Web attack payload catalog
Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.
Open in ctfpalA payload list is only useful if it is organised by intent. The first question is never 'what is my exploit' but 'is this injectable at all', and the payloads that answer that are different from the ones that extract data.
Detection before exploitation
| Class | Detection probe | What confirms it |
|---|---|---|
| SQL injection | ' then '' | One breaks, two repair - that is the parser talking |
| SSTI | {{7*7}} | The response contains 49 |
| XSS | '"><svg onload=1> | The characters survive unescaped into the HTML |
| Command injection | ;sleep 5 | The response takes five seconds longer |
| SSRF | A URL you control | Your listener receives a request |
SSTI: identify the engine first
{{7*7}} returning 49 tells you a template engine evaluated it, but Jinja2, Twig, Freemarker, and Velocity all need different escape chains to reach code execution. {{7*'7'}} disambiguates: Jinja2 returns 7777777 (Python string repetition), Twig returns 49. Getting the engine right first saves trying twenty payloads that could never have worked.
Part of a module
6. Web attacks and session tokens
Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.
Practise on real challenges
Related tools
HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
URL decoder and encoder
Percent-decode and encode URL components, including double-encoded payloads and `+`-as-space form encoding.
Reverse shell generator
Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.
HTTP security header analyzer
Analyse CSP, HSTS, X-Frame-Options, and CORS headers on a response - and find the gaps in a Content-Security-Policy that make XSS exploitable.