페이로드

모든 페이로드를 Git으로! 웹 공격 페이로드 모음입니다. 풀 리퀘스트는 언제나 환영합니다!

사용법

외부 페이로드를 다운로드하고 압축된 페이로드 파일을 압축 해제하려면 ./get.sh를 실행하세요.

페이로드 출처

• fuzzdb - https://github.com/fuzzdb-project/fuzzdb
• SecLists - https://github.com/danielmiessler/SecLists
• xsuperbug - https://github.com/xsuperbug/payloads
• NickSanzotta - https://github.com/NickSanzotta/BurpIntruder
• 7ioSecurity - https://github.com/7ioSecurity/XSS-Payloads
• shadsidd - https://github.com/shadsidd
• shikari1337 - https://www.shikari1337.com/list-of-xss-payloads-for-cross-site-scripting/
• xmendez - https://github.com/xmendez/wfuzz
• minimaxir - https://github.com/minimaxir/big-list-of-naughty-strings
• xsscx - https://github.com/xsscx/Commodity-Injection-Signatures
• TheRook - https://github.com/TheRook/subbrute
• danielmiessler - https://github.com/danielmiessler/RobotsDisallowed
• FireFart - https://github.com/FireFart/HashCollision-DOS-POC
• HybrisDisaster - https://github.com/HybrisDisaster/aspHashDoS
• swisskyrepo - https://github.com/swisskyrepo/PayloadsAllTheThings
• 1N3 - https://github.com/1N3/IntruderPayloads
• cujanovic - https://github.com/cujanovic/Open-Redirect-Payloads
• cujanovic - https://github.com/cujanovic/Content-Bruteforcing-Wordlist
• cujanovic - https://github.com/cujanovic/subdomain-bruteforce-list
• cujanovic - https://github.com/cujanovic/CRLF-Injection-Payloads
• cujanovic - https://github.com/cujanovic/Virtual-host-wordlist
• cujanovic - https://github.com/cujanovic/dirsearch-wordlist
• lavalamp- - https://github.com/lavalamp-/password-lists
• arnaudsoullie - https://github.com/arnaudsoullie/ics-default-passwords
• scadastrangelove - https://github.com/scadastrangelove/SCADAPASS
• jeanphorn - https://github.com/jeanphorn/wordlist
• j3ers3 - https://github.com/j3ers3/PassList
• nyxxxie - https://github.com/nyxxxie/awesome-default-passwords
• foospidy - https://github.com/foospidy/web-cve-tests
• terjanq - https://github.com/terjanq/Tiny-XSS-Payloads

OWASP

• dirbuster - https://www.owasp.org/index.php/DirBuster
• fuzzing_code_database - https://www.owasp.org/index.php/Category:OWASP_Fuzzing_Code_Database
• JBroFuzz - https://www.owasp.org/index.php/JBroFuzz

기타

• xss/ismailtasdelen.txt - https://github.com/ismailtasdelen/xss-payload-list
• xss/jsf__k.txt - http://www.jsfuck.com/
• xss/kirankarnad.txt - https://www.linkedin.com/pulse/20140812222156-79939846-xss-vectors-you-may-need-as-a-pen-tester
• xss/packetstorm.txt - https://packetstormsecurity.com/files/112152/Cross-Site-Scripting-Payloads.html
• xss/smeegessec.com.txt - http://www.smeegesec.com/2012/06/collection-of-cross-site-scripting-xss.html
• xss/d3adend.org.txt - http://d3adend.org/xss/ghettoBypass
• xss/soaj1664ashar.txt - http://pastebin.com/u6FY1xDA
• xss/billsempf.txt - https://www.sempf.net/post/Six-hundred-and-sixty-six-XSS-vectors-suitable-for-attacking-an-API.aspx (http://pastebin.com/48WdZR6L)
• xss/787373.txt - https://84692bb0df6f30fc0687-25dde2f20b8e8c1bda75aeb96f737eae.ssl.cf1.rackcdn.com/--xss.html
• xss/bhandarkar.txt - http://hackingforsecurity.blogspot.com/2013/11/xss-cheat-sheet-huge-list.html
• xss/xssdb.txt - http://xssdb.net/xssdb.txt
• xss/0xsobky.txt - https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot
• xss/secgeek.txt - https://www.secgeek.net/solutions-for-xss-waf-challenge/
• xss/reddit_xss_get.txt - https://www.reddit.com/r/xss 에서 가져온 모든 XSS GET 요청 (2016년 3월 30일 기준)

ctf

캡처 더 플래그(CTF) 이벤트의 패킷 캡처 또는 로그 파일에서 추출한 요청입니다. 대부분 원시 데이터이므로 모든 요청이 실제 페이로드는 아니지만, 요청들은 중복 제거되어 있습니다.

• maccdc2010.txt - Mid-Atlantic CCDC (http://maccdc.org/), 출처: http://www.netresec.com/?page=MACCDC
• maccdc2011.txt - Mid-Atlantic CCDC (http://maccdc.org/), 출처: http://www.netresec.com/?page=MACCDC
• maccdc2012.txt - Mid-Atlantic CCDC (http://maccdc.org/), 출처: http://www.netresec.com/?page=MACCDC
• ists12_2015.txt - Information Security Talent Search (http://ists.sparsa.org/), 출처: http://www.netresec.com/?page=ISTS
• defcon20.txt - DEFCON Capture the Flag (https://www.defcon.org/html/links/dc-ctf.html), 출처: http://www.netresec.com/?page=PcapFiles

기타

• 이미 포함된 출처와 중복될 수 있는 XSS 참고 자료:
  • https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
  • http://htmlpurifier.org/live/smoketests/xssAttacks.php