payloads

Git All the Payloads! Uma coleção de payloads de ataque web. Pull requests são bem-vindos!

Uso

execute ./get.sh para baixar payloads externos e descompactar quaisquer arquivos de payload que estejam comprimidos.

Créditos dos Payloads

• fuzzdb - https://github.com/fuzzdb-project/fuzzdb
• SecLists - https://github.com/danielmiessler/SecLists
• xsuperbug - https://github.com/xsuperbug/payloads
• NickSanzotta - https://github.com/NickSanzotta/BurpIntruder
• 7ioSecurity - https://github.com/7ioSecurity/XSS-Payloads
• shadsidd - https://github.com/shadsidd
• shikari1337 - https://www.shikari1337.com/list-of-xss-payloads-for-cross-site-scripting/
• xmendez - https://github.com/xmendez/wfuzz
• minimaxir - https://github.com/minimaxir/big-list-of-naughty-strings
• xsscx - https://github.com/xsscx/Commodity-Injection-Signatures
• TheRook - https://github.com/TheRook/subbrute
• danielmiessler - https://github.com/danielmiessler/RobotsDisallowed
• FireFart - https://github.com/FireFart/HashCollision-DOS-POC
• HybrisDisaster - https://github.com/HybrisDisaster/aspHashDoS
• swisskyrepo - https://github.com/swisskyrepo/PayloadsAllTheThings
• 1N3 - https://github.com/1N3/IntruderPayloads
• cujanovic - https://github.com/cujanovic/Open-Redirect-Payloads
• cujanovic - https://github.com/cujanovic/Content-Bruteforcing-Wordlist
• cujanovic - https://github.com/cujanovic/subdomain-bruteforce-list
• cujanovic - https://github.com/cujanovic/CRLF-Injection-Payloads
• cujanovic - https://github.com/cujanovic/Virtual-host-wordlist
• cujanovic - https://github.com/cujanovic/dirsearch-wordlist
• lavalamp- - https://github.com/lavalamp-/password-lists
• arnaudsoullie - https://github.com/arnaudsoullie/ics-default-passwords
• scadastrangelove - https://github.com/scadastrangelove/SCADAPASS
• jeanphorn - https://github.com/jeanphorn/wordlist
• j3ers3 - https://github.com/j3ers3/PassList
• nyxxxie - https://github.com/nyxxxie/awesome-default-passwords
• foospidy - https://github.com/foospidy/web-cve-tests
• terjanq - https://github.com/terjanq/Tiny-XSS-Payloads

OWASP

• dirbuster - https://www.owasp.org/index.php/DirBuster
• fuzzing_code_database - https://www.owasp.org/index.php/Category:OWASP_Fuzzing_Code_Database
• JBroFuzz - https://www.owasp.org/index.php/JBroFuzz

Outros

• xss/ismailtasdelen.txt - https://github.com/ismailtasdelen/xss-payload-list
• xss/jsf__k.txt - http://www.jsfuck.com/
• xss/kirankarnad.txt - https://www.linkedin.com/pulse/20140812222156-79939846-xss-vectors-you-may-need-as-a-pen-tester
• xss/packetstorm.txt - https://packetstormsecurity.com/files/112152/Cross-Site-Scripting-Payloads.html
• xss/smeegessec.com.txt - http://www.smeegesec.com/2012/06/collection-of-cross-site-scripting-xss.html
• xss/d3adend.org.txt - http://d3adend.org/xss/ghettoBypass
• xss/soaj1664ashar.txt - http://pastebin.com/u6FY1xDA
• xss/billsempf.txt - https://www.sempf.net/post/Six-hundred-and-sixty-six-XSS-vectors-suitable-for-attacking-an-API.aspx (http://pastebin.com/48WdZR6L)
• xss/787373.txt - https://84692bb0df6f30fc0687-25dde2f20b8e8c1bda75aeb96f737eae.ssl.cf1.rackcdn.com/--xss.html
• xss/bhandarkar.txt - http://hackingforsecurity.blogspot.com/2013/11/xss-cheat-sheet-huge-list.html
• xss/xssdb.txt - http://xssdb.net/xssdb.txt
• xss/0xsobky.txt - https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot
• xss/secgeek.txt - https://www.secgeek.net/solutions-for-xss-waf-challenge/
• xss/reddit_xss_get.txt - Todas as requisições GET de XSS de https://www.reddit.com/r/xss (em 30/03/2016)
• xss/rafaybaloch.txt - http://www.rafayhackingarticles.net/2016/09/breaking-great-wall-of-web-xss-waf.html
• xss/alternume0.txt - https://www.openbugbounty.org/reports/722726/
• xss/XssPayloads - https://twitter.com/XssPayloads
• sqli/camoufl4g3.txt - https://github.com/camoufl4g3/SQLi-payload-Fuzz3R/blob/master/payloads.txt
• sqli/c0rni3sm.txt - http://c0rni3sm.blogspot.in/2016/02/a-quite-rare-mssql-injection.html
• sqli/sqlifuzzer.txt - https://github.com/ContactLeft/sqlifuzzer/tree/master/payloads
• sqli/harisec.txt - https://hackerone.com/reports/297478
• sqli/jstnkndy.txt - https://foxglovesecurity.com/2017/02/07/type-juggling-and-php-object-injection-and-sqli-oh-my/
• sqli/d0znpp.txt - https://medium.com/@d0znpp/how-to-bypass-libinjection-in-many-waf-ngwaf-1e2513453c0f
• sqli/libinjection-bypasses.txt - https://gist.github.com/migolovanov/432fe28c8c7e9fa675ab3903c5eda77f
• traversal/dotdotpwn.txt - https://github.com/wireghoul/dotdotpwn
• codeinjection/fede.txt - https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/
• commandinjection/ismailtasdelen-unix.txt - https://github.com/ismailtasdelen/command-injection-payload-list
• commandinjection/ismailtasdelen-windows.txt - https://github.com/ismailtasdelen/command-injection-payload-list

ctf

Requisições extraídas de capturas de pacotes ou arquivos de log de eventos capture the flag (CTF). Maioria são dados brutos, portanto nem todas as requisições são payloads reais, mas as requisições devem ser deduplicadas.

• maccdc2010.txt - Mid-Atlantic CCDC (http://maccdc.org/), fonte: http://www.netresec.com/?page=MACCDC
• maccdc2011.txt - Mid-Atlantic CCDC (http://maccdc.org/), fonte: http://www.netresec.com/?page=MACCDC
• maccdc2012.txt - Mid-Atlantic CCDC (http://maccdc.org/), fonte: http://www.netresec.com/?page=MACCDC
• ists12_2015.txt - Information Security Talent Search (http://ists.sparsa.org/), fonte: http://www.netresec.com/?page=ISTS
• defcon20.txt - DEFCON Capture the Flag (https://www.defcon.org/html/links/dc-ctf.html), fonte: http://www.netresec.com/?page=PcapFiles

Diversos

• Referências de XSS que podem se sobrepor com fontes já incluídas acima:
  • https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
  • http://htmlpurifier.org/live/smoketests/xssAttacks.php