OWASP-Hunting
owasp/owasp-huntingCurated collection of payloads for ethical security testing and bug bounty hunting, covering common web vulnerabilities and attack vectors.
curated-resourcespayload-generationpenetration-testing+2
22
owasp/owasp-huntingCurated collection of payloads for ethical security testing and bug bounty hunting, covering common web vulnerabilities and attack vectors.
zapstiko/bug-bountyHere Are Some Bug Bounty Resource From Twitter
7iosecurity/xss-payloadsCollection of cross-site scripting (XSS) payloads for web application security testing, filter bypass research, and penetration testing engagements.
tennc/webshellThis is a webshell open source project
waf-bypass-maker/waf-community-bypassesCurated CSV collection of community-sourced Web Application Firewall bypass payloads for testing and validating WAF protections.
mbadanoiu/xxe-payloadsQuick access to XXE Payloads
cujanovic/open-redirect-payloadsCurated collection of open redirect payloads sourced from bug bounty reports, with a shell script to substitute a target whitelisted domain for…
cujanovic/crlf-injection-payloadsCollection of CRLF injection payloads gathered from bug bounty reports, used as a reference for testing HTTP header and response splitting…
h3x0v3rl0rd/xss-payload-listCurated collection of XSS payload vectors for web application security testing, covering various contexts and bypass techniques.
portswigger/xss-cheatsheet-dataCommunity-contributed JSON dataset of XSS payload vectors powering the PortSwigger XSS cheat sheet, with browser support and interaction metadata.
edr4/xss-bypass-filtersCurated XSS payload collection and filter-bypass cheat sheet: WAF-specific evasion, JS/HTML injection vectors, encoding tricks, DOMPurify and…
swisskyrepo/payloadsallthethingsA list of useful payloads and bypass for Web Application Security and Pentest/CTF
ghosttroops/topTOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things
ill-deed/cve-2025-34085-multi-targetMulti-target unauthenticated RCE scanner for CVE-2025-34085 affecting WordPress Simple File List plugin. Uploads, renames, and triggers PHP webshells…
ifconfig-me/log4shell-payloadsLog4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889
yukinime/cve-2025-34085Automated scanner and exploit for CVE-2025-34085, an unauthenticated RCE in the WordPress Simple File List plugin. Supports multi-target scanning,…
joelindra/cve-2017-9841Tool designed to scan a list of websites for a known vulnerability in the PHPUnit framework, specifically the CVE-2017-9841 vulnerability.
mrjhaxcore/cve-2025-34085Simple File List – Unauthenticated RCE Exploit (CVE-2025-34085)