Arsenly
Tools
Free Tools
Pricing
Resources
Sign in Get started
← All tools

Payload Lists

Payloads & Wordlists

26 vulnerability classes, 140+ sections, 700+ curated payloads - copy a single string or download a whole category as a fuzz list.

What is Payload Lists?

Payload Lists is a hand-picked reference of battle-tested payloads organised into 26 vulnerability classes and 140+ named sections, totalling over 700 curated strings. Each category opens with its severity rating and a one-line description; sections inside group the patterns by what they actually do (auth bypass, error-based, blind, WAF bypass, etc.) so finding the right payload is a few clicks instead of grep-ing a 5000-line dump.

Coverage spans the full modern web-app attack surface: injection (XSS / SQLi / NoSQLi / OS-Command / SSTI / LFI / RFI / XXE), SSRF (incl. cloud-metadata for AWS / GCP / Azure / Alibaba / DigitalOcean / Oracle), CRLF & HTTP header attacks (Host header, auth-bypass headers, method override), open redirect bypasses, CORS, file-upload tricks (extension, MIME, magic-byte polyglots, .htaccess weaponisation), JWT (alg=none, weak HS256 secrets, kid traversal, jku / x5u injection, RS-to-HS key confusion), GraphQL (introspection, field suggestion, batching DoS), prototype pollution, deserialization markers (PHP / Java / Python / .NET), HTTP request smuggling (CL.TE / TE.CL / TE.TE), CSV / formula injection (Excel / Google Sheets / LibreOffice), LDAP injection, OAuth misuse, subdomain-takeover fingerprints, and a WAF-evasion grab-bag.

Every payload renders with HTML escaping, lives behind a one-click copy button, and can be downloaded as a category-scoped .txt fuzz list or the complete dataset as .json. A case-insensitive cross-section filter lets you narrow to a specific keyword across an entire category in real time.

What it includes

  • Injection - XSS (9 sections incl. event handlers, SVG, polyglots, AngularJS sandbox bypass, CSP bypass), SQLi (10 sections covering auth bypass, error-based on MySQL/PostgreSQL/MSSQL/Oracle, UNION, blind boolean, blind time-based, stacked queries, WAF bypass), NoSQLi (operator/$where/type-coercion), Command Injection (Linux/Windows/blind-OOB/filter bypass/reverse shells), LFI & RFI (PHP wrappers, encoding bypasses, log poisoning), SSTI (Jinja2, Twig, Freemarker, Velocity, ERB, Smarty, Mako).
  • SSRF - loopback & IP encodings (octal, decimal, hex, IPv6), full cloud-metadata sets (AWS / GCP / Azure / Alibaba / DigitalOcean / Oracle / OpenStack / Rancher / K8s), protocol smuggling (gopher, dict, file, ftp, ldap, tftp, jar) and URL-parser confusion tricks.
  • Auth & session - default credential pairs, login SQLi/NoSQLi, header-based bypass, common admin paths, 2FA bypass patterns, OAuth redirect_uri tampering, state-CSRF and PKCE downgrade.
  • JWT & tokens - alg=none, weak HS256 secrets to crack with hashcat -m 16500, kid file-traversal / SQLi / cmdi, jku & x5u header injection, RS-to-HS algorithm confusion notes.
  • Modern injection - Prototype pollution (JSON / qs / client gadgets / server-RCE), CSV / formula injection (Excel cmd, Google Sheets IMPORTXML, LibreOffice DDE), LDAP injection (auth bypass, AD filters).
  • Network & smuggling - HTTP request smuggling (CL.TE / TE.CL / TE.TE / HTTP/2 downgrade), CRLF response splitting, CORS misconfig probes, deserialization format markers (PHP O:n:, Java rO0AB, Python pickle, .NET ViewState).
  • File upload - extension tricks (.php.jpg, .phar, null-byte, .htaccess weaponisation), MIME bypass, magic-byte polyglots, path traversal in filename.
  • Subdomain takeover fingerprints - body strings for AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, Tumblr, WordPress.com, Surge.sh, Netlify, Bitbucket, Pantheon, Zendesk, Readme.io and more.
  • WAF / filter bypass - case + comment splits, URL / double encoding, whitespace alternatives, HTML entity decoding, JS string obfuscation, content-type tricks, HTTP parameter pollution, padding / oversized inputs.
  • One-click copy - copy a single payload, a whole section, or a whole category - or download the category as .txt and the entire library as .json.
  • Live filter - type a keyword and every section + payload in the current category narrows in real time, with section-by-section count badges.

Where it fits in your workflow

  • Pull a reliable payload mid-test without leaving the suite - auth-bypass SQLi, an SSTI for Jinja2, a cloud-metadata URL.
  • Build a quick fuzz list - download a whole category as .txt and feed it to ffuf with -w.
  • Pair with Payload Generator for context-encoded variants and Command Builder for the exact ffuf / sqlmap / curl invocation that drives the payload.
  • Use the Subdomain Takeover fingerprints alongside DNS Recon Pro / Subdomain Discovery to identify dangling-CNAME services ripe for takeover.
Use Payload Lists

Sign in to access this tool.

Create free account Sign in

At a glance

CategoryPayloads & Wordlists
RunsIn your browser
Token cost Free - no tokens
Access Free
Status● Live

Frequently asked questions

Is the data updated?

Yes - the library is curated for high-signal, broadly-effective payloads. We focus on patterns that work in 2025+ engagements: modern SSTI engines, recent SSRF metadata endpoints, current cloud-provider IPs, current JWT abuse patterns, current takeover fingerprints.

How is this different from Payload Generator?

Payload Lists is a static, curated reference - "give me a known-good string". Payload Generator builds context-aware variants - "give me 50 polyglots with this OOB marker base64-encoded". Use Lists for the quick grab; use Generator when you need a specific shape.

Does anything get sent to the server when I copy a payload?

No. The dataset is fetched once on load; everything after that - filtering, copying, downloading - runs client-side. Your interaction with specific payloads is never logged.

Is everything safe to use against any target?

No. Many payloads (sqlmap stacked-query drops, .htaccess weaponisation, RCE chains, deserialization gadget markers) can cause real damage. Use only on systems you have explicit, documented authorisation to test - bug-bounty scope or a signed pentest agreement.

Explore more tools →