Find a file
Swissky ef65f36902
Merge pull request #48 from dee-see/patch-1
Fix anchors in README.md
2019-03-06 16:16:08 +01:00
_template_vuln CSRF - First draft 2018-12-24 14:14:51 +01:00
AWS Amazon Bucket S3 AWS S3 and Open redirect rewritten 2018-12-29 13:05:29 +01:00
Command injection Polyglot Command Injection + XSS HTML file 2019-02-28 00:36:53 +01:00
CRLF injection Adding references sectio 2018-12-24 15:02:50 +01:00
CSRF injection .git/index file parsing + fix CSRF payload typo 2019-02-07 23:33:47 +01:00
CSV injection SQL wildcard '_' + CSV injection reverse shell 2018-12-26 01:02:17 +01:00
CVE Exploits Use print() function in both Python 2 and Python 3 2019-02-17 23:47:18 +01:00
Directory traversal Directory traversal / File inclusion rewritten 2018-12-28 00:27:15 +01:00
File inclusion Use print() function in both Python 2 and Python 3 2019-02-17 23:47:18 +01:00
GraphQL Injection Added GraphQL injection notes 2019-03-06 14:18:54 +02:00
Insecure deserialization Meterpreter generate + LaTeK XSS + Ruby Yaml 2019-03-03 16:31:17 +01:00
Insecure direct object references References added based on @ngalongc bug-bounty-references 2018-12-25 16:10:15 +01:00
Insecure management interface Adding references sectio 2018-12-24 15:02:50 +01:00
Insecure source code management .git/index file parsing + fix CSRF payload typo 2019-02-07 23:33:47 +01:00
JSON Web Token JWT - Payload detail 2019-02-11 14:04:38 +01:00
LaTeX injection Meterpreter generate + LaTeK XSS + Ruby Yaml 2019-03-03 16:31:17 +01:00
LDAP injection Adding references sectio 2018-12-24 15:02:50 +01:00
Methodology and Resources Typo fix 2019-03-04 19:40:34 +01:00
NoSQL injection Adding references sectio 2018-12-24 15:02:50 +01:00
OAuth References added based on @ngalongc bug-bounty-references 2018-12-25 16:10:15 +01:00
Open redirect AWS S3 and Open redirect rewritten 2018-12-29 13:05:29 +01:00
Server Side Request Forgery Fix anchors in README.md 2019-03-06 09:22:05 -05:00
Server Side Template Injection Bugfix - Errors in stashed changes 2019-01-28 20:27:45 +01:00
SQL injection SQL injection - MySQL version for error based 2019-02-17 22:56:09 +01:00
Tar commands execution Adding references sectio 2018-12-24 15:02:50 +01:00
Type juggling Bugfix - Errors in stashed changes 2019-01-28 20:27:45 +01:00
Upload insecure files Meterpreter generate + LaTeK XSS + Ruby Yaml 2019-03-03 16:31:17 +01:00
Web cache deception Web cache deception resources update 2019-03-01 17:49:19 +01:00
XPATH injection Adding references sectio 2018-12-24 15:02:50 +01:00
XSS injection Typo fix 2019-03-04 19:40:34 +01:00
XXE injection References added based on @ngalongc bug-bounty-references 2018-12-25 16:10:15 +01:00
.gitignore Shell IPv6 + Sandbox credential 2019-01-07 18:15:45 +01:00
README.md Fixed Hack The Box-Link 2019-02-18 13:08:45 +01:00

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

  • README.md - vulnerability description and how to exploit it
  • Intruder - a set of files to give to Burp Intruder
  • Images - pictures for the README.md
  • Files - some files referenced in the README.md

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube