Awesome GitHub RepositoriesInjection Payloads

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

MHDDoS is a command-line utility designed for volumetric stress testing and infrastructure resilience assessment. It functions as a comprehensive framework for simulating high-volume network and application layer traffic to evaluate the capacity and stability of web services and network infrastructure. The tool distinguishes itself through its ability to generate complex, protocol-specific traffic patterns and raw packet structures. By employing dynamic header randomization and specialized payload injection, it simulates diverse request behaviors intended to test the effectiveness of security

XSStrike is an automated security scanning engine designed for web application discovery, input

Routersploit is a penetration testing framework designed for the security assessment of embedded network devices and routers. It functions as a comprehensive tool for auditing hardware configurations and testing network protocols to identify and verify security vulnerabilities. The framework utilizes a modular plugin architecture that allows for the dynamic loading of exploit and scanner modules. It provides a centralized command interface that manages target state and executes controlled payloads, enabling the automation of security testing across diverse network hardware. The platform cove

TheFatRat is a security exploitation framework designed to automate the creation, obfuscation, and deployment of payloads for penetration testing. It functions as a comprehensive toolkit that streamlines the exploitation lifecycle, enabling users to generate malicious executables, manage network listeners, and execute post-exploitation tasks through a unified command-line interface. The framework distinguishes itself by integrating various third-party exploitation utilities into a single, orchestrated workflow. It provides specialized capabilities for embedding code into legitimate binaries a

fuzzdb is a collection of datasets designed for web application penetration testing and dynamic fuzzing. It provides a fuzzing payload dictionary, a resource discovery wordlist, and a fault injection dataset containing corrupted Unicode, null bytes, and escape codes to trigger application crashes and logic errors. The project includes a security filter bypass list featuring polyglots and encoded strings to evade web application firewalls and input validation filters. It also provides a comprehensive web application penetration testing dataset specifically for identifying flaws such as cross-s

fuzzDicts is a repository of curated wordlists and dictionaries designed for web application fuzzing. It provides collections of strings and payloads used to discover hidden files, subdomains, and security vulnerabilities. The project includes specialized libraries for different security testing vectors, such as dictionaries for common request and cookie parameters, lists of common subdomain prefixes, and collections of passwords and default vendor credentials for brute-force testing. It also maintains a security payload library containing character sequences used to identify flaws like SQL i

UACME is a set of specialized tools designed to audit security configurations, escalate user privileges, and circumvent access control restrictions on Windows systems. It functions as a utility for executing commands with elevated privileges by bypassing User Account Control restrictions. The project includes a configuration auditor used to extract and analyze system settings to identify security misconfigurations and vulnerabilities. It provides a collection of techniques for gaining administrative rights on a host. The toolset covers a wide range of privilege escalation and security auditi

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

SpringBootVulExploit عبارة عن مجموعة من أدوات الفحص والتدقيق المصممة لتحديد الثغرات الأمنية، وتسريبات المعلومات، وناقلات التنفيذ داخل أطر عمل تطبيقات Java، وتحديداً التي تستهدف تطبيقات Spring Boot. توفر مجموعة من تقنيات الاستغلال، والحمولات (payloads)، وقوائم المراجعة الأمنية لإجراء تحليل الثغرات. يتميز المشروع بقدرات لتشغيل تنفيذ الكود عن بُعد من خلال ناقلات الحقن، وحمولات إلغاء التسلسل (deserialization)، وملفات الإعدادات الضارة. يتضمن ماسحاً ضوئياً لاكتشاف متغيرات البيئة المكشوفة وتفاصيل التوجيه الداخلي الناتجة عن نقاط النهاية التي تم إعدادها بشكل خاطئ، بالإضافة إلى طرق لاستخراج البيانات الحساسة والأسرار بنص عادي عبر تحليل تفريغ الذاكرة (heap dump). تدعم مجموعة الأدوات تقييمات الأمان للصندوق الأسود (black-box) وتحليل ثغرات إطار العمل، بما في ذلك تعيين إصدارات التبعيات لتحديد نوافذ الثغرات المحتملة.

sqli-labs هي مجموعة من تطبيقات الويب الضعيفة عمداً وبيئات الاختبار المصممة لممارسة تحديد واستغلال ثغرات حقن SQL. تعمل كمختبر تعليمي للأمن السيبراني حيث يمكن للمستخدمين تجربة استغلال قواعد البيانات في بيئة خاضعة للرقابة. توفر البيئة وحدات متخصصة لاختبار مجموعة واسعة من ناقلات الهجوم، بما في ذلك الحقن القائم على الخطأ، والحقن الأعمى القائم على المنطق البولي، والحقن القائم على الوقت. تغطي بشكل خاص تقنيات متقدمة مثل حقن الدرجة الثانية، والاستعلامات المكدسة، والهجمات التي تستهدف رؤوس HTTP. يتضمن المشروع أيضاً تمارين تركز على تجاوز مرشحات الأمان وتجاوز جدران حماية تطبيقات الويب من خلال تقنيات مثل تجريد التعليقات وعدم تطابق المعاوقة. تسمح هذه السيناريوهات بمحاكاة اختبار الاختراق الواقعي وتدقيق أمن قواعد البيانات.

tplmap هي أداة أمنية مصممة لاكتشاف واستغلال ثغرات حقن القوالب من جانب الخادم (Server-Side Template Injection). تعمل كماسح آلي لتحديد سياقات محركات القوالب المعرضة للخطر وتوفر إطار عمل لتحقيق تنفيذ الأوامر عن بُعد. تركز الأداة على ترجمة الطلبات عالية المستوى إلى صيغة برمجية خاصة بالمحرك لتنفيذ أوامر نظام التشغيل وتجاوز بيئات الحماية (sandboxes) الخاصة بالتطبيقات. كما تتيح الوصول إلى نظام الملفات عن بُعد، مما يسمح للمستخدمين بقراءة وكتابة ونقل الملفات بين الجهاز المحلي والخادم المستهدف. تشمل القدرات الإضافية إمكانية تشغيل خوادم محلية مصابة لمحاكاة بيئات معيبة للتحقق من الحمولات (payloads). يدعم المشروع أيضاً التكامل مع وكلاء أمن الويب (web security proxies) لأتمتة حقن حمولات الاختبار في حركة المرور المعترضة.

This project is a framework and utility suite for iOS and iPadOS designed for privilege escalation, security exploitation, and system customization. It functions as a tool for performing sandbox escapes, exploiting kernel-level memory corruption and persistence bugs, and injecting unsigned code to bypass standard operating system security checks. The tool enables the modification of restricted system parameters and hidden configuration files to unlock device functionality. It allows for the installation of unauthorized application bundles and alternative app stores by bypassing code signing r

ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and structured gadget chains. It serves as a tool for generating command execution strings and security testing suites used to assess vulnerabilities in .NET formatters. The tool enables the creation of sequences of object calls that trigger remote code execution during the reconstruction of serialized data. It produces specialized payloads for executing system commands, loading remote libraries, and accessing local file systems. The project includes capabilities for optimizing payl

Marshalsec is a toolkit designed for generating malicious serialized Java objects to achieve remote code execution during the unmarshalling process. It functions as a Java deserialization exploit tool and a framework for triggering Java Naming and Directory Interface lookups to remote servers. The project provides a JNDI redirector service that intercepts lookups and points targets toward a remote codebase. It includes utilities for crafting payloads that force Java applications to download and execute arbitrary classes from a remote URL. The toolset covers security analysis activities inclu