PayloadsAllTheThings: a knowledge base organised by web vulnerability class

PayloadsAllTheThings (about 82,000 stars on GitHub) is one of the most popular security repositories on GitHub. It was created in 2016 by Swissky and is maintained with a large group of contributors. The repository is structured as one directory per vulnerability class, with a README in each: injection flaws of various kinds, authentication and session weaknesses, file handling problems, server-side and client-side request issues, access control mistakes, and many more. A separate section covers methodology and the structure of a professional assessment, and the project also publishes the material as a website at swisskyrepo.github.io/PayloadsAllTheThings.

Who it is for

• Application security teams who need a shared vocabulary for weaknesses found in reviews and a quick way to explain a finding to developers.
• Developers who want to understand why a class of bug matters and what the recommended fix looks like; each section links to references such as the OWASP guides and vendor advisories.
• Defenders and detection engineers who want to know what an attempt against a given weakness looks like so they can write monitoring for it.
• Authorised testers, bug bounty hunters working within a programme’s scope, and CTF players, for whom it serves as a structured checklist.

How to browse it

Start from the top-level README, which lists every section, or from the website, which has a search box. Each section follows a similar outline, so once you have read one the rest are easy to navigate. The repository is updated continuously; watch it on GitHub or follow the project’s changelog if you want to see new sections as they appear. Contributions go through pull requests and the maintainers keep a contribution guide and a template for new sections.

Credit

PayloadsAllTheThings is maintained by Swissky and the contributors listed in the repository. It is published under the MIT license.

Use it responsibly

Material of this kind is meant for systems you own or have written permission to test, for bug bounty programmes within their published scope, and for training labs and capture-the-flag (CTF) exercises. Unauthorised testing of other people’s systems is illegal in most countries, regardless of intent, and the maintainers of these projects say so in their own terms. Defenders can use the same material to check their own environments and to understand what their detection rules should catch.