26 vulnerability classes, 140+ sections, 700+ curated payloads - copy a single string or download a whole category as a fuzz list.
Payload Lists is a hand-picked reference of battle-tested payloads organised into 26 vulnerability classes and 140+ named sections, totalling over 700 curated strings. Each category opens with its severity rating and a one-line description; sections inside group the patterns by what they actually do (auth bypass, error-based, blind, WAF bypass, etc.) so finding the right payload is a few clicks instead of grep-ing a 5000-line dump.
Coverage spans the full modern web-app attack surface: injection (XSS / SQLi / NoSQLi / OS-Command / SSTI / LFI / RFI / XXE), SSRF (incl. cloud-metadata for AWS / GCP / Azure / Alibaba / DigitalOcean / Oracle), CRLF & HTTP header attacks (Host header, auth-bypass headers, method override), open redirect bypasses, CORS, file-upload tricks (extension, MIME, magic-byte polyglots, .htaccess weaponisation), JWT (alg=none, weak HS256 secrets, kid traversal, jku / x5u injection, RS-to-HS key confusion), GraphQL (introspection, field suggestion, batching DoS), prototype pollution, deserialization markers (PHP / Java / Python / .NET), HTTP request smuggling (CL.TE / TE.CL / TE.TE), CSV / formula injection (Excel / Google Sheets / LibreOffice), LDAP injection, OAuth misuse, subdomain-takeover fingerprints, and a WAF-evasion grab-bag.
Every payload renders with HTML escaping, lives behind a one-click copy button, and can be downloaded as a category-scoped .txt fuzz list or the complete dataset as .json. A case-insensitive cross-section filter lets you narrow to a specific keyword across an entire category in real time.
.txt and the entire library as .json..txt and feed it to ffuf with -w.Yes - the library is curated for high-signal, broadly-effective payloads. We focus on patterns that work in 2025+ engagements: modern SSTI engines, recent SSRF metadata endpoints, current cloud-provider IPs, current JWT abuse patterns, current takeover fingerprints.
Payload Lists is a static, curated reference - "give me a known-good string". Payload Generator builds context-aware variants - "give me 50 polyglots with this OOB marker base64-encoded". Use Lists for the quick grab; use Generator when you need a specific shape.
No. The dataset is fetched once on load; everything after that - filtering, copying, downloading - runs client-side. Your interaction with specific payloads is never logged.
No. Many payloads (sqlmap stacked-query drops, .htaccess weaponisation, RCE chains, deserialization gadget markers) can cause real damage. Use only on systems you have explicit, documented authorisation to test - bug-bounty scope or a signed pentest agreement.