Skip to content
All tools
WebRuns locallyNo account

Web attack payload catalog

Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.

Open in ctfpal

A payload list is only useful if it is organised by intent. The first question is never 'what is my exploit' but 'is this injectable at all', and the payloads that answer that are different from the ones that extract data.

Detection before exploitation

ClassDetection probeWhat confirms it
SQL injection' then ''One breaks, two repair - that is the parser talking
SSTI{{7*7}}The response contains 49
XSS'"><svg onload=1>The characters survive unescaped into the HTML
Command injection;sleep 5The response takes five seconds longer
SSRFA URL you controlYour listener receives a request

SSTI: identify the engine first

{{7*7}} returning 49 tells you a template engine evaluated it, but Jinja2, Twig, Freemarker, and Velocity all need different escape chains to reach code execution. {{7*'7'}} disambiguates: Jinja2 returns 7777777 (Python string repetition), Twig returns 49. Getting the engine right first saves trying twenty payloads that could never have worked.

Part of a module

6. Web attacks and session tokens

Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.

Practise on real challenges

Related tools