PayloadsAllTheThings

Payloads All The Things A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques! You can also contribute with a 🍻 IRL, or using the sponsor button. An alternative display version is available at PayloadsAllTheThingsWeb. 📖...

Kautilya

Kautilya Kautilya is a toolkit which provides various payloads for a Human Interface Device which may help in breaking in a computer during penetration tests. By nikhilmitt List of Payloads Windows Gather Gather Information Hashdump and Exfiltrate Keylog and Exfiltrate Sniffer WLAN keys dump Get...

xxexploiter

XXExploiter It generates the XML payloads, and automatically starts a server to serve the needed DTD's or to do data exfiltration. Installation install node and npm if you don't have it yet npm install -g xxexploiter Building & Running from source This is a simple Node application written with...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

ronin

ronin Website Source Issues Documentation Discord | Mastodon Description Roninwebsite is a free and Open Source Ruby toolkit for security research and development. Ronin contains many different CLI commands and Ruby librariesronin-rb for a variety of security tasks, such as encoding/decoding data...

routersploit

RouterSploit - Exploitation Framework for Embedded Devices Community Join community on Embedded Exploitation Discord. Description The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aid penetration testing...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

SecLists

About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

horrors-log4shell

horrors-log4shell A micro lab playground? for CVE-2021-44228 log4j Can be used for executing payloads against multiple targets. Target-specific payloads are generated runtime. Adjustable configuration and bypasses. Installation Java-related requirements Development / Running example Gradle Maven ...

CVE-2020-0796-Scanner

SMBGhostscanner Simple scanner for CVE-2020-0796 - SMBv3. The scanner is for meant only for testing whether a server is vulnerable. It is not meant for research or development, hence the fixed payload. It checks for SMB dialect 3.1.1 and compression capability through a negotiate request...

gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads ... -- " !-- If number of iframes on the pa...

PAYLOAD-LISTS

Payloads List of payloads: SSTI-injection payloads XXE payloads XSS payloads Server Side Request ForgerySSRF SQL injection payloads Open Redirect payloads NoSQL injection payloads LDAP injection payloads File inclusion payloads Command injection payloads CRLF injection payloads Code injection...

Terminator

Terminator : Metasploit Payload Generator Payload List : Binaries Payloads 1 Android 2 Windows 3 Linux 4 Mac OS Scripting Payloads 1 Python 2 Perl 3 Bash Web Payloads 1 ASP 2 JSP 3 War Encrypters 1 APK Encrypter 2 Python Encrypter The author does not hold any responsibility for the bad use of thi...

pe_to_shellcode

petoshellcode Converts PE so that it can be then injected just like a normal shellcode. At the same time, the output file remains to be a valid PE. Supports both 32 and 64 bit PEs Authors:@hasherezade & @hh86 Objective The goal of this project is to provide a possibility to generate PE files that...

weaponised-XSS-payloads

Weaponised XSS Payloads XSS payloads designed to turn alert1 into P1. The Blog Post This repo was released alongside a blogpost titled "How to Upgrade Your XSS Bugs from Medium to Critical" https://medium.com/@hakluke/upgrade-xss-from-medium-to-critical-cb96597b6cc4 What is this? In this reposito...

Pi-Zero-2W-Bad-USB

Raspberry Pi Zero 2 W BadUSB HID Toolkit A programmable BadUSB / HID attack platform built on a Raspberry Pi Zero 2 W. The Pi enumerates as a USB composite device keyboard plus an optional read-only mass-storage volume and executes Ducky-Script-style payloads against the host it's plugged into...

AwesomeXSS

AwesomeXSS This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue. Awesome contents Challenges Reads & Presentations Tools Mind maps DOM XSS Payloads Polyglots Tags and event handlers Context breaking HTML context Attribute context...