OWASP Hunting

Repository Structure

Detailed explanation of the OWASP Hunting repository directory layout.

Repository Structure

The OWASP Hunting repository uses a flat directory structure. Each vulnerability category is a top-level directory containing a README and a payload file.

Root Level


bash
owasp-hunting/
├── Authentication-Bypass/
├── Business-Logic/
├── Command-Injection/
├── CONTRIBUTING.md
├── CONTRIBUTORS.md
├── CORS-Misconfiguration/
├── CSV-Injection/
├── Deserialization/
├── DISCLAIMER.md
├── File-Upload/
├── HTTP-Request-Smuggling/
├── IDOR/
├── JWT-Vulnerabilities/
├── LDAP-Injection/
├── LICENSE
├── Log-Injection/
├── NoSQL-Injection/
├── Open-Redirect/
├── Password-Reset/
├── Path-Traversal/
├── Prompt-Injection/
├── Prototype-Pollution/
├── README.md
├── SECURITY.md
├── SQL-Injection/
├── SSJI/
├── SSRF/
├── SSTI/
├── Security-Misconfiguration/
├── Symbolic-Link-Attacks/
├── Timing-Attacks/
├── Tor-Based-Attacks/
├── Vulnerable-Components/
├── Weak-Cryptography/
├── Weak-Passwords/
├── XML-Injection/
├── XSS/
└── scripts/


Category Directory Structure

Every vulnerability category follows the same pattern:

bash
Category-Name/
├── README.md           # Overview, vectors, testing approach
└── category-payloads.txt  # Payload list


Some categories have multiple payload files:

bash
Security-Misconfiguration/
├── README.md
├── default-credentials-payloads.txt
└── misconfiguration-paths-payloads.txt


Root Files

| File | Purpose |
|---|---|
| README.md | Project overview and category index |
| CONTRIBUTING.md | Contribution guidelines |
| CONTRIBUTORS.md | Automatically maintained contributors list |
| DISCLAIMER.md | Legal disclaimer for responsible use |
| SECURITY.md | Security policy for the project itself |
| LICENSE | MIT License |

Automation

The scripts/ directory contains:

| Script | Purpose |
|---|---|
| check_duplicates.py | Validates that no duplicate payloads exist across files |

GitHub Actions workflows in .github/workflows/ handle:

  • Contributor recognition (auto-updating CONTRIBUTORS.md)

  • Duplicate payload detection on pull requests

  • Advisory and Discord notifications


Payload File Conventions

Payload files follow these conventions:

  • Plain UTF-8 text, one payload per line

  • Comment blocks prefixed with # describe the technique

  • Blank lines separate logical sections

  • No trailing whitespace on payload lines

  • Payloads are not URL-encoded unless encoding is the point of the test