A personal reference collection of web application security payloads, bypasses, and penetration testing resources.
For authorized security testing and educational purposes only.
Each vulnerability category follows a consistent layout:
| Item | Description |
|---|---|
README.md |
Vulnerability overview, exploitation techniques, and payloads |
Intruder/ |
Wordlists and payload files for Burp Suite Intruder |
Images/ |
Supporting screenshots for the README |
Files/ |
Auxiliary files referenced in the README |
Use the _template_vuln/ folder as a starting point when adding a new category.
| Category | Description |
|---|---|
| Account Takeover | ATO techniques and bypass methods |
| API Key Leaks | Discovering and exploiting exposed API keys |
| AWS / S3 Buckets | Cloud misconfiguration and bucket enumeration |
| Command Injection | OS command injection payloads and techniques |
| CORS Misconfiguration | Cross-origin resource sharing exploits |
| CRLF Injection | Carriage return / line feed injection |
| CSRF Injection | Cross-site request forgery |
| CSV Injection | Formula injection in exported data |
| CVE Exploits | Standalone exploit scripts for known CVEs |
| Directory Traversal | Path traversal and file disclosure |
| File Inclusion | LFI / RFI payloads |
| GraphQL Injection | Introspection abuse and injection techniques |
| Insecure Deserialization | Java, PHP, Python, Ruby deserialization |
| Insecure Direct Object References | IDOR exploitation patterns |
| Insecure Management Interface | Exposed admin panels and management endpoints |
| Insecure Source Code Management | .git/.svn exposure and extraction |
| JSON Web Token | JWT attacks — alg:none, secret cracking, key confusion |
| Kubernetes | K8s misconfigurations and cluster attacks |
| LaTeX Injection | Injection via LaTeX rendering engines |
| LDAP Injection | LDAP filter bypass and blind injection |
| NoSQL Injection | MongoDB and other NoSQL injection |
| OAuth | OAuth flow abuse and token theft |
| Open Redirect | URL redirection bypasses |
| Race Condition | TOCTOU and concurrent request attacks |
| Request Smuggling | HTTP/1.1 and HTTP/2 desync attacks |
| SAML Injection | XML signature wrapping and SAML bypass |
| Server Side Request Forgery | SSRF payloads and cloud metadata abuse |
| Server Side Template Injection | SSTI payloads across Jinja2, Twig, Freemarker, etc. |
| SQL Injection | Error-based, blind, and time-based SQLi |
| Tabnabbing | Reverse tabnabbing via target=_blank |
| Type Juggling | PHP loose comparison exploits |
| Upload Insecure Files | Bypassing file upload filters |
| Web Cache Deception | Cache poisoning and deception |
| Web Sockets | WebSocket hijacking and injection |
| XPATH Injection | Blind and error-based XPath injection |
| XSLT Injection | XSLT server-side injection |
| XSS Injection | Reflected, stored, DOM-based, and filter bypasses |
| XXE Injection | XML external entity attacks |
General pentest methodology, cheat sheets, and post-exploitation notes:
- Methodology and enumeration
- Active Directory Attack
- Cloud - AWS Pentest
- Cloud - Azure Pentest
- Cobalt Strike - Cheatsheet
- Container - Docker Pentest
- Linux - Persistence
- Linux - Privilege Escalation
- Metasploit - Cheatsheet
- Miscellaneous - Tricks
- Network Discovery
- Network Pivoting Techniques
- Reverse Shell Cheatsheet
- Bind Shell Cheatsheet
- Subdomains Enumeration
- Windows - Download and Execute
- Windows - Mimikatz
- Windows - Persistence
- Windows - Post Exploitation Koadic
- Windows - Privilege Escalation
- Windows - Using credentials