This project aims to provide a comprehensive resource for understanding and testing Cross-Site Scripting (XSS) vulnerabilities, one of the OWASP Top 10 security risks. It is designed to be a useful resource for security researchers, penetration testers, and developers.
☆204Jan 10, 2026Updated 9 months ago
Alternatives and similar repositories for xss-payload-list
Users that are interested in xss-payload-list are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- The primary goal of this project is to explain SQL Injection (one of the OWASP Top 10 vulnerabilities) and to provide a beneficial resour…☆155Jan 10, 2026Updated 9 months ago
- SSTI – Advanced / Polyglot Payloads☆39Jan 24, 2026Updated 9 months ago
- Joomla! Core 1.5.0 - 3.9.4 - Directory Traversal / Authenticated Arbitrary File Deletion in Python3☆34Feb 27, 2023Updated 3 years ago
- PowerShell-based security assessment script by cube0x0 for Windows and Active Directory environments.☆21Dec 22, 2025Updated 10 months ago
- ☆76Sep 15, 2026Updated last month
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- GitLab User Enumeration☆75Jan 3, 2025Updated last year
- A simple splunk package for obtaining reverse shells on both Windows and most *nix systems.☆173Aug 20, 2018Updated 8 years ago
- This script will bruteforce the credential of tomcat manager or host-manager☆41Jun 24, 2020Updated 6 years ago
- Joomla login bruteforce☆140Jul 18, 2024Updated 2 years ago
- C# implementation of harmj0y's PowerView☆62Mar 22, 2020Updated 6 years ago
- Vodafone EasyBox default wps pin algorithm☆14Sep 20, 2014Updated 12 years ago
- ☆223Jan 12, 2026Updated 9 months ago
- This Burp plugin allow copy all authentication headers by one click☆13Mar 23, 2026Updated 7 months ago
- A semi-interactive PHP shell compressed into a single file.☆1,115Feb 14, 2018Updated 8 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- WAF Bypass Payload List☆19Jan 10, 2026Updated 9 months ago
- my active recon and vulnerability scanner framework☆12Jul 13, 2026Updated 3 months ago
- ☆14Jun 3, 2024Updated 2 years ago
- InQL - A Burp Extension for GraphQL Security Testing☆65Feb 16, 2026Updated 8 months ago
- eJPTv2 Essentials: Notes & Machines to crush the eJPTv2 Exam.☆69Sep 1, 2025Updated last year
- Write-ups and notes for Hack The Box Academy modules☆21Mar 17, 2024Updated 2 years ago
- Username tools for penetration testing☆1,493Sep 20, 2024Updated 2 years ago
- WiFi Scanner and Default WPS PIN Generator for Livebox 2.1 and Lievbox Next from Orange (Spain)☆26Oct 5, 2021Updated 5 years ago
- Username guessing tool primarily for use against the default Solaris SMTP service. Can use either EXPN, VRFY or RCPT TO.☆180Apr 20, 2022Updated 4 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Tool to parse the Group Policy Preferences XML file which extracts the username and decrypts the cpassword attribute.☆221Oct 11, 2026Updated 2 weeks ago
- This repo contains scripts to query dehashed.com and crack the returned hashes which will then save all cleartext passwords and hashes to…☆219Oct 17, 2024Updated 2 years ago
- A list of interesting payloads, tips and tricks for bug bounty hunters.☆23Jul 8, 2024Updated 2 years ago
- Command Injection Payload List☆116Jan 18, 2026Updated 9 months ago
- A free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan.☆267Aug 1, 2023Updated 3 years ago
- Drupal < 7.58 - Drupalgeddon 3 Authenticated Remote Code Execution (Metasploit)☆43May 1, 2018Updated 8 years ago
- Claude Code plugin for writing triager-grade bug bounty reports☆354Aug 25, 2026Updated 2 months ago
- A Tool for Domain Flyovers☆139Nov 20, 2024Updated last year
- ADCS abuser☆325Feb 6, 2023Updated 3 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Loads a custom dll in system32 via diaghub.☆91Mar 16, 2020Updated 6 years ago
- Extracts Key Values from .keytab files☆385Aug 26, 2020Updated 6 years ago
- Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications…☆1,476Sep 5, 2026Updated last month
- Blind WAF identification tool☆758Sep 10, 2026Updated last month
- ☆344Jan 7, 2015Updated 11 years ago
- Wordlists for creating statistically likely username lists for use in password attacks and security testing. Used for pentesting for over…☆1,431Feb 16, 2026Updated 8 months ago
- A unique automated LFi Exploiter with Bind/Reverse Shells☆321Jul 11, 2026Updated 3 months ago