Find a file
2019-04-21 13:00:16 +02:00
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
AWS Amazon Bucket S3 Fixed a typing mistake 2019-03-15 16:09:58 +02:00
Command Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CRLF Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CSRF Injection Linux Privesc - /etc/passwd writable 2019-04-07 23:40:36 +02:00
CSV Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
CVE Exploits SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
Directory Traversal Fix name's capitalization 2019-03-07 00:07:55 +01:00
File Inclusion Fix name's capitalization 2019-03-07 00:07:55 +01:00
GraphQL Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Deserialization Added CTF writeup in reference section 2019-03-20 12:19:25 +05:30
Insecure Direct Object References Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Management Interface Fix name's capitalization 2019-03-07 00:07:55 +01:00
Insecure Source Code Management GoGitDumper + MySQL summary rewrite 2019-04-15 00:49:56 +02:00
JSON Web Token SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LDAP Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
Methodology and Resources GoGitDumper + MySQL summary rewrite 2019-04-15 00:49:56 +02:00
NoSQL Injection add nosqli GET example 2019-04-21 13:00:16 +02:00
OAuth Fix name's capitalization 2019-03-07 00:07:55 +01:00
Open Redirect Fix name's capitalization 2019-03-07 00:07:55 +01:00
SAML Injection SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
Server Side Request Forgery MSQL UDF sys_exec + SSRF IP: 127.1 and 127.0.1 2019-04-20 20:23:40 +02:00
Server Side Template Injection sudo_inject + SSTI FreeMarker + Lin PrivEsc passwords 2019-04-14 21:01:14 +02:00
SQL Injection MSQL UDF sys_exec + SSRF IP: 127.1 and 127.0.1 2019-04-20 20:23:40 +02:00
Type Juggling Fix name's capitalization 2019-03-07 00:07:55 +01:00
Upload Insecure Files Update README.md 2019-04-08 22:49:50 +02:00
Web Cache Deception Fix name's capitalization 2019-03-07 00:07:55 +01:00
Web Sockets Fix name's capitalization 2019-03-07 00:07:55 +01:00
XPATH Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
XSS Injection Fixed link for google CSP bypass 2019-04-16 11:37:59 +01:00
XXE Injection Add XXE inside SVG 2019-03-24 03:27:12 +08:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
README.md Fix name's capitalization 2019-03-07 00:07:55 +01:00

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube