Awesome GitHub RepositoriesInjection Payloads

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

MHDDoS is a command-line utility designed for volumetric stress testing and infrastructure resilience assessment. It functions as a comprehensive framework for simulating high-volume network and application layer traffic to evaluate the capacity and stability of web services and network infrastructure. The tool distinguishes itself through its ability to generate complex, protocol-specific traffic patterns and raw packet structures. By employing dynamic header randomization and specialized payload injection, it simulates diverse request behaviors intended to test the effectiveness of security

XSStrike is an automated security scanning engine designed for web application discovery, input

Routersploit is a penetration testing framework designed for the security assessment of embedded network devices and routers. It functions as a comprehensive tool for auditing hardware configurations and testing network protocols to identify and verify security vulnerabilities. The framework utilizes a modular plugin architecture that allows for the dynamic loading of exploit and scanner modules. It provides a centralized command interface that manages target state and executes controlled payloads, enabling the automation of security testing across diverse network hardware. The platform cove

TheFatRat is a security exploitation framework designed to automate the creation, obfuscation, and deployment of payloads for penetration testing. It functions as a comprehensive toolkit that streamlines the exploitation lifecycle, enabling users to generate malicious executables, manage network listeners, and execute post-exploitation tasks through a unified command-line interface. The framework distinguishes itself by integrating various third-party exploitation utilities into a single, orchestrated workflow. It provides specialized capabilities for embedding code into legitimate binaries a

fuzzdb is a collection of datasets designed for web application penetration testing and dynamic fuzzing. It provides a fuzzing payload dictionary, a resource discovery wordlist, and a fault injection dataset containing corrupted Unicode, null bytes, and escape codes to trigger application crashes and logic errors. The project includes a security filter bypass list featuring polyglots and encoded strings to evade web application firewalls and input validation filters. It also provides a comprehensive web application penetration testing dataset specifically for identifying flaws such as cross-s

fuzzDicts is a repository of curated wordlists and dictionaries designed for web application fuzzing. It provides collections of strings and payloads used to discover hidden files, subdomains, and security vulnerabilities. The project includes specialized libraries for different security testing vectors, such as dictionaries for common request and cookie parameters, lists of common subdomain prefixes, and collections of passwords and default vendor credentials for brute-force testing. It also maintains a security payload library containing character sequences used to identify flaws like SQL i

UACME is a set of specialized tools designed to audit security configurations, escalate user privileges, and circumvent access control restrictions on Windows systems. It functions as a utility for executing commands with elevated privileges by bypassing User Account Control restrictions. The project includes a configuration auditor used to extract and analyze system settings to identify security misconfigurations and vulnerabilities. It provides a collection of techniques for gaining administrative rights on a host. The toolset covers a wide range of privilege escalation and security auditi

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

SpringBootVulExploit is a collection of scanning and auditing tools designed to identify vulnerabilities, information leaks, and execution vectors within Java-based application frameworks, specifically targeting Spring Boot applications. It provides a suite of exploit techniques, payloads, and security checklists for performing vulnerability analysis. The project features capabilities for triggering remote code execution through injection vectors, deserialization payloads, and malicious configuration files. It includes a scanner for detecting exposed environment variables and internal routing

sqli-labs 是一个包含故意存在漏洞的 Web 应用和沙箱环境的集合，旨在练习识别和利用 SQL 注入漏洞。它作为一个网络安全教育实验室，用户可以在受控环境中尝试数据库漏洞利用。 该环境提供了专门的模块来测试广泛的攻击向量，包括基于错误的注入、布尔盲注和基于时间的注入。它特别涵盖了高级技术，如二阶注入、堆叠查询以及针对 HTTP 头的攻击。 该项目还包括专注于安全过滤器规避和通过注释剥离、阻抗失配等技术绕过 Web 应用防火墙的练习。这些场景允许模拟真实世界的渗透测试和数据库安全审计。

tplmap 是一款旨在检测和利用服务器端模板注入 (SSTI) 漏洞的安全工具。它作为一个自动化扫描器，用于识别易受攻击的模板引擎上下文，并提供了一个实现远程代码执行的框架。 该工具专注于将高级请求转换为引擎特定的语法，以执行操作系统命令并绕过应用沙箱。它还支持远程文件系统访问，允许用户在本地机器和目标服务器之间读取、写入和传输文件。 其他功能包括启动本地易受攻击的服务器以模拟有缺陷的环境进行 Payload 验证。该项目还支持与 Web 安全代理集成，以自动化将测试 Payload 注入到拦截的流量中。

This project is a framework and utility suite for iOS and iPadOS designed for privilege escalation, security exploitation, and system customization. It functions as a tool for performing sandbox escapes, exploiting kernel-level memory corruption and persistence bugs, and injecting unsigned code to bypass standard operating system security checks. The tool enables the modification of restricted system parameters and hidden configuration files to unlock device functionality. It allows for the installation of unauthorized application bundles and alternative app stores by bypassing code signing r

ysoserial.net is a payload generator for .NET deserialization, designed to create malicious serialized objects and structured gadget chains. It serves as a tool for generating command execution strings and security testing suites used to assess vulnerabilities in .NET formatters. The tool enables the creation of sequences of object calls that trigger remote code execution during the reconstruction of serialized data. It produces specialized payloads for executing system commands, loading remote libraries, and accessing local file systems. The project includes capabilities for optimizing payl

Marshalsec is a toolkit designed for generating malicious serialized Java objects to achieve remote code execution during the unmarshalling process. It functions as a Java deserialization exploit tool and a framework for triggering Java Naming and Directory Interface lookups to remote servers. The project provides a JNDI redirector service that intercepts lookups and points targets toward a remote codebase. It includes utilities for crafting payloads that force Java applications to download and execute arbitrary classes from a remote URL. The toolset covers security analysis activities inclu