Find a file
2021-07-22 16:55:03 +02:00
.github DSRM Admin 2021-01-08 23:41:50 +01:00
_template_vuln SAML exploitation + ASREP roasting + Kerbrute 2019-03-24 13:16:23 +01:00
Account Takeover Office Attacks 2021-02-21 20:17:57 +01:00
API Key Leaks PrintNightmare - Mimikatz 2021-07-05 21:57:14 +02:00
AWS Amazon Bucket S3 Fix AWS duplicated tool enumerate-iam 2020-12-18 22:52:21 +11:00
Command Injection Fix snippets 2021-06-14 19:36:23 +09:00
CORS Misconfiguration Fix typos 2020-12-13 04:34:10 +11:00
CRLF Injection CORS and CRLF README.md updated 2020-10-25 11:07:50 +01:00
CSRF Injection Added referer header validation check in CSRF 2021-06-23 10:05:14 +09:00
CSV Injection Update README.md 2021-03-16 19:17:01 -06:00
CVE Exploits Fix typos 2020-12-13 04:34:10 +11:00
Dependency Confusion Dependency Confusion + LDAP 2021-07-04 13:32:32 +02:00
Directory Traversal Update README.md 2020-10-09 18:17:06 +05:30
File Inclusion add RCE via Apache logs in log poisoning 2021-05-10 11:48:14 +02:00
GraphQL Injection Dependency Confusion + LDAP 2021-07-04 13:32:32 +02:00
HTTP Parameter Pollution Updated to include modules used for golang 2020-12-23 01:30:23 +08:00
Insecure Deserialization Dependency Confusion + LDAP 2021-07-04 13:32:32 +02:00
Insecure Direct Object References Command injection rewritten 2019-04-21 19:50:50 +02:00
Insecure Management Interface Add Springboot Actuator RCE 2020-10-28 12:05:12 -04:00
Insecure Source Code Management Fix ToC 2021-02-04 00:47:00 +11:00
JSON Web Token Updates JWT tool 2021-05-19 03:26:57 +02:00
Kubernetes Add Kubernetes Pentest Methodology Part 3 2021-01-20 09:07:23 +05:30
LaTeX Injection Fix name's capitalization 2019-03-07 00:07:55 +01:00
LDAP Injection Dependency Confusion + LDAP 2021-07-04 13:32:32 +02:00
Methodology and Resources Active Directory update 2021-07-12 20:45:16 +02:00
NoSQL Injection add NoSQLi payload 2021-05-29 13:04:13 +03:00
OAuth Masscan + AD password in description + ZSH revshell bugfix + Mimikatz lsass.dmp 2019-05-12 21:34:09 +02:00
Open Redirect Update README.md 2020-11-26 16:43:10 +01:00
Race Condition Race Condition - First Draft 2020-01-26 12:43:59 +01:00
Request Smuggling Add PortSwigger http-desync reborn article 2021-01-17 04:23:38 +11:00
SAML Injection XSW 4 Fix #205 2020-05-12 14:27:25 +02:00
Server Side Request Forgery Add AWS SSRF Bypasses 2021-06-16 23:42:50 +08:00
Server Side Template Injection Update README.md 2021-07-16 11:24:16 -04:00
SQL Injection Relay + MSSQL Read File 2021-03-25 18:25:02 +01:00
Tabnabbing Fix typos 2020-12-13 04:34:10 +11:00
Type Juggling AMSI + Trust 2020-12-08 14:31:01 +01:00
Upload Insecure Files File Upload Update 2021-07-14 17:10:04 +02:00
Web Cache Deception Fix(Docs): Correcting typos on the repo 2020-10-17 22:52:35 +02:00
Web Sockets Added: Cross-Site WebSocket Hijacking (CSWSH) 2020-04-11 16:24:32 +02:00
XPATH Injection Bind shell cheatsheet (Fix #194) 2020-05-24 14:09:46 +02:00
XSLT Injection AD mitigations 2019-12-26 12:09:23 +01:00
XSS Injection Update README.md 2021-07-22 16:55:03 +02:00
XXE Injection improved XXE SVG payloads to be valid XMLs 2021-04-24 14:45:45 +02:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
BOOKS.md README rewrite : BOOKS and YOUTUBE 2019-05-12 22:43:42 +02:00
CONTRIBUTING.md Upload Methodology 2020-09-27 11:16:50 +02:00
LICENSE Create License 2019-05-25 16:27:35 +02:00
README.md Update README.md 2020-08-22 23:45:49 +02:00
TWITTER.md Update TWITTER.md 2020-11-03 12:57:33 +01:00
YOUTUBE.md Update YOUTUBE.md 2020-10-08 10:01:45 +02:00

Payloads All The Things Tweet

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I ❤️ pull requests :)

You can also contribute with a 🍻 IRL, or using the sponsor button.

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it, including several payloads
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

You want more ? Check the Books and Youtube videos selections.