$ show swisskyrepo/PayloadsAllTheThings
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
The LLM identified 6 files worth highlighting for reuse:
A self-contained Python script that automates Local File Inclusion to Remote Code Execution using PHP wrappers (php://filter, data://). It demonstrates a non-obvious chain of techniques: base64 encoding a payload, writing it via php://filter, and executing it. Reusable as a template for LFI exploitation in CTFs or assessments.
A crafted JPEG file that exploits ImageMagick's delegate feature (ImageTragick) to exfiltrate local files via a pangu wrapper. Demonstrates a sophisticated attack vector using image metadata and external protocol handlers. Reusable as a template for testing image processing vulnerabilities.
A JPEG image with XSS payload embedded in all known EXIF metadata fields, designed to bypass content-type checks and trigger stored XSS when processed by vulnerable applications. Demonstrates a reusable pattern for injecting JavaScript into image metadata.
A comprehensive wordlist of UNION SELECT payloads for SQL injection fuzzing, covering various column counts, database-specific syntax, and comment styles. Designed for use with Burp Intruder or similar tools. Demonstrates systematic enumeration of injection vectors.
A Python script that generates obfuscated IP address representations (decimal, octal, hex, mixed) for SSRF bypass. Demonstrates a reusable utility for converting IP addresses to alternative formats that may bypass host-based filters.
A Ruby script that generates and verifies universal gadget chains for Ruby deserialization attacks. Demonstrates a reusable pattern for crafting malicious serialized objects using known gadget classes. Comparable to ysoserial for Java.