Awesome GitHub RepositoriesInjection Payloads

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

MHDDoS is a command-line utility designed for volumetric stress testing and infrastructure resilience assessment. It functions as a comprehensive framework for simulating high-volume network and application layer traffic to evaluate the capacity and stability of web services and network infrastructure. The tool distinguishes itself through its ability to generate complex, protocol-specific traffic patterns and raw packet structures. By employing dynamic header randomization and specialized payload injection, it simulates diverse request behaviors intended to test the effectiveness of security

XSStrike is an automated security scanning engine designed for web application discovery, input

Routersploit is a penetration testing framework designed for the security assessment of embedded network devices and routers. It functions as a comprehensive tool for auditing hardware configurations and testing network protocols to identify and verify security vulnerabilities. The framework utilizes a modular plugin architecture that allows for the dynamic loading of exploit and scanner modules. It provides a centralized command interface that manages target state and executes controlled payloads, enabling the automation of security testing across diverse network hardware. The platform cove

TheFatRat is a security exploitation framework designed to automate the creation, obfuscation, and deployment of payloads for penetration testing. It functions as a comprehensive toolkit that streamlines the exploitation lifecycle, enabling users to generate malicious executables, manage network listeners, and execute post-exploitation tasks through a unified command-line interface. The framework distinguishes itself by integrating various third-party exploitation utilities into a single, orchestrated workflow. It provides specialized capabilities for embedding code into legitimate binaries a

fuzzdb is a collection of datasets designed for web application penetration testing and dynamic fuzzing. It provides a fuzzing payload dictionary, a resource discovery wordlist, and a fault injection dataset containing corrupted Unicode, null bytes, and escape codes to trigger application crashes and logic errors. The project includes a security filter bypass list featuring polyglots and encoded strings to evade web application firewalls and input validation filters. It also provides a comprehensive web application penetration testing dataset specifically for identifying flaws such as cross-s

fuzzDicts is a repository of curated wordlists and dictionaries designed for web application fuzzing. It provides collections of strings and payloads used to discover hidden files, subdomains, and security vulnerabilities. The project includes specialized libraries for different security testing vectors, such as dictionaries for common request and cookie parameters, lists of common subdomain prefixes, and collections of passwords and default vendor credentials for brute-force testing. It also maintains a security payload library containing character sequences used to identify flaws like SQL i

UACME is a set of specialized tools designed to audit security configurations, escalate user privileges, and circumvent access control restrictions on Windows systems. It functions as a utility for executing commands with elevated privileges by bypassing User Account Control restrictions. The project includes a configuration auditor used to extract and analyze system settings to identify security misconfigurations and vulnerabilities. It provides a collection of techniques for gaining administrative rights on a host. The toolset covers a wide range of privilege escalation and security auditi

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

SpringBootVulExploit es una colección de herramientas de escaneo y auditoría diseñadas para identificar vulnerabilidades, fugas de información y vectores de ejecución dentro de frameworks de aplicaciones basados en Java, específicamente dirigidas a aplicaciones Spring Boot. Proporciona una suite de técnicas de explotación, payloads y listas de verificación de seguridad para realizar análisis de vulnerabilidades. El proyecto cuenta con capacidades para activar la ejecución remota de código a través de vectores de inyección, payloads de deserialización y archivos de configuración maliciosos. Incluye un escáner para detectar variables de entorno expuestas y detalles de enrutamiento interno causados por endpoints mal configurados, así como métodos para extraer datos sensibles y secretos en texto plano mediante el análisis de heap dumps. El conjunto de herramientas soporta evaluaciones de seguridad de caja negra y análisis de vulnerabilidades de frameworks, incluyendo el mapeo de versiones de dependencias para identificar posibles ventanas de vulnerabilidad.

sqli-labs es una colección de aplicaciones web intencionalmente vulnerables y entornos sandbox diseñados para practicar la identificación y explotación de vulnerabilidades de inyección SQL. Sirve como un laboratorio de educación en ciberseguridad donde los usuarios pueden experimentar con exploits de bases de datos en un entorno controlado. El entorno proporciona módulos especializados para probar una amplia gama de vectores de ataque, incluyendo inyecciones basadas en errores, boolean-blind y basadas en tiempo. Cubre específicamente técnicas avanzadas como inyecciones de segundo orden, consultas apiladas (stacked queries) y ataques dirigidos a cabeceras HTTP. El proyecto también incluye ejercicios centrados en la evasión de filtros de seguridad y la omisión de firewalls de aplicaciones web mediante técnicas como la eliminación de comentarios y el desajuste de impedancia. Estos escenarios permiten la simulación de pruebas de penetración del mundo real y auditorías de seguridad de bases de datos.

tplmap es una herramienta de seguridad diseñada para la detección y explotación de vulnerabilidades de inyección de plantillas en el lado del servidor (SSTI). Funciona como un escáner automatizado para identificar contextos de motores de plantillas vulnerables y proporciona un framework para lograr la ejecución remota de código. La herramienta se centra en traducir solicitudes de alto nivel a sintaxis específica del motor para ejecutar comandos del sistema operativo y eludir sandboxes de aplicaciones. Además, permite el acceso remoto al sistema de archivos, facilitando la lectura, escritura y transferencia de archivos entre una máquina local y un servidor objetivo. Otras capacidades incluyen la posibilidad de lanzar servidores locales vulnerables para simular entornos defectuosos y verificar payloads. El proyecto también admite la integración con proxies de seguridad web para automatizar la inyección de payloads de prueba en el tráfico interceptado.

This project is a framework and utility suite for iOS and iPadOS designed for privilege escalation, security exploitation, and system customization. It functions as a tool for performing sandbox escapes, exploiting kernel-level memory corruption and persistence bugs, and injecting unsigned code to bypass standard operating system security checks. The tool enables the modification of restricted system parameters and hidden configuration files to unlock device functionality. It allows for the installation of unauthorized application bundles and alternative app stores by bypassing code signing r

ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and structured gadget chains. It serves as a tool for generating command execution strings and security testing suites used to assess vulnerabilities in .NET formatters. The tool enables the creation of sequences of object calls that trigger remote code execution during the reconstruction of serialized data. It produces specialized payloads for executing system commands, loading remote libraries, and accessing local file systems. The project includes capabilities for optimizing payl

Marshalsec is a toolkit designed for generating malicious serialized Java objects to achieve remote code execution during the unmarshalling process. It functions as a Java deserialization exploit tool and a framework for triggering Java Naming and Directory Interface lookups to remote servers. The project provides a JNDI redirector service that intercepts lookups and points targets toward a remote codebase. It includes utilities for crafting payloads that force Java applications to download and execute arbitrary classes from a remote URL. The toolset covers security analysis activities inclu