A list of interesting payloads, tips and tricks for bug bounty hunters.

Git All the Payloads! A collection of web attack payloads.

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

A container repository for my public web hacks!

🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

Undetectable Windows Payload Generation

A collection of tiny XSS Payloads that can be used in different contexts.

Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.

Use a Fake image.jpg to exploit targets (hide known file extensions)

Image Payload Creating/Injecting tools

Writing custom backdoor payloads with C# - Defcon 27 Workshop

🎯 SQL Injection Payload List

Open Redirect Payloads

🎯 XML External Entity (XXE) Injection Payload List

BurpCrypto is a collection of burpsuite encryption plug-ins, support AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite).

Infosec Wordlists

🎯 Open Redirect Payload List

🎯 RFI/LFI Payload List

Xss Payload Generator ~ Xss Scanner ~ Xss Dork Finder

A simple framework for sending test payloads for known web CVEs.

Common Web Managers Fuzz Wordlists

Research on UDP/TCP amplification vectors, payloads and mitigations against their use in DDoS Attacks

XSS Payload without Anything.

NodeJS Red-Team Cheat Sheet

Loki.Rat is a fork of the Ares RAT, it integrates new modules, like recording , lockscreen , and locate options. Loki.Rat is a Python Remote Access Tool.

Fast exploitation based on metasploit.

🎯 Server Side Template Injection Payloads

本脚本旨在生成各类畸形URL链接，进行探测使用的payload，尝试绕过服务端ssrf限制。

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

🎯 Directory Payload List