owasp/owasp-huntingCurated collection of payloads for ethical security testing and bug bounty hunting, covering common web vulnerabilities and attack vectors.
Version: 1.0.1 | Changelog
An open-source security testing and vulnerability research reference for security researchers, penetration testers, bug bounty hunters, and developers. OWASP repository.
A curated reference of testing payloads, attack vectors, and methodology notes — not an automated scanner or exploit framework. Nothing here runs against a target on its own.
41 vulnerability categories, each a directory with a README.md (description, attack vectors, testing approach) and one or more payload or testing-reference text files.
git clone https://github.com/OWASP/OWASP-Hunting.git
cd OWASP-Hunting
cat SQL-Injection/README.md
grep -r "onerror=" XSS/xss-payloads.txt
No build or install step — it's plain Markdown and text files. Read a category's README.md first; it gives the context the payload list assumes.
Text files retain the existing comment-and-payload format. Some entries are single inputs; others are protocol fragments, escaped HTTP bytes, browser fixtures or commented multi-request sequences. Use each section in its stated context rather than loading every file as a one-line wordlist. Replace lab placeholders with values from systems you control, preserve byte-sensitive framing, and verify the stated expected result. Reference examples are not claims that every target, browser or library is vulnerable.
See CONTRIBUTING.md — workflow, payload standards, PR requirements, and the AI-assisted contribution policy. This project does not run any AI provider internally; the policy covers contributor AI use only.
For authorized testing only — systems you own, systems with explicit written permission, in-scope bug bounty programs, or controlled educational labs. Never against systems you're not authorized to test. See DISCLAIMER.md for full terms, and SECURITY.md to report a security issue in this repo.
MIT — see LICENSE. Copyright OWASP.
Project repository · OWASP Top 10 · OWASP API Security Top 10 · OWASP Testing Guide