
/
PayloadsAllTheThings
mirror of https://github.com/daffainfo/PayloadsAllTheThings.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
140 Commits
2 Branches
3 Tags
11 MiB
Python 86.3%
Ruby 6.5%
ASP.NET 3.9%
Classic ASP 1.4%
PHP 1.4%
Other 0.4%
 
 
 
 
 
 
Go to file
Swissky 81eebeaea2 AD - Ropnop Tricks 2018-05-08 22:11:36 +02:00
AWS Amazon Bucket S3 Update README.md 2017-08-01 08:37:04 +10:00
CRLF injection SQLmap tips + Active Directory attacks + SQLite injections 2018-03-12 09:17:31 +01:00
CSV injection Fix in juggling type + CSV injection 2016-10-20 10:50:12 +07:00
CVE Exploits Drupalgeddon2 update + Payment API in Methodology 2018-04-23 18:41:59 +02:00
File Inclusion - Path Traversal SVG XSS + SSRF enclosed alphanumerics 2017-11-19 14:01:36 +01:00
Insecured source code management Multiple update - LFI/RCE via phpinfo, Struts2 v2 2017-09-13 23:55:29 +02:00
Java Deserialization Refactoring XSS 0/? 2018-03-23 13:53:53 +01:00
LDAP injection Refactoring XSS 0/? 2018-03-23 13:53:53 +01:00
Methodology and Resources AD - Ropnop Tricks 2018-05-08 22:11:36 +02:00
NoSQL injection Traversal Dir + NoSQL major updates + small addons 2018-02-15 23:27:42 +01:00
OAuth Add CSRF to OAuth2 2017-10-16 08:41:43 +02:00
Open redirect AD Attack - Golden Ticket + SQL/OpenRed/SSRF 2018-04-12 23:23:41 +02:00
PHP juggling type Fix in juggling type + CSV injection 2016-10-20 10:50:12 +07:00
PHP serialization Payloads - Quick fix 2018-02-23 13:48:51 +01:00
Remote commands execution SQLmap tips + Active Directory attacks + SQLite injections 2018-03-12 09:17:31 +01:00
SQL injection Oracle SQL + SQL injection updates (MS SQL/MYSQL/ GENERAL) 2018-04-27 23:31:58 +02:00
SSRF injection AD Attack - Golden Ticket + SQL/OpenRed/SSRF 2018-04-12 23:23:41 +02:00
Server Side Template injections SQLmap tips + Active Directory attacks + SQLite injections 2018-03-12 09:17:31 +01:00
Tar commands execution Clean project - Renamed and added PHP juggling type 2016-10-20 10:22:24 +07:00
Traversal directory Traversal Dir + NoSQL major updates + small addons 2018-02-15 23:27:42 +01:00
Upload insecure files Payloads - Quick fix 2018-02-23 13:48:51 +01:00
Web cache deception Typo fix in Web cache 2017-02-27 20:06:40 +01:00
XPATH injection LDAP & XPATH injection + Small fixes and payloads 2017-07-14 23:40:31 +02:00
XSS injection Fix README broken links 2018-03-25 23:51:22 +02:00
XXE injections Payloads - Quick fix 2018-02-23 13:48:51 +01:00
.gitignore AD refactoring part1 2018-05-05 17:32:19 +02:00
README.md AD refactoring part1 2018-05-05 17:32:19 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

Every section contains:

  • README.md - vulnerability description and how to exploit it
  • Intruders - a set of files to give to Burp Intruder
  • Some exploits

You might also like :

Tools

Online Challenges

Bug Bounty

Docker

Command Link
docker pull remnux/metasploit docker-metasploit
docker pull paoloo/sqlmap docker-sqlmap
docker pull kalilinux/kali-linux-docker official Kali Linux
docker pull owasp/zap2docker-stable official OWASP ZAP
docker pull wpscanteam/wpscan official WPScan
docker pull infoslack/dvwa Damn Vulnerable Web Application (DVWA)
docker pull danmx/docker-owasp-webgoat OWASP WebGoat Project docker image
docker pull opendns/security-ninjas Security Ninjas
docker pull ismisepaul/securityshepherd OWASP Security Shepherd
docker-compose build && docker-compose up OWASP NodeGoat
docker pull citizenstig/nowasp OWASP Mutillidae II Web Pen-Test Practice Application
docker pull bkimminich/juice-shop OWASP Juice Shop

More resources

Book's list:

Blogs/Websites

Youtube