Payloads All The Things

Payloads All The Things

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! I <3 pull requests 🙂

You can also contribute with a beer IRL or with


Every section contains:

  • – vulnerability description and how to exploit it
  • Intruders – a set of files to give to Burp Intruder
  • Some exploits

You might also like :

Try Harder

Ever wonder where you can use your knowledge ? The following list will help you find “targets” to improve your skills.

Book’s list

Grab a book and relax, these ones are the best security books (in my opinion).

More resources




Command Link
docker pull remnux/metasploit docker-metasploit
docker pull paoloo/sqlmap docker-sqlmap
docker pull kalilinux/kali-linux-docker official Kali Linux
docker pull owasp/zap2docker-stable official OWASP ZAP
docker pull wpscanteam/wpscan official WPScan
docker pull infoslack/dvwa Damn Vulnerable Web Application (DVWA)
docker pull danmx/docker-owasp-webgoat OWASP WebGoat Project docker image
docker pull opendns/security-ninjas Security Ninjas
docker pull ismisepaul/securityshepherd OWASP Security Shepherd
docker-compose build && docker-compose up OWASP NodeGoat
docker pull citizenstig/nowasp OWASP Mutillidae II Web Pen-Test Practice Application
docker pull bkimminich/juice-shop OWASP Juice Shop