payloadsallthethings-checklist

name	payloadsallthethings-checklist
description	The full PayloadsAllTheThings category checklist (60+ vuln classes) as a final coverage sweep. Converted from master-pentest-prompt.md Phase 22. Use as a closing checklist near the end of an engagement to catch any category that wasn't explicitly covered by another skill.

PayloadsAllTheThings full directory list (check every box)

When to use

Late in an engagement, as a coverage sweep against the PayloadsAllTheThings category list -- cross-check this against what's actually been tested and chase down anything that fell through the gaps between the other skills.

The checklist

API Key Leaks · Account Takeover · Brute Force Rate Limit · Business Logic Errors · CORS Misconfiguration · CRLF Injection · CSS Injection · CSV Injection · CVE Exploits · Clickjacking · Client Side Path Traversal · Command Injection · CSRF · DNS Rebinding · DOM Clobbering · Denial of Service · Dependency Confusion · Directory Traversal · Encoding Transformations · External Variable Modification · File Inclusion · Google Web Toolkit · GraphQL Injection · HTTP Parameter Pollution · Headless Browser · Hidden Parameters · Insecure Deserialization · IDOR · Insecure Management Interface · Insecure Randomness · Insecure Source Code Management · JWT · Java RMI · LDAP Injection · LaTeX Injection · Mass Assignment · NoSQL Injection · OAuth Misconfiguration · ORM Leak · Open Redirect · Prompt Injection · Prototype Pollution · Race Condition · Regular Expression (ReDoS) · Request Smuggling · Reverse Proxy Misconfigurations · SAML Injection · SQL Injection · SSI (Server Side Include) Injection · SSRF · SSTI · Tabnabbing · Type Juggling · Upload Insecure Files · Virtual Hosts · Web Cache Deception · Web Sockets · XPATH Injection · XS-Leak (cross-site leaks) · XSLT Injection · XSS · XXE · Zip Slip

Most of these are already covered in depth by a dedicated skill (injection-and-rce, xss, ssrf, xxe, access-control-and-idor, request-smuggling, open-redirect, csrf-cors-origin, and others) -- treat this list as the final "did I actually hit every category" check, not a first-pass technique reference.