Contributing to OWASP Hunting

Types of Contributions

• New Payloads — Add payloads to existing vulnerability categories
• New Categories — Propose and create new vulnerability classes
• Documentation — Improve README files and category descriptions
• Bug Fixes — Correct errors in existing payloads or documentation
• Organization — Improve structure and consistency

Contribution Guidelines

• Quality over quantity — Well-documented, tested payloads over raw dumps
• Clear documentation — Each payload should be clearly explained in context
• Proper attribution — Credit original sources where applicable
• Educational focus — Include context about attack vectors and testing scenarios
• Legal compliance — All content must comply with applicable laws

Adding New Payloads

Identify the existing category that fits your payload, check for duplicates, then follow the formatting style of existing payload files.

Payload file format:

# Section Name
payload_1
payload_2
payload_3

# Another Section
# Comment explaining complex payload
another_payload

Creating New Categories

Create a new category when:

• The vulnerability type doesn’t fit existing categories
• There’s substantial content (15+ unique payloads)
• The category represents a distinct attack vector

Required structure:

New-Category/
├── README.md
└── new-category-payloads.txt

Submission Process

1. Fork the upstream repository

git clone https://github.com/owasp/owasp-hunting.git
cd owasp-hunting

2. Create a branch

git checkout -b add-xss-payloads
# or
git checkout -b new-category-api-injection

3. Commit your changes

git add .
git commit -m "Add DOM-based XSS payloads for event handler contexts"
git push origin add-xss-payloads

4. Open a Pull Request

On GitHub, open a PR to the upstream repository with:

• A clear, descriptive title
• Description of what you’re adding and why it’s valuable
• Note if you’ve tested the payloads
• References to any relevant sources or documentation

Quality Standards

Before submitting, verify:

• Payloads are properly formatted
• No duplicates exist
• Documentation is clear and accurate
• Follows existing structure and conventions
• No personal or sensitive information included
• Content is legal, ethical, and educational

Code of Conduct

• Be ethical — All contributions must be for legitimate purposes
• Be respectful — Treat all contributors professionally
• Be accurate — Verify payloads and techniques where possible