Installation

How to clone and use the OWASP Hunting repository locally.

Installation

OWASP Hunting is a flat-file repository. There is no installation process in the traditional sense — you clone the repository and navigate its directory structure directly.

Cloning the Upstream Repository

The canonical source is the OWASP upstream repository:

bash

git clone https://github.com/owasp/owasp-hunting.git
cd owasp-hunting

Cloning the Fork

An actively maintained fork is available at:

bash

git clone https://github.com/0x5t4l1n/owasp-hunting.git
cd hunting

> The upstream OWASP repository is the canonical source. The fork may contain additional content or experimental changes not yet merged upstream.

Directory Layout

After cloning, the repository root contains one directory per vulnerability category:

bash

hunting/
├── SQL-Injection/
│   ├── README.md
│   └── sql-injection-payloads.txt
├── XSS/
│   ├── README.md
│   └── xss-payloads.txt
├── Command-Injection/
│   ├── README.md
│   └── command-injection-payloads.txt
├── SSRF/
│   ├── README.md
│   └── ssrf-payloads.txt
...
├── CONTRIBUTING.md
├── DISCLAIMER.md
├── LICENSE
└── README.md

Each category directory follows the same convention:

| File | Purpose |
|---|---|
| README.md | Description, attack vectors, testing methodology |
| *-payloads.txt | The payload list, organized by technique |

Keeping Up to Date

To pull the latest upstream changes:

bash

# If cloned from upstream
git pull origin main

# If cloned from the fork and you want upstream changes
git remote add upstream https://github.com/owasp/owasp-hunting.git
git fetch upstream
git merge upstream/main

No Build Step Required

Payload files are plain text. You can use them directly with:

Burp Suite Intruder — load a payload file as a wordlist

ffuf / wfuzz — reference the payload file with -w

Manual testing — copy individual payloads from this documentation site