Payloads All The Things

Server-Side Request Forgery (SSRF) is a vulnerability where an attacker forces a server to perform requests on their behalf. This typically occurs when a server processes user-provided URLs or IP addresses without proper validation.

Common exploitation paths include:

• Accessing Cloud metadata (e.g., AWS EC2 metadata service).
• Leaking local files on the server.
• Network discovery and port scanning.
• Sending packets to internal services to achieve Remote Command Execution (RCE).

# Example of vulnerable code
url = input("Enter URL:")
response = requests.get(url)
return response

# Malicious input to fetch AWS metadata
http://169.254.169.254/latest/meta-data/

Payloads All The Things is a curated collection of useful payloads and bypasses specifically designed for Web Application Security testing. It serves as a reference for security researchers and penetration testers to find exploitation techniques and bypasses for various vulnerabilities.

An alternative web-based display version is available at PayloadsAllTheThingsWeb.

This section provides a summary of significant vulnerabilities from the last 15 years:

• CVE-2017-0144 (EternalBlue): Exploits SMBv1 in Microsoft Windows to allow remote code execution (RCE). Affects various Windows versions including Vista, 7, 8.1, 10, and Server 2008/2012/2016.
• CVE-2017-5638 (Apache Struts 2): RCE vulnerability allowing command injection via the Content-Type header.
• CVE-2018-7600 (Drupalgeddon 2): RCE vulnerability in Drupal 7.x and 8.x subsystems.
• CVE-2019-0708 (BlueKeep): Pre-authentication RCE in Remote Desktop Services (RDP).
• CVE-2019-19781 (Citrix ADC Netscaler): Unauthenticated RCE in Citrix ADC/Gateway (versions 10.5 through 13.0).
• CVE-2014-0160 (Heartbleed): Information disclosure vulnerability in OpenSSL allowing the theft of protected data.
• CVE-2014-6271 (Shellshock): Command injection in Unix Bash shell.

Cross-Site Request Forgery (CSRF/XSRF) attacks force authenticated users to execute unwanted state-changing actions. This guide provides various payload methodologies categorized by HTTP method (GET/POST/JSON) and interaction requirements (User Interaction vs. AutoSubmit).

Recommended Tool:

• 0xInfection/XSRFProbe: A toolkit for CSRF audit and exploitation.

SQL Injection (SQLi) is a vulnerability that allows attackers to interfere with application database queries, potentially leading to unauthorized data access or full server compromise. This repository provides specialized cheatsheets for various database management systems (DBMS):

• MSSQL Injection
• MySQL Injection
• OracleSQL Injection
• PostgreSQL Injection
• SQLite Injection
• Cassandra Injection
• DB2 Injection
• SQLmap (Automation guide)

Regular Expression Denial of Service (ReDoS) occurs when a regex pattern causes an exponential explosion of backtracking attempts when processing certain inputs, leading to application unresponsiveness or crashes.

Detection Tools

Use the following tools to identify or test for ReDoS vulnerabilities:

• tjenkinson/redos-detector: A CLI and library for testing if a regex pattern is safe. Supports Browser, Node, and Deno.
• doyensec/regexploit: Specifically designed to find regular expressions vulnerable to ReDoS.
• devina.io/redos-checker: An online tool to examine regular expressions for potential DoS vulnerabilities.

SAML (Security Assertion Markup Language) is used for exchanging authentication and authorization data between identity providers and service providers. Improper implementation can lead to various injection vulnerabilities.

Recommended Tools for Testing

• SAMLRaider: A Burp Suite extension for SAML2.
• XSW: A Burp Suite extension specifically for testing XML Signature Wrapping attacks.
• ZAP SAML Support: An add-on for OWASP ZAP that allows detecting, showing, editing, and fuzzing SAML requests.

The repository provides specific methodologies and exploitation techniques for different version control systems. Use these guides to understand how to extract data from specific SCM implementations:

• Bazaar: Methodology for Bazaar SCM.
• Git: Methodology for Git (note: data extraction can often be conducted even if directory listing is disabled, provided individual files can be read).
• Mercurial: Methodology for Mercurial SCM.
• Subversion: Methodology for SVN/Subversion.