Browse / Payloads

Payloads and techniques

What to send for each kind of bug, including variants that get past filters. 1,123 passages across 64 topics. For how researchers got past protections in real reports, see the bypass library.

• API Key Leaks 16
• Account Takeover 28
• Brute Force Rate Limit 8
• Business Logic Errors 11
• CORS Misconfiguration 17
• CRLF Injection 6
• CSS Injection 10
• CSV Injection 3
• CVE Exploits 16
• Clickjacking 13
• Client Side Path Traversal 4
• Command Injection 27
• Cross-Site Request Forgery 11
• DNS Rebinding 7
• DOM Clobbering 4
• Denial of Service 5
• Dependency Confusion 4
• Directory Traversal 17
• Encoding Transformations 5
• External Variable Modification 6
• File Inclusion 41
• Google Web Toolkit 3
• GraphQL Injection 20
• HTTP Parameter Pollution 5
• Headless Browser 8
• Hidden Parameters 4
• Insecure Deserialization 45
• Insecure Direct Object References 9
• Insecure Management Interface 2
• Insecure Randomness 13
• Insecure Source Code Management 24
• JSON Web Token 19
• Java RMI 8
• LDAP Injection 8
• LaTeX Injection 5
• Mass Assignment 2
• Methodology and Resources 36
• NoSQL Injection 11
• OAuth Misconfiguration 7
• ORM Leak 12
• Open Redirect 7
• Prompt Injection 10
• Prototype Pollution 10
• Race Condition 8
• Regular Expression 4
• Request Smuggling 8
• Reverse Proxy Misconfigurations 9
• SAML Injection 9
• SQL Injection 185
• Server Side Include Injection 4
• Server Side Request Forgery 54
• Server Side Template Injection 118
• Tabnabbing 5
• Type Juggling 6
• Upload Insecure Files 21
• Virtual Hosts 4
• Web Cache Deception 8
• Web Sockets 7
• XPATH Injection 5
• XS-Leak 8
• XSLT Injection 9
• XSS Injection 93
• XXE Injection 28
• Zip Slip 3

This section is PayloadsAllTheThings by Swissky and contributors, used under the MIT licence. Use it only on systems you are authorised to test.