Skip to content

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Notifications You must be signed in to change notification settings

BugHunterID/PayloadsAllTheThings

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests :)

You can also contribute with a beer IRL or with buymeacoffee.com

Coffee

Every section contains:

  • README.md - vulnerability description and how to exploit it
  • Intruders - a set of files to give to Burp Intruder
  • Some exploits

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find "targets" to improve your skills.

Book's list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources

Blogs/Websites

Youtube

Docker

Command Link
docker pull remnux/metasploit docker-metasploit
docker pull paoloo/sqlmap docker-sqlmap
docker pull kalilinux/kali-linux-docker official Kali Linux
docker pull owasp/zap2docker-stable official OWASP ZAP
docker pull wpscanteam/wpscan official WPScan
docker pull infoslack/dvwa Damn Vulnerable Web Application (DVWA)
docker run --name dvna -p 9090:9090 -d appsecco/dvna:sqlite Damn Vulnerable NodeJS Application
docker pull danmx/docker-owasp-webgoat OWASP WebGoat Project docker image
docker pull opendns/security-ninjas Security Ninjas
docker pull ismisepaul/securityshepherd OWASP Security Shepherd
docker-compose build && docker-compose up OWASP NodeGoat
docker pull citizenstig/nowasp OWASP Mutillidae II Web Pen-Test Practice Application
docker pull bkimminich/juice-shop OWASP Juice Shop

About

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Python 62.8%
  • HTML 32.8%
  • Ruby 3.6%
  • PHP 0.6%
  • Jupyter Notebook 0.2%
  • Shell 0.0%