PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository powers https://cheats.rs/, a single-page interactive reference for the Rust programming language. Built with the Zola static site generator, it combines a massive Markdown content file (`content/_index.md`) with custom HTML, SCSS, and JavaScript to deliver a highly interactive cheat sheet. Core features include tabbed panels, memory-layout visualizations (using custom HTML tags like `<datum>` and `<memory-row>`), a day/night mode, an inline code playground, and an X-Ray feedback system that collects per-section sentiment via an external API. The build pipeline is orchestrated by a Gitea Actions workflow that runs Zola, post-processes with PostHTML (inlining assets), generates a PDF with Playwright, and deploys to S3 with Cloudflare cache purging. The codebase is well-structured for its domain, with clean separation of styling (SCSS), client-side logic (vanilla JS), and build scripts. It is actively maintained and demonstrates strong craftsmanship in creating a rich, offline-capable documentation experience, though its single-file content source is fragile and the heavy external dependency on api.cheats.rs poses a risk if the API goes down.
This repository provides an xontrib (plugin) for the Xonsh shell that adds a `cheatsheet` command to open the project's README.md in a web browser. The README.md serves as a comprehensive cheat sheet for the Xonsh shell, covering installation, basics, and advanced topics. The repository also includes an example script demonstrating how to make web requests, process output, and use colored output in Xonsh.
This repository is a documentation-only collection of Apple Xcode user defaults (`defaults write` commands) and related shell one-liners. It contains no application code, libraries, tests, or executable entry points; the only substantive content is a large README that catalogs tweaks for Xcode's build system, Swift compiler parallelism, indexing, logging, simulator behavior, derived data cleanup, and related developer-experience settings. The README is organized by topic and cites sources for many of the tips, making it a curated cheat sheet rather than a software product. Because there is no codebase, there is no runtime architecture, API, or data flow. The repository's practical value is as a reference for iOS/macOS developers who want to tune Xcode behavior by copying commands into Terminal. The included GitHub Actions workflow only checks markdown links, and the renovate configuration manages dependency updates for a repository that has no actual dependencies. The CC BY-ND 4.0 license permits sharing with attribution but prohibits derivative works, which may limit how freely the curated content can be reused in other projects or tools.
This repository is a curated cheat sheet for web application security testing, penetration testing, and bug bounty hunting. It aggregates a vast collection of tools, commands, URLs, and references organized by phases: discovering, enumerating, scanning, monitoring, attacking, manual exploitation, and AI-related security. The repo contains no application code; it is a markdown document only. It is a valuable reference for security professionals but lacks any executable software components or data pipelines. The information is comprehensive and well-structured, but the repository itself is not a functional system and does not demonstrate software architecture or engineering craftsmanship beyond content curation.
This repository contains a collection of example SQLMap command lines for bypassing Web Application Firewalls (WAF) during SQL injection penetration testing. It is essentially a cheat sheet or reference guide, not a software application. The content is provided in plain text files with various tamper script combinations and techniques. The repository has no actual code, scripts, or executable components; it solely consists of documentation and example usage. While the commands may be useful for security professionals, the repository itself is not a functional tool and has seen no active development since its creation around 2021.
This repository is a static README-based reference list that curates 20 links to external blog posts about credential dumping techniques for penetration testing. There is no actual source code, scripts, executables, or any functional software. The entire content is a markdown table with topics and links to the Ignitetechnologies blog. It functions as a curated cheat sheet or index, not as a tool, library, or pipeline. No architecture, entry points, dependencies, or data flows exist. The repository has no reusable components and exhibits zero code craftsmanship—it is purely documentation. Despite having many stars and forks, it offers no software value and is effectively a non-functional repository from a software engineering perspective.