Payloads — PayloadsAllTheThings mirror — DÆMON//SEC

01 payloadAccount Takeover 2 pages 02 payloadAPI Key Leaks 2 pages 03 payloadBrute Force Rate Limit 1 page 04 payloadBusiness Logic Errors 1 page 05 payloadClickjacking 1 page 06 payloadClient Side Path Traversal 1 page 07 payloadCommand Injection 1 page 08 payloadCORS Misconfiguration 1 page 09 payloadCRLF Injection 1 page 10 payloadCross-Site Request Forgery 1 page 11 payloadCSS Injection 1 page 12 payloadCSV Injection 1 page 13 payloadCVE Exploits 2 pages 14 payloadDenial of Service 1 page 15 payloadDependency Confusion 1 page 16 payloadDirectory Traversal 1 page 17 payloadDNS Rebinding 1 page 18 payloadDOM Clobbering 1 page 19 payloadEncoding Transformations 1 page 20 payloadExternal Variable Modification 1 page 21 payloadFile Inclusion 3 pages 22 payloadGoogle Web Toolkit 1 page 23 payloadGraphQL Injection 1 page 24 payloadHeadless Browser 1 page 25 payloadHidden Parameters 1 page 26 payloadHTTP Parameter Pollution 1 page 27 payloadInsecure Deserialization 7 pages 28 payloadInsecure Direct Object References 1 page 29 payloadInsecure Management Interface 1 page 30 payloadInsecure Randomness 1 page 31 payloadInsecure Source Code Management 5 pages 32 payloadJava RMI 1 page 33 payloadJSON Web Token 1 page 34 payloadLaTeX Injection 1 page 35 payloadLDAP Injection 1 page 36 payloadMass Assignment 1 page 37 payloadMethodology and Resources 34 pages 38 payloadNoSQL Injection 1 page 39 payloadOAuth Misconfiguration 1 page 40 payloadOpen Redirect 1 page 41 payloadORM Leak 1 page 42 payloadPrompt Injection 1 page 43 payloadPrototype Pollution 1 page 44 payloadRace Condition 1 page 45 payloadRegular Expression 1 page 46 payloadRequest Smuggling 1 page 47 payloadReverse Proxy Misconfigurations 1 page 48 payloadSAML Injection 1 page 49 payloadServer Side Include Injection 1 page 50 payloadServer Side Request Forgery 3 pages 51 payloadServer Side Template Injection 8 pages 52 payloadSQL Injection 10 pages 53 payloadTabnabbing 1 page 54 payloadType Juggling 1 page 55 payloadUpload Insecure Files 2 pages 56 payloadVirtual Hosts 1 page 57 payloadWeb Cache Deception 1 page 58 payloadWeb Sockets 1 page 59 payloadXPATH Injection 1 page 60 payloadXS-Leak 1 page 61 payloadXSLT Injection 1 page 62 payloadXSS Injection 6 pages 63 payloadXXE Injection 1 page 64 payloadZip Slip 1 page

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.