Payloads Open Source Projects

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

Fast web fuzzer written in Go

An open-source post-exploitation framework for students, researchers and developers.

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

hekate - A GUI based Nintendo Switch Bootloader

The all-in-one browser extension for offensive security professionals 🛠

All about bug bounty (bypasses, payloads, and etc)

A list of interesting payloads, tips and tricks for bug bounty hunters.

The Official USB Rubber Ducky Payload Repository

🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

Official Documentation for the Binance Spot APIs and Streams

🎯 SQL Injection Payload List

Git All the Payloads! A collection of web attack payloads.

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

Malware Configuration And Payload Extraction

:cat2: webrtc screensharing electron app for mac os (Alpha)

The Official Bash Bunny Payload Repository

Read-only mirror of https://review.coreboot.org/coreboot.git. Synced every hour. We don't handle Pull Requests.

This cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and completely with "BurpSuite".

Spot SDK repo

netshell features all in version 2 powershell

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me

Active Directory and Internal Pentest Cheatsheets

Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.

A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.

Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3

Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。

A container repository for my public web hacks!

Unified repository for different Metasploit Framework payloads

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

Java Apple Push Notification Service Provider

Burpsuite Extension to bypass 403 restricted directory

BurpCrypto is a collection of burpsuite encryption plug-ins, support AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite). 支持多种加密算法或直接执行JS代码的用于爆破前端加密的BurpSuite插件

RubberDucky like payloads for DigiSpark Attiny85

Undetectable Windows Payload Generation

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)

Upload, save and run keystroke injection payloads with an ESP8266 + ATMEGA32U4

jsonapi.org style payload serializer and deserializer

XSS payloads designed to turn alert(1) into P1

A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!

MSFvenom Payload Creator (MSFPC)

Payload launcher and serial number checker for Nintendo Switch

A DNS rebinding attack framework.

Image Payload Creating/Injecting tools

A generator of weird files (binary polyglots, near polyglots, polymocks...)

Boot9/Boot11 code execution.

Writing custom backdoor payloads with C# - Defcon 27 Workshop

A Ruby framework designed to aid in the penetration testing of WordPress systems.

Sleepy Puppy XSS Payload Management Framework

Performance testing of serialization and deserialization of Java JSON libraries

An Python Script For Generating Payloads that Bypasses All Antivirus so far .

A collection of various GitHub gists for hackers, pentesters and security researchers

Use a Fake image.jpg to exploit targets (hide known file extensions)

Payload Arsenal for Pentration Tester and Bug Bounty Hunters

Infosec Wordlists and more.

Hardware/IOT Pentesting Wiki