Find a file
2019-03-20 12:19:25 +05:30
_template_vuln Fix name's capitalization 2019-03-07 00:07:55 +01:00
AWS Amazon Bucket S3 Fixed a typing mistake 2019-03-15 16:09:58 +02:00
Command Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CRLF Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CSRF Injection Fix changed urls 2019-03-19 20:18:06 +08:00
CSV Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CVE Exploits Fix name's capitalization 2019-03-07 00:07:55 +01:00
Directory Traversal Fix name's capitalization 2019-03-07 00:07:55 +01:00
File Inclusion Fix name's capitalization 2019-03-07 00:07:55 +01:00
GraphQL Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Deserialization Added CTF writeup in reference section 2019-03-20 12:19:25 +05:30
Insecure Direct Object References Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Management Interface Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Source Code Management Bazaar - version control system 2019-03-15 23:27:14 +01:00
JSON Web Token JSON Web Token - jwt_tool example 2019-03-10 13:33:50 +01:00
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LDAP Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Methodology and Resources Linux Priv Esc - minor update 2019-03-18 23:19:36 +01:00
NoSQL Injection MarkDown typo 2019-03-18 23:06:22 +00:00
OAuth Fix name's capitalization 2019-03-07 00:07:55 +01:00
Open Redirect Fix name's capitalization 2019-03-07 00:07:55 +01:00
Server Side Request Forgery Fix changed urls 2019-03-19 20:18:06 +08:00
Server Side Template Injection Fix changed urls 2019-03-19 20:18:06 +08:00
SQL Injection Fix changed urls 2019-03-19 20:18:06 +08:00
Type Juggling Fix name's capitalization 2019-03-07 00:07:55 +01:00
Upload Insecure Files Fix name's capitalization 2019-03-07 00:07:55 +01:00
Web Cache Deception Fix name's capitalization 2019-03-07 00:07:55 +01:00
Web Sockets Fix name's capitalization 2019-03-07 00:07:55 +01:00
XPATH Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
XSS Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
XXE Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
README.md Fix name's capitalization 2019-03-07 00:07:55 +01:00

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube