81.8K ·GitHub
What is this?
A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.
A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.Is this a tool or a reference list?It is a reference wiki/cheatsheet repository, not executable software: each vulnerability class has its own folder with a README, example payloads, and supporting files.
It is a reference wiki/cheatsheet repository, not executable software: each vulnerability class has its own folder with a README, example payloads, and supporting files.How is the content organized and where do I start?Content is split into per-vulnerability folders (e.g. SQL Injection, XSS, SSRF) each containing a README with description, exploitation steps and payloads, plus Intruder files for Burp Suite and reference images.
Content is split into per-vulnerability folders (e.g. SQL Injection, XSS, SSRF) each containing a README with description, exploitation steps and payloads, plus Intruder files for Burp Suite and reference images.Do I need any tools to use these payloads?No special tooling is required to read the cheatsheets, but some sections include files meant for Burp Suite's Intruder tool.
No special tooling is required to read the cheatsheets, but some sections include files meant for Burp Suite's Intruder tool.Is this an automated scanner?No, it is a manual reference of payloads and techniques you apply yourself during testing, not an automated exploitation tool.
No, it is a manual reference of payloads and techniques you apply yourself during testing, not an automated exploitation tool.Are there related projects for other areas like Active Directory or hardware?Yes, the author maintains sibling projects InternalAllTheThings for Active Directory and internal pentest cheatsheets, and HardwareAllTheThings for Hardware/IOT pentesting.
Yes, the author maintains sibling projects InternalAllTheThings for Active Directory and internal pentest cheatsheets, and HardwareAllTheThings for Hardware/IOT pentesting.Is there a nicer way to browse this than GitHub?Yes, there is an alternative display version called PayloadsAllTheThingsWeb for easier browsing.
Yes, there is an alternative display version called PayloadsAllTheThingsWeb for easier browsing.Is this list actively maintained?Yes, it has CI workflows for markdown checks and docs building, and carries the hacktoberfest topic indicating ongoing community contributions.
Yes, it has CI workflows for markdown checks and docs building, and carries the hacktoberfest topic indicating ongoing community contributions.What are similar projects?Claude-Red, hacktricks, bug-bounty-hunting-prompts, PENTESTING-BIBLE, copy-fail-CVE-2026-31431, hacker-roadmap, dirsearch, Red-Teaming-Toolkit
Claude-Red, hacktricks, bug-bounty-hunting-prompts, PENTESTING-BIBLE, copy-fail-CVE-2026-31431, hacker-roadmap, dirsearch, Red-Teaming-ToolkitWhich topics is it in?methodology, web-application, privilege-escalation, bugbounty, pentest, redteam, bypass, web-security, ctf, infosec, vulnerability, offensive-security
methodology, web-application, privilege-escalation, bugbounty, pentest, redteam, bypass, web-security, ctf, infosec, vulnerability, offensive-security