← all datasets
from the project README
◆ Vulnerable targets & payloads
PayloadsAllTheThings
MITPayloads and bypasses for web application testing, organised by vulnerability class — standard input for testing WAFs and DAST scanners.
Summary
A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques! You can also contribute with a :beers: IRL, or using the sponsor button.
- Formats
txt- License
- MIT
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ git clone --depth 1 https://github.com/swisskyrepo/PayloadsAllTheThings
Shallow clone: history isn’t needed for testing.
Contents
452 files 22.8 MB repository
-
.md142 -
.txt67 -
.png37 -
.jpg27 -
.svg18 -
.xsl15 -
(no ext)14 -
.php14
Use it with
Commands are curated, not yet run by us.
ffuf — Fuzz a test target's paths with one of the collection's wordlists.
$ ffuf -u http://127.0.0.1:3000/FUZZ -w ./PayloadsAllTheThings/Discovery/Web-Content/common.txt