payloadsallthethings-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 61 files.

• account-takeover

  Account takeover techniques via password reset poisoning, OAuth flaws, and session manipulation. Use for auth testing.

  payloadsallthethings/skills/account-takeover/SKILL.md on GitHub (opens in a new tab)

• api-key-leaks

  Detect and validate leaked API keys, tokens, and credentials. Use when finding exposed secrets in code, logs, or repositories.

  payloadsallthethings/skills/api-key-leaks/SKILL.md on GitHub (opens in a new tab)

• brute-force

  Brute force and rate limit bypass techniques for authentication testing. Use when testing login security.

  payloadsallthethings/skills/brute-force/SKILL.md on GitHub (opens in a new tab)

• business-logic

  Business logic vulnerability testing - price manipulation, workflow bypass, privilege escalation. Use for logic flaw hunting.

  payloadsallthethings/skills/business-logic/SKILL.md on GitHub (opens in a new tab)

• clickjacking

  Clickjacking and UI redressing attacks with frame busting bypass. Use when testing X-Frame-Options.

  payloadsallthethings/skills/clickjacking/SKILL.md on GitHub (opens in a new tab)

• client-path-traversal

  Client-side path traversal techniques for browser-based file access. Use for client-side security testing.

  payloadsallthethings/skills/client-path-traversal/SKILL.md on GitHub (opens in a new tab)

• command-injection

  OS command injection with space bypass, filter evasion, blind detection. Use when testing system command execution.

  payloadsallthethings/skills/command-injection/SKILL.md on GitHub (opens in a new tab)

• cors

  CORS misconfiguration exploitation - origin reflection, null origin, regex bypass. Use when testing cross-origin policies.

  payloadsallthethings/skills/cors/SKILL.md on GitHub (opens in a new tab)

• crlf

  CRLF injection for header manipulation, response splitting, and session fixation. Use for HTTP header testing.

  payloadsallthethings/skills/crlf/SKILL.md on GitHub (opens in a new tab)

• csrf

  Cross-Site Request Forgery exploitation with token bypass and SameSite cookie evasion. Use for CSRF testing.

  payloadsallthethings/skills/csrf/SKILL.md on GitHub (opens in a new tab)

• csv-injection

  CSV/spreadsheet injection with formula payloads for Excel, Google Sheets. Use when testing export functionality.

  payloadsallthethings/skills/csv-injection/SKILL.md on GitHub (opens in a new tab)

• cve-exploits

  Common CVE exploitation techniques and known vulnerability payloads. Use for known vulnerability testing.

  payloadsallthethings/skills/cve-exploits/SKILL.md on GitHub (opens in a new tab)

• dependency-confusion

  Dependency confusion and supply chain attacks via package managers. Use for supply chain security testing.

  payloadsallthethings/skills/dependency-confusion/SKILL.md on GitHub (opens in a new tab)

• deserialization

  Insecure deserialization for Java, PHP, Python, .NET, Ruby with gadget chains. Use for serialization testing.

  payloadsallthethings/skills/deserialization/SKILL.md on GitHub (opens in a new tab)

• dns-rebinding

  DNS rebinding attacks for same-origin policy bypass. Use when testing internal service access.

  payloadsallthethings/skills/dns-rebinding/SKILL.md on GitHub (opens in a new tab)

• dom-clobbering

  DOM clobbering techniques for JavaScript variable overwriting via HTML injection. Use for DOM security testing.

  payloadsallthethings/skills/dom-clobbering/SKILL.md on GitHub (opens in a new tab)

• dos

  Denial of Service techniques - ReDoS, resource exhaustion, algorithmic complexity. Use for availability testing.

  payloadsallthethings/skills/dos/SKILL.md on GitHub (opens in a new tab)

• encoding

  Encoding transformation techniques - URL, Unicode, Base64 for filter bypass. Use for WAF evasion.

  payloadsallthethings/skills/encoding/SKILL.md on GitHub (opens in a new tab)

• external-variable

  External variable modification and parameter tampering techniques. Use for input validation testing.

  payloadsallthethings/skills/external-variable/SKILL.md on GitHub (opens in a new tab)

• file-upload

  File upload bypass - extension, content-type, magic bytes, polyglot files. Use for upload security testing.

  payloadsallthethings/skills/file-upload/SKILL.md on GitHub (opens in a new tab)

• graphql

  GraphQL injection, introspection abuse, batching attacks, and authorization bypass. Use for GraphQL API testing.

  payloadsallthethings/skills/graphql/SKILL.md on GitHub (opens in a new tab)

• gwt

  Google Web Toolkit security testing and deserialization attacks. Use when testing GWT applications.

  payloadsallthethings/skills/gwt/SKILL.md on GitHub (opens in a new tab)

• headless-browser

  Headless browser exploitation and Chrome DevTools Protocol attacks. Use for browser automation testing.

  payloadsallthethings/skills/headless-browser/SKILL.md on GitHub (opens in a new tab)

• hidden-params

  Hidden parameter discovery and exploitation techniques. Use for parameter fuzzing and enumeration.

  payloadsallthethings/skills/hidden-params/SKILL.md on GitHub (opens in a new tab)

• hpp

  HTTP Parameter Pollution for server-side and client-side exploitation. Use when testing parameter handling.

  payloadsallthethings/skills/hpp/SKILL.md on GitHub (opens in a new tab)

• idor

  Insecure Direct Object Reference exploitation for authorization bypass. Use when testing access controls.

  payloadsallthethings/skills/idor/SKILL.md on GitHub (opens in a new tab)

• java-rmi

  Java RMI exploitation and deserialization attacks. Use when testing Java RMI services.

  payloadsallthethings/skills/java-rmi/SKILL.md on GitHub (opens in a new tab)

• jwt

  JWT attacks - none algorithm, key confusion, brute force, header injection. Use for JWT security testing.

  payloadsallthethings/skills/jwt/SKILL.md on GitHub (opens in a new tab)

• latex

  LaTeX injection for file read, command execution, and XSS. Use when testing LaTeX/PDF generation.

  payloadsallthethings/skills/latex/SKILL.md on GitHub (opens in a new tab)

• ldap

  LDAP injection for authentication bypass and data extraction. Use when testing LDAP integration.

  payloadsallthethings/skills/ldap/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 431k stars · 5 skills
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 297k stars · 30 skills
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 230k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 185k stars · 6 skills
• difyby langgenius Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-h… 160k stars
• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 145k stars · 7 skills