Find a file
2019-10-16 23:35:04 +02:00
.github Update FUNDING.yml with buymeacoffee 2019-09-13 17:49:47 +02:00
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
API Key Leaks API Key Leaks - Twitter/Twilio/Gitlab 2019-09-22 17:06:44 +02:00
AWS Amazon Bucket S3 CORS Misconfiguration 2019-08-18 12:08:51 +02:00
Command Injection Remove http:// prefix for DNS queries 2019-05-07 18:14:49 +02:00
CORS Misconfiguration CORS Misconfiguration 2019-08-18 12:08:51 +02:00
CRLF Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CSRF Injection HQL Injection + references update 2019-06-16 23:45:52 +02:00
CSV Injection HQL Injection + references update 2019-06-16 23:45:52 +02:00
CVE Exploits RCE vBulletin + findomain 2019-09-26 20:41:01 +02:00
Directory Traversal Pspy + Silver Ticket + MSSQL connect 2019-08-18 22:24:48 +02:00
File Inclusion Pspy + Silver Ticket + MSSQL connect 2019-08-18 22:24:48 +02:00
GraphQL Injection PrivEsc - sudoers + Upload PHP 2019-09-02 12:36:40 +02:00
Insecure Deserialization Add .NET references 2019-10-02 20:23:37 -04:00
Insecure Direct Object References Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Management Interface Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Source Code Management ImageMagik Ghost Script + Typo git summary 2019-06-26 00:07:06 +02:00
JSON Web Token SharpPersist - Windows Persistence 2019-09-13 17:38:23 +02:00
Kubernetes Update readme.md 2019-10-16 14:45:42 +02:00
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LDAP Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Methodology and Resources Update Active Directory Attack.md 2019-10-15 23:18:07 +07:00
NoSQL Injection little changes 2019-10-09 16:53:34 +02:00
OAuth Masscan + AD password in description + ZSH revshell bugfix + Mimikatz lsass.dmp 2019-05-12 21:34:09 +02:00
Open Redirect Add Host/Split Unicode Normalization 2019-08-30 08:57:22 +01:00
SAML Injection GraphQL + LXD/etc/passwd PrivEsc + Win firewall 2019-06-09 13:46:40 +02:00
Server Side Request Forgery SSRF for ECS 2019-10-12 13:30:52 +02:00
Server Side Template Injection Pebble - Server Side Template Injection 2019-09-17 15:43:13 +02:00
SQL Injection Juicy Potato + XXE update 2019-09-08 19:44:51 +02:00
Type Juggling Type Juggling - Another SHA 256 2019-07-14 14:23:20 +02:00
Upload Insecure Files PrivEsc - sudoers + Upload PHP 2019-09-02 12:36:40 +02:00
Web Cache Deception Fix dead youtube link 2019-10-02 20:09:41 -04:00
Web Sockets CORS Misconfiguration 2019-08-18 12:08:51 +02:00
XPATH Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
XSS Injection Add Angular automatic sanitization 2019-10-02 21:24:53 -04:00
XXE Injection Add local DTD section to the XXE Injection page 2019-10-01 18:22:42 -04:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
BOOKS.md README rewrite : BOOKS and YOUTUBE 2019-05-12 22:43:42 +02:00
LICENSE Create License 2019-05-25 16:27:35 +02:00
README.md XSS PostMessage 2019-08-03 23:22:14 +02:00
YOUTUBE.md Fix YOUTUBE and BOOKS links 2019-05-12 22:59:22 +02:00

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I ❤️ pull requests :)

You can also contribute with a 🍻 IRL

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

You want more ? Check the Books and Youtube videos selections.