domains / families / security / security-arsenal

security-arsenal

authentic

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.

When to use

• XSS payloads
• SSRF payloads
• SQLi payloads
• XXE payloads
• NoSQLi payloads
• command injection payloads
• SSTI payloads
• IDOR payloads

When not to use

• what NOT to submit

Skill page

Source