A list of useful payloads and bypass for Web Application Security and Pentest/CTF
 
 
 
 
 
 
Go to file
Swissky eefa2afab1
Merge pull request #150 from austinsonger/master
Added CVE
2020-01-23 10:10:23 +01:00
.github Update FUNDING.yml with buymeacoffee 2019-09-13 17:49:47 +02:00
API Key Leaks Blacklist3r and Machine Key 2020-01-02 23:33:04 +01:00
AWS Amazon Bucket S3 CORS Misconfiguration 2019-08-18 12:08:51 +02:00
CORS Misconfiguration CORS Misconfiguration 2019-08-18 12:08:51 +02:00
CRLF Injection Added Summary in CRLF 2019-12-17 22:12:35 +05:30
CSRF Injection Updated Summary and Fixed Broken Links in CSRF 2019-12-17 22:21:53 +05:30
CSV Injection HQL Injection + references update 2019-06-16 23:45:52 +02:00
CVE Exploits Added link to exploit creator 2020-01-22 17:49:47 +00:00
Command Injection Add escaped double or single quote cases 2020-01-17 10:41:12 +09:00
Directory Traversal AD mitigations 2019-12-26 12:09:23 +01:00
File Inclusion Linux AD - Keyring, Keytab, CCACHE 2019-11-25 23:12:06 +01:00
GraphQL Injection Privilege impersonation and GraphQL SQLi 2019-12-11 16:59:14 +01:00
Insecure Deserialization Update Java.md 2019-10-30 11:36:09 +08:00
Insecure Direct Object References Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Management Interface Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Source Code Management ImageMagik Ghost Script + Typo git summary 2019-06-26 00:07:06 +02:00
JSON Web Token SharpPersist - Windows Persistence 2019-09-13 17:38:23 +02:00
Kubernetes Kubernetes - Privileged Service Account Token 2019-12-20 11:33:25 +01:00
LDAP Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Methodology and Resources BloodHound ZIP + Zero Width space tip 2020-01-19 22:46:45 +01:00
NoSQL Injection Added an alternate possible Found condition to POST 2019-10-29 21:11:56 +02:00
OAuth Masscan + AD password in description + ZSH revshell bugfix + Mimikatz lsass.dmp 2019-05-12 21:34:09 +02:00
Open Redirect Added new payloads 2019-11-14 18:26:35 +08:00
SAML Injection GraphQL + LXD/etc/passwd PrivEsc + Win firewall 2019-06-09 13:46:40 +02:00
SQL Injection Merge pull request #116 from nizam0906/master 2019-10-29 17:11:28 +01:00
Server Side Request Forgery SSRF exploiting WSGI 2020-01-05 22:11:28 +01:00
Server Side Template Injection Abusing Active Directory ACLs/ACEs 2019-12-30 14:22:10 +01:00
Type Juggling Type Juggling - Another SHA 256 2019-07-14 14:23:20 +02:00
Upload Insecure Files IIS asp shell with .asa, .cer, .xamlx 2019-11-16 14:53:42 +01:00
Web Cache Deception Fix dead youtube link 2019-10-02 20:09:41 -04:00
Web Sockets CORS Misconfiguration 2019-08-18 12:08:51 +02:00
XPATH Injection XPATH: add tools 2019-10-26 16:43:36 +02:00
XSLT Injection AD mitigations 2019-12-26 12:09:23 +01:00
XSS Injection Create 0xcela_event_handlers.txt 2020-01-15 17:00:26 +01:00
XXE Injection Merge pull request #128 from noraj/patch-1 2019-12-02 22:38:08 +01:00
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
BOOKS.md README rewrite : BOOKS and YOUTUBE 2019-05-12 22:43:42 +02:00
LICENSE Create License 2019-05-25 16:27:35 +02:00
README.md XSS PostMessage 2019-08-03 23:22:14 +02:00
YOUTUBE.md Fix YOUTUBE and BOOKS links 2019-05-12 22:59:22 +02:00

README.md

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I ❤️ pull requests :)

You can also contribute with a 🍻 IRL

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

You want more ? Check the Books and Youtube videos selections.