Find a file
2018-11-17 14:41:40 +01:00
AWS Amazon Bucket S3 Deserialization - merging Java, PHP 2018-11-13 23:25:18 +01:00
CRLF injection Markdown formatting update 2018-08-12 23:30:22 +02:00
CSV injection Markdown formatting - Part 2 2018-08-13 12:01:13 +02:00
CVE Exploits More CVE - RCE : Jenkins, JBoss, WebLogic, WebSphere 2018-11-15 23:13:08 +01:00
File Inclusion - Path Traversal LDAP fix typo + LDAP attributes + LFI filter chaining 2018-11-02 13:50:56 +01:00
Insecure deserialization Files JPEG -> JPG + Tag v2 2018-11-17 14:40:12 +01:00
Insecure source code management Deserialization - merging Java, PHP 2018-11-13 23:25:18 +01:00
JSON Web Token JWT JSON Web Token + SSI files 2018-10-29 22:22:10 +01:00
LaTeX injection Markdown formatting update 2018-08-12 23:30:22 +02:00
LDAP injection LDAP fix typo + LDAP attributes + LFI filter chaining 2018-11-02 13:50:56 +01:00
Methodology and Resources Subdomain enumeration - New Aquatone (Go) 2018-11-05 13:45:52 +01:00
NoSQL injection Markdown formatting update 2018-08-12 23:30:22 +02:00
OAuth Markdown formatting update 2018-08-12 23:30:22 +02:00
Open redirect Subdomain enumeration - New Aquatone (Go) 2018-11-05 13:45:52 +01:00
PHP juggling type Cassandra SQL + XSS MD + PHP Type Juggling 2018-09-10 20:40:43 +02:00
Remote commands execution LDAP fix typo + LDAP attributes + LFI filter chaining 2018-11-02 13:50:56 +01:00
Server Side Template injections Web Cache Deception details from SI9INT's blogpost 2018-09-23 20:07:19 +02:00
SQL injection SQLmap --crawl, --form 2018-10-04 19:59:11 +02:00
SSRF injection More CVE - RCE : Jenkins, JBoss, WebLogic, WebSphere 2018-11-15 23:13:08 +01:00
Tar commands execution Markdown formatting update 2018-08-12 23:30:22 +02:00
Traversal directory Markdown formatting update 2018-08-12 23:30:22 +02:00
Upload insecure files Files JPEG -> JPG + Tag v2 2018-11-17 14:40:12 +01:00
Web cache deception WebCache param miner file + Reverse shell Python TTY 2018-10-08 13:49:50 +02:00
XPATH injection Markdown formatting update 2018-08-12 23:30:22 +02:00
XSS injection add new attack patterns from Daniel miessler 2018-11-16 14:45:51 +03:00
XXE injection Markdown formatting update 2018-08-12 23:30:22 +02:00
.gitignore Markdown formatting - Part 3 2018-08-13 13:07:37 +02:00
README.md Script Docker RCE 2018-10-18 17:32:01 +02:00

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains:

  • README.md - vulnerability description and how to exploit it
  • Intruders - a set of files to give to Burp Intruder
  • Some exploits

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube

Docker

Command Link
docker pull remnux/metasploit docker-metasploit
docker pull paoloo/sqlmap docker-sqlmap
docker pull kalilinux/kali-linux-docker official Kali Linux
docker pull owasp/zap2docker-stable official OWASP ZAP
docker pull wpscanteam/wpscan official WPScan
docker pull infoslack/dvwa Damn Vulnerable Web Application (DVWA)
docker run --name dvna -p 9090:9090 -d appsecco/dvna:sqlite Damn Vulnerable NodeJS Application
docker pull danmx/docker-owasp-webgoat OWASP WebGoat Project docker image
docker pull opendns/security-ninjas Security Ninjas
docker pull ismisepaul/securityshepherd OWASP Security Shepherd
docker-compose build && docker-compose up OWASP NodeGoat
docker pull citizenstig/nowasp OWASP Mutillidae II Web Pen-Test Practice Application
docker pull bkimminich/juice-shop OWASP Juice Shop