OWASP Hunting

About OWASP Hunting

A comprehensive collection of security testing resources and payloads for authorized security testing.

Project Overview

OWASP Hunting is an open-source security testing reference covering over 30 vulnerability classes. It provides curated payloads, testing methodology, and documentation for security professionals conducting authorized assessments.

The project is organized by vulnerability type, with each category containing a README explaining the attack vector, testing approach, and a payload file for use in authorized testing environments.

Repository

The canonical source is the upstream OWASP Hunting repository. This documentation site is derived from that repository and is not operated by OWASP directly.

Upstream Repository

Canonical OWASP project — the authoritative source

Development Fork

Active development fork and contributions

Purpose

OWASP Hunting serves as a reference for security professionals to:

  • Test web applications for common vulnerability classes
  • Learn about different attack vectors and techniques
  • Prepare for authorized bug bounty hunting
  • Conduct structured penetration testing
  • Understand security risks and their mitigations

Coverage

The project covers vulnerability classes across six categories:

  • Injection — SQL, NoSQL, XSS, Command, SSTI, SSJI, CSV, LDAP, Log, XML, Prompt, Prototype Pollution
  • Access Control — Path Traversal, IDOR, Open Redirect
  • Authentication & Authorization — Auth Bypass, Password Reset, Weak Passwords
  • Server-Side — SSRF, Deserialization, File Upload, Symbolic Link, Timing Attacks
  • Configuration & Design — Misconfiguration, CORS, HTTP Smuggling, JWT, Business Logic, Crypto, Vulnerable Components
  • Network & Anonymity — Tor-Based Attacks

License

OWASP Hunting is released under the MIT License. While the repository is open source, all content is for educational and authorized testing purposes only. See the project disclaimer before use.

Responsible Use

For authorized testing only

All payloads and techniques are for use on systems you own, authorized penetration testing engagements, approved bug bounty programs, and controlled educational environments. Unauthorized access to computer systems is illegal. The project maintainers are not responsible for misuse.