Payloads
// Payload Collections
Curated offensive payloads for authorised security testing.
// Categories
XSS
Cross-Site Scripting
Session theft, keylogging, phishing, DOM manipulation, WAF bypass.
10 posts
SQLi
SQL Injection
Error-based, union, blind boolean, time-based, OOB extraction.
0 posts
CMDi
Command Injection
OS command injection, RCE chains, reverse shells, filter bypass.
0 posts
XXE
XML External Entity
File read, SSRF via XXE, blind OOB exfiltration, error-based.
0 posts
// Cross-Site Scripting (XSS)
XSS
A production-grade XSS keylogger that handles network errors gracefully and logs each keystroke with confirmation — designed fo...
XSS
Use an XSS injection to exfiltrate the victim's session cookie to your server — achieving full account takeover without knowing...
XSS
Inject hidden username and password fields into the DOM — browsers auto-fill them with saved credentials. A delayed fetch sends...
XSS
Many apps store JWTs, API keys, and user data in localStorage and sessionStorage. This XSS payload silently exfiltrates all of ...
XSS
Replace the entire page with a cloned login form via XSS — the URL stays legitimate, the victim trusts it, and credentials go d...
XSS
Attach a keydown event listener through an XSS payload to silently capture everything the victim types — passwords, search quer...
XSS
When the injection point is inside innerHTML, script tags don't fire — but img onerror does. This one-liner exfiltrates localSt...
XSS
When inline script injection is blocked, host your payload externally and load it via a script src tag — bypassing length limit...
XSS
When WAFs and filters block raw XSS strings, Base64-encode your payload and use eval(atob()) or btoa(eval(atob())) to execute i...
XSS
Understanding the fundamental JavaScript payload structure used in Cross-Site Scripting attacks — the foundation before moving ...