WebRuns locallyNo account
Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
Open in ctfpalA payload list is only useful if it is organised by intent. The first question is never 'what is my exploit' but 'is this injectable at all', and the payloads that answer that are different from the ones that extract data.
Detection before exploitation
| Class | Detection probe | What confirms it |
|---|---|---|
| SQL injection | ' then '' | One breaks, two repair - that is the parser talking |
| SSTI | {{7*7}} | The response contains 49 |
| XSS | '"><svg onload=1> | The characters survive unescaped into the HTML |
| Command injection | ;sleep 5 | The response takes five seconds longer |
| SSRF | A URL you control | Your listener receives a request |
SSTI: identify the engine first
{{7*7}} returning 49 tells you a template engine evaluated it, but Jinja2, Twig, Freemarker, and Velocity all need different escape chains to reach code execution. {{7*'7'}} disambiguates: Jinja2 returns 7777777 (Python string repetition), Twig returns 49. Getting the engine right first saves trying twenty payloads that could never have worked.