PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
NeoPass is a browser extension designed to assist students during online exams by bypassing restrictions (tab switching, pasting, screenshare) and providing AI-powered answer assistance. It employs a Manifest V3 architecture with a background service worker, content scripts injected into exam platforms, and a popup UI for configuration. Key features include automatic code typing, MCQ solving, a stealth-mode chatbot, and anti-detection measures to avoid identification by exam portals. The extension supports both a free mode (requiring user-configured API keys) and a Pro mode via a managed backend service.
Ladder is a self-hosted HTTP web proxy written in Go, designed for testing and analyzing paywall implementations, content delivery, and access control behavior on modern websites. It intercepts client requests, applies domain-specific YAML rulesets to modify request headers, URLs, and response content (e.g., removing CORS/CSP headers, injecting scripts, rewriting relative URLs), then fetches the target site and returns the modified response. The proxy exposes a web form, a JSON API, a raw HTML endpoint, and a ruleset endpoint, and supports optional FlareSolverr integration for bypassing Cloudflare challenges. It is deployable as a binary, Docker container, or Helm chart, and is configured via environment variables and CLI flags. The architecture is a single Go binary using the Fiber web framework. The main entry point (cmd/main.go) sets up routing, basic auth, and middleware. Core logic lives in handlers/proxy.go, which handles URL extraction, ruleset application, HTTP fetching, HTML rewriting, and FlareSolverr integration. The pkg/ruleset package provides a clean, reusable ruleset loader supporting local files, directories, remote URLs, and gzip-compressed YAML. The codebase is generally well-structured with some global state and a few misnamed test files (e.g., proxy.test.go instead of proxy_test.go) that are not executed by Go's test runner. Despite these minor issues, the project is actively maintained, uses current dependencies, and demonstrates solid engineering practices for a focused tool.