OWASP Hunting

Version: 1.0.1 | Changelog

An open-source security testing and vulnerability research reference for security researchers, penetration testers, bug bounty hunters, and developers. OWASP repository.

A curated reference of testing payloads, attack vectors, and methodology notes — not an automated scanner or exploit framework. Nothing here runs against a target on its own.

What's inside

41 vulnerability categories, each a directory with a README.md (description, attack vectors, testing approach) and one or more payload or testing-reference text files.

Browse all categories

Category	Group
SQL Injection	Injection
NoSQL Injection	Injection
XSS	Injection
Command Injection	Injection
SSTI	Injection
SSJI	Injection
CSV Injection	Injection
LDAP Injection	Injection
Log Injection	Injection
XML Injection	Injection
Prompt Injection	Injection
Prototype Pollution	Injection
CSS Injection	Injection
Path Traversal	Access control
IDOR	Access control
Open Redirect	Access control
API Authorization	Access control
Authentication Bypass	Auth
Password Reset	Auth
Weak Passwords	Auth
OAuth and OIDC	Auth
SAML Vulnerabilities	Auth
Session Management	Auth
SSRF	Server-side
Deserialization	Server-side
File Upload	Server-side
Symbolic Link Attacks	Server-side
Timing Attacks	Server-side
Security Misconfiguration	Config & design
CORS Misconfiguration	Config & design
HTTP Request Smuggling	Config & design
JWT Vulnerabilities	Config & design
Business Logic	Config & design
Weak Cryptography	Config & design
Vulnerable Components	Config & design
Cache Poisoning	Config & design
CSRF	Browser & protocol
GraphQL Security	Browser & protocol
WebSocket Security	Browser & protocol
XS-Leaks	Browser & protocol
Tor-Based Attacks	Network

Getting started

git clone https://github.com/OWASP/OWASP-Hunting.git
cd OWASP-Hunting
cat SQL-Injection/README.md
grep -r "onerror=" XSS/xss-payloads.txt

No build or install step — it's plain Markdown and text files. Read a category's README.md first; it gives the context the payload list assumes.

Text files retain the existing comment-and-payload format. Some entries are single inputs; others are protocol fragments, escaped HTTP bytes, browser fixtures or commented multi-request sequences. Use each section in its stated context rather than loading every file as a one-line wordlist. Replace lab placeholders with values from systems you control, preserve byte-sensitive framing, and verify the stated expected result. Reference examples are not claims that every target, browser or library is vulnerable.

Contributing

See CONTRIBUTING.md — workflow, payload standards, PR requirements, and the AI-assisted contribution policy. This project does not run any AI provider internally; the policy covers contributor AI use only.

Responsible use

For authorized testing only — systems you own, systems with explicit written permission, in-scope bug bounty programs, or controlled educational labs. Never against systems you're not authorized to test. See DISCLAIMER.md for full terms, and SECURITY.md to report a security issue in this repo.

License

MIT — see LICENSE. Copyright OWASP.

Resources

Project repository · OWASP Top 10 · OWASP API Security Top 10 · OWASP Testing Guide