daffainfo
/
PayloadsAllTheThings
mirror of https://github.com/daffainfo/PayloadsAllTheThings.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
174 Commits
2 Branches
3 Tags
11 MiB
Python 86.3%
Ruby 6.5%
ASP.NET 3.9%
Classic ASP 1.4%
PHP 1.4%
Other 0.4%
 
 
 
 
 
 
Go to file
Swissky c38adaded3 CVE Apache Struts + XSS in Python Notebook 2018-08-28 18:48:26 +02:00
AWS Amazon Bucket S3 Markdown formatting update 2018-08-12 23:30:22 +02:00
CRLF injection Markdown formatting update 2018-08-12 23:30:22 +02:00
CSV injection Markdown formatting - Part 2 2018-08-13 12:01:13 +02:00
CVE Exploits CVE Apache Struts + XSS in Python Notebook 2018-08-28 18:48:26 +02:00
File Inclusion - Path Traversal LFI via Upload (race condition) + Network Pivot nmap 2018-08-26 15:43:26 +02:00
Insecured source code management Markdown formatting update 2018-08-12 23:30:22 +02:00
Java Deserialization Markdown formatting update 2018-08-12 23:30:22 +02:00
LDAP injection Markdown formatting update 2018-08-12 23:30:22 +02:00
LaTeX injection Markdown formatting update 2018-08-12 23:30:22 +02:00
Methodology and Resources LFI via Upload (race condition) + Network Pivot nmap 2018-08-26 15:43:26 +02:00
NoSQL injection Markdown formatting update 2018-08-12 23:30:22 +02:00
OAuth Markdown formatting update 2018-08-12 23:30:22 +02:00
Open redirect Markdown formatting update 2018-08-12 23:30:22 +02:00
PHP juggling type Markdown formatting update 2018-08-12 23:30:22 +02:00
PHP serialization ImageTragick v2 + Angular 1.6+ XSS 2018-08-22 21:42:25 +02:00
Remote commands execution Markdown formatting update 2018-08-12 23:30:22 +02:00
SQL injection Markdown formatting update 2018-08-12 23:30:22 +02:00
SSRF injection LFI via Upload (race condition) + Network Pivot nmap 2018-08-26 15:43:26 +02:00
Server Side Template injections Markdown formatting update 2018-08-12 23:30:22 +02:00
Tar commands execution Markdown formatting update 2018-08-12 23:30:22 +02:00
Traversal directory Markdown formatting update 2018-08-12 23:30:22 +02:00
Upload insecure files ImageTragick v2 + Angular 1.6+ XSS 2018-08-22 21:42:25 +02:00
Web cache deception Markdown formatting update 2018-08-12 23:30:22 +02:00
XPATH injection Markdown formatting update 2018-08-12 23:30:22 +02:00
XSS injection CVE Apache Struts + XSS in Python Notebook 2018-08-28 18:48:26 +02:00
XXE injection Markdown formatting update 2018-08-12 23:30:22 +02:00
.gitignore Markdown formatting - Part 3 2018-08-13 13:07:37 +02:00
README.md Markdown formatting - Part 2 2018-08-13 12:01:13 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains:

  • README.md - vulnerability description and how to exploit it
  • Intruders - a set of files to give to Burp Intruder
  • Some exploits

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube

Docker

Command Link
docker pull remnux/metasploit docker-metasploit
docker pull paoloo/sqlmap docker-sqlmap
docker pull kalilinux/kali-linux-docker official Kali Linux
docker pull owasp/zap2docker-stable official OWASP ZAP
docker pull wpscanteam/wpscan official WPScan
docker pull infoslack/dvwa Damn Vulnerable Web Application (DVWA)
docker pull danmx/docker-owasp-webgoat OWASP WebGoat Project docker image
docker pull opendns/security-ninjas Security Ninjas
docker pull ismisepaul/securityshepherd OWASP Security Shepherd
docker-compose build && docker-compose up OWASP NodeGoat
docker pull citizenstig/nowasp OWASP Mutillidae II Web Pen-Test Practice Application
docker pull bkimminich/juice-shop OWASP Juice Shop