Payloads All The Things: Web Application Security Payloads
/PayloadsAllTheThings
Payloads All The Things is a curated GitHub collection of exploitation payloads and bypass techniques for web application security, covering entries from SQL injection to XXE. It's a reference, not a tool. Reach for it when you need a starting payload for a specific vulnerability class mid-pentest or mid-CTF; skip it if you want a maintained exploitation framework instead of a static list.
Understanding Payloads All The Things
Payloads All The Things is a GitHub repository maintained by swisskyrepo that catalogs payloads and bypass techniques for web application security, penetration testing, and CTF challenges. Each vulnerability class gets its own folder with a README.md explaining the exploit and example payloads, often with a file set for Burp Intruder too. A second version, PayloadsAllTheThingsWeb, mirrors the same content for browsing without cloning the repo.
What the Collection Covers
- โPer-vulnerability folders, each with its own README.md describing the exploit and listing payload examples, matching the documentation structure the README lays out.
- โBurp Intruder file sets included alongside many entries, ready to load instead of hand-copying payload lists.
- โA _template_vuln folder that contributors use to scaffold a new vulnerability chapter, per the README.
- โRepo topics spanning bypass, enumeration, and privilege-escalation, among others, alongside the core payload lists.
- โCompanion projects from the same author: InternalAllTheThings, which covers Active Directory attack paths and internal-network pentest notes, and HardwareAllTheThings, a wiki for hardware and IoT security testing, both linked from the README's 'AllTheThings family' section.
- โA separate Books and YouTube channel selection linked from the README for readers who want longer-form material.
- โPayloadsAllTheThingsWeb, a browsable website version of the same content, for reading without cloning the repo.
Who Benefits from This Resource?
- โขPentesters who need a starting payload for a specific vulnerability class mid-engagement instead of writing one from scratch.
- โขBug bounty hunters checking whether a known bypass technique already exists for the vulnerability class they've found.
- โขCTF players who want a categorized payload reference to pull from during a timed challenge.
- โขDevelopers and AppSec engineers studying how a given attack class works, since each entry's README.md explains the exploit alongside the payloads.
- โขContributors who want to document a new payload or technique, using the _template_vuln folder as a starting structure.
Strengths
- โOrganized by vulnerability class with a consistent per-folder structure, so you know where to look for a specific exploit type.
- โBurp Intruder file sets ship alongside many payload lists, saving the step of reformatting payloads for that specific tool.
- โMIT-licensed, so payloads and structure are free to reuse in your own notes, scripts, or write-ups.
- โGitHub reflects an active contributor base feeding new entries into the repo.
- โA written CONTRIBUTING.md and a working template folder make it straightforward to submit a new payload or technique.
Considerations for Using This Resource
- โณThe README doesn't state how often individual vulnerability folders get reviewed or updated, so payload freshness likely varies by section rather than being uniform.
- โณIt's a reference to read, not software to run: there's no CLI or API, so payloads have to be copied out and adapted to your target by hand.
- โณGitHub lists Python as the repo's primary language, but the README gives no indication of an installable tool bundled with the payload lists.
- โณCoverage depth isn't documented per category, so some vulnerability classes may have far more entries and detail than others.
Related Security Collections and Resources
Frequently Asked Questions
Payloads All The Things is released under the MIT license, as listed on its GitHub repository.
Payloads All The Things covers a wide range of web application security issues, organized into per-vulnerability folders; the repo's own topics list includes bypass, enumeration, privilege-escalation, and vulnerability, among others.
Payloads All The Things accepts contributions through its CONTRIBUTING.md guidelines, and the repo includes a _template_vuln folder to scaffold a new vulnerability chapter.
Payloads All The Things does have a web-based version, PayloadsAllTheThingsWeb, browsable at swisskyrepo.github.io/PayloadsAllTheThings, mirroring the same content as the GitHub repo.
The same author maintains InternalAllTheThings, which covers Active Directory attack paths and internal-network pentest notes, and HardwareAllTheThings, a wiki for hardware and IoT security testing, per the README's 'AllTheThings family' section.
Who should try it โ and who should skip
Try Payloads All The Things if you do hands-on web application testing and want a categorized reference for payloads and bypasses during a pentest, bug bounty hunt, or CTF. Skip it if you're after an automated scanner or exploitation framework: this repository is a static collection of write-ups and payload lists, not a tool that runs anything against a target for you.
Related repositories
Is PayloadsAllTheThings worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of PayloadsAllTheThings.