daffainfo
/
PayloadsAllTheThings
mirror of https://github.com/daffainfo/PayloadsAllTheThings.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
148 Commits
2 Branches
3 Tags
11 MiB
Python 86.3%
Ruby 6.5%
ASP.NET 3.9%
Classic ASP 1.4%
PHP 1.4%
Other 0.4%
 
 
 
 
 
 
Go to file
Swissky abd3c565da Coffee contributing 2018-07-07 12:45:32 +02:00
AWS Amazon Bucket S3 Update README.md 2017-08-01 08:37:04 +10:00
CRLF injection SQLmap tips + Active Directory attacks + SQLite injections 2018-03-12 09:17:31 +01:00
CSV injection Fix in juggling type + CSV injection 2016-10-20 10:50:12 +07:00
CVE Exploits Drupalgeddon2 update + Payment API in Methodology 2018-04-23 18:41:59 +02:00
File Inclusion - Path Traversal Path traversal refactor + AD cme module msf/empire + IIS web.config 2018-07-07 12:04:55 +02:00
Insecured source code management Multiple update - LFI/RCE via phpinfo, Struts2 v2 2017-09-13 23:55:29 +02:00
Java Deserialization SSRF to XSS + Retail account Windows 2018-06-06 00:05:28 +02:00
LDAP injection Refactoring XSS 0/? 2018-03-23 13:53:53 +01:00
Methodology and Resources Path traversal refactor + AD cme module msf/empire + IIS web.config 2018-07-07 12:04:55 +02:00
NoSQL injection Traversal Dir + NoSQL major updates + small addons 2018-02-15 23:27:42 +01:00
OAuth Add CSRF to OAuth2 2017-10-16 08:41:43 +02:00
Open redirect AD Attack - Golden Ticket + SQL/OpenRed/SSRF 2018-04-12 23:23:41 +02:00
PHP juggling type Fix in juggling type + CSV injection 2016-10-20 10:50:12 +07:00
PHP serialization Payloads - Quick fix 2018-02-23 13:48:51 +01:00
Remote commands execution SQLmap tips + Active Directory attacks + SQLite injections 2018-03-12 09:17:31 +01:00
SQL injection Path traversal refactor + AD cme module msf/empire + IIS web.config 2018-07-07 12:04:55 +02:00
SSRF injection SSRF to XSS + Retail account Windows 2018-06-06 00:05:28 +02:00
Server Side Template injections Windows port forwarding - Netsh 2018-06-09 18:56:19 +02:00
Tar commands execution Clean project - Renamed and added PHP juggling type 2016-10-20 10:22:24 +07:00
Traversal directory Traversal Dir + NoSQL major updates + small addons 2018-02-15 23:27:42 +01:00
Upload insecure files Path traversal refactor + AD cme module msf/empire + IIS web.config 2018-07-07 12:04:55 +02:00
Web cache deception Typo fix in Web cache 2017-02-27 20:06:40 +01:00
XPATH injection LDAP & XPATH injection + Small fixes and payloads 2017-07-14 23:40:31 +02:00
XSS injection XSS Colors highlighting + JS code eval 2018-06-27 20:00:17 +02:00
XXE injections Payloads - Quick fix 2018-02-23 13:48:51 +01:00
.gitignore Coffee contributing 2018-07-07 12:45:32 +02:00
README.md Coffee contributing 2018-07-07 12:45:32 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :) You can also contribute with a coffee Coffee or a beer IRL ;)

Every section contains:

  • README.md - vulnerability description and how to exploit it
  • Intruders - a set of files to give to Burp Intruder
  • Some exploits

You might also like :

Tools

Online Challenges

Bug Bounty

Docker

Command Link
docker pull remnux/metasploit docker-metasploit
docker pull paoloo/sqlmap docker-sqlmap
docker pull kalilinux/kali-linux-docker official Kali Linux
docker pull owasp/zap2docker-stable official OWASP ZAP
docker pull wpscanteam/wpscan official WPScan
docker pull infoslack/dvwa Damn Vulnerable Web Application (DVWA)
docker pull danmx/docker-owasp-webgoat OWASP WebGoat Project docker image
docker pull opendns/security-ninjas Security Ninjas
docker pull ismisepaul/securityshepherd OWASP Security Shepherd
docker-compose build && docker-compose up OWASP NodeGoat
docker pull citizenstig/nowasp OWASP Mutillidae II Web Pen-Test Practice Application
docker pull bkimminich/juice-shop OWASP Juice Shop

More resources

Book's list:

Blogs/Websites

Youtube