A list of useful payloads and bypass for Web Application Security and Pentest/CTF

A list of interesting payloads, tips and tricks for bug bounty hunters.

Git All the Payloads! A collection of web attack payloads.

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

A container repository for my public web hacks!

Undetectable Windows Payload Generation

A collection of tiny XSS Payloads that can be used in different contexts.

Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.

Use a Fake image.jpg to exploit targets (hide known file extensions)

Image Payload Creating/Injecting tools

🎯 SQL Injection Payload List

Writing custom backdoor payloads with C# - Defcon 27 Workshop

Open Redirect Payloads

Chimera is a (shiny and very hack-ish) PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

🎯 XML External Entity (XXE) Injection Payload List

BurpCrypto is a collection of burpsuite encryption plug-ins, support AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite).

Infosec Wordlists

🎯 Open Redirect Payload List

Xss Payload Generator ~ Xss Scanner ~ Xss Dork Finder

🎯 RFI/LFI Payload List

A simple framework for sending test payloads for known web CVEs.

🎯 Server Side Template Injection Payloads

Common Web Managers Fuzz Wordlists

Research on UDP/TCP amplification vectors, payloads and mitigations against their use in DDoS Attacks

XSS Payload without Anything.

NodeJS Red-Team Cheat Sheet

Fast exploitation based on metasploit.

Loki.Rat is a fork of the Ares RAT, it integrates new modules, like recording , lockscreen , and locate options. Loki.Rat is a Python Remote Access Tool.

🎯 Directory Payload List