PayloadsAllTheThings
A community-maintained collection of web security attack payloads and filter bypass examples, organized by vul
- Stars
- 82.3k
- Forks
- 17.6k
- Licence
- MIT
- Language
- Python
- Last update
- 6 days ago
- Type
- Curated list
What it is
PayloadsAllTheThings is a large set of Markdown documents, one folder per vulnerability topic, that list example payloads and techniques for bypassing protections in web applications. Each section describes a vulnerability, how it can be exploited, and sample inputs, and some sections include files for Burp Intruder. It is mainly a reference that security testers and learners consult while working on web security tasks.
- Look up example payloads for SQL injection, XSS, or other web vulnerability topics
- Load the provided Intruder files into Burp Intruder for fuzzing a test target you are authorized to assess
- Read the vulnerability description and methodology in a section to understand how an attack works
- Use the _template_vuln folder as a starting point for writing a new chapter
Great for
- Penetration testers who want a quick reference of payload variations for a known vulnerability class
- Students learning how common web vulnerabilities are exploited
- CTF players looking for alternative payload syntax when a standard one is blocked
- Security engineers building test cases for input filters or web application firewalls
Not ideal for
- Complete beginners who need step-by-step guided lessons, since the README is a reference list rather than a course
- Anyone looking for an automated scanner, because the project provides payloads to read or copy, not a tool that runs tests
- People testing systems they do not have permission to test, since the payloads are offensive material
How to get it
- 1
Clone and build from source
Clone the repository
git clone https://github.com/swisskyrepo/PayloadsAllTheThings - 2
Run it
- Clone the repository or open the homepage at https://swisskyrepo.github.io/PayloadsAllTheThings/
- Open the folder for the vulnerability you are studying
- Read the README.md in that folder for the description and payload examples
- Use the Intruder files in that folder with Burp Intruder on an authorized test target if needed
- 3
Get the most out of it
- Use the online display version at the project homepage for easier browsing
- Check the Books and YouTube selections linked in the README for further learning
- Read CONTRIBUTING.md if you want to add or correct a section
- Use the _template_vuln folder to structure your own notes in the same format
Downloads
Strengths
- Broad, long-running collection with a consistent per-topic structure of README, Intruder, Images, and Files
- Very popular, with a large contributor base and an active repository
- Free and open source under the MIT license
Trade-offs
- It is a collection of text and files, not software, so it does not test anything on its own and has no release binaries
- Quality and depth vary by section, and the README provided here is truncated so not every section could be assessed
- Payloads are offensive material, so responsible use and authorization are the user's responsibility
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| PayloadsAllTheThings (this) | 82.3k | Curated list | beginner | 6 days ago | Penetration testers who want a quick reference of payload variations for a known vulnerability class |
| SecLists | 74.5k | Learning resource | beginner | 4 days ago | Penetration testers who need standard lists for password or directory guessing |
| h4cker | 30k | Curated list | beginner | 14 days ago | Students looking for a structured starting point in cybersecurity |
| hacker-roadmap | 15.7k | Curated list | beginner | 3.1 years ago | Beginners who want an overview of penetration testing concepts and vocabulary |
| awesome-hacker-search-engines | 11.5k | Curated list | beginner | 4 days ago | Security professionals starting a penetration test or vulnerability assessment who need a place to look up data |
| nginx-admins-handbook | 14.3k | Learning resource | beginner | 2.0 years ago | System administrators who already run NGINX and want practical tips |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.