A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I :heart: pull requests :)

You can also contribute with a :beers: IRL

Every section contains the following files, you can use the _template_vuln folder to create a new chapter:

• README.md - vulnerability description and how to exploit it
• Intruder - a set of files to give to Burp Intruder
• Images - pictures for the README.md
• Files - some files referenced in the README.md

You might also like the Methodology and Resources folder :

• Methodology and Resources

  • Active Directory Attack.md
  • Linux - Persistence.md
  • Linux - Privilege Escalation.md
  • Metasploit - Cheatsheet.md
  • Methodology and enumeration.md
  • Network Pivoting Techniques.md
  • Network Discovery.md
  • Reverse Shell Cheatsheet.md
  • Subdomains Enumeration.md
  • Windows - Download and Execute.md
  • Windows - Mimikatz.md
  • Windows - Persistence.md
  • Windows - Post Exploitation Koadic.md
  • Windows - Privilege Escalation.md
  • Windows - Using credentials.md

• CVE Exploits

  • Apache Struts 2 CVE-2013-2251 CVE-2017-5638 CVE-2018-11776_.py
  • Apache Struts 2 CVE-2017-9805.py
  • Apache Struts 2 CVE-2018-11776.py
  • Docker API RCE.py
  • Drupalgeddon2 CVE-2018-7600.rb
  • Heartbleed CVE-2014-0160.py
  • JBoss CVE-2015-7501.py
  • Jenkins CVE-2015-8103.py
  • Jenkins CVE-2016-0792.py
  • Rails CVE-2019-5420.rb
  • Shellshock CVE-2014-6271.py
  • Tomcat CVE-2017-12617.py
  • WebLogic CVE-2016-3510.py
  • WebLogic CVE-2017-10271.py
  • WebLogic CVE-2018-2894.py
  • WebSphere CVE-2015-7450.py

You want more ? Check the Books and Youtube videos selections.