{"full_name":"swisskyrepo/PayloadsAllTheThings","owner":"swisskyrepo","name":"PayloadsAllTheThings","url":"https://github.com/swisskyrepo/PayloadsAllTheThings","description":"A list of useful payloads and bypass for Web Application Security and Pentest/CTF","homepage":"https://swisskyrepo.github.io/PayloadsAllTheThings/","topics":[],"language":"Python","license":"MIT","avatar":"https://avatars.githubusercontent.com/u/12152583?u=e368c891b81d41b1ce12825f52049e5eb146d401&v=4","created_at":"2016-10-18T07:29:07Z","pushed_at":"2026-10-30T15:58:03Z","metrics":{"stars":82552,"forks":17576,"watchers":1976,"issues":0,"prs":770,"releases":5,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":0},"growth":{"day":{"stars":35,"forks":5,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[82517,82552],"forks":[17571,17576],"watchers":[1976,1976],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[],"discussions":[],"latest_release":{"name":"2025.1 - PayloadsAllTheThings - FERRETEDITOR","tag":"4.2","published_at":"2025-07-26T20:28:58Z","body":"This update brings significant new content, including dedicated pages for new vulnerability classes, fresh exploitation techniques for existing topics, and numerous quality-of-life improvements across the knowledge base.\r\n\r\n## 📚 New Vulnerability Pages\r\n\r\n* **External Variable Modification**: Complete new section covering PHP `extract()` function vulnerabilities, variable pollution, and security implications\r\n* **Reverse Proxy Misconfigurations**: Covering common Nginx misconfigurations.\r\n\r\n## 🔄 Enhanced Sections\r\n\r\n- **Command Injection**: \r\n  - Added worstfit technique for argument injection\r\n  - Enhanced with fullwidth character bypass methods\r\n- **CSV Injection**: \r\n  - New Google Sheets exploitation section\r\n  - Added formulas like IMPORTXML, IMPORTRANGE for data exfiltration\r\n  - Enhanced with remote resource access techniques\r\n- **File Inclusion**: \r\n  - New lightyear tool for blind file read primitives\r\n  - Enhanced PHP filter exploitation techniques\r\n\r\n- **Headless Browser**: \r\n  - New CVE exploitation section\r\n  - Enhanced debugging port security implications\r\n  - Added insecure flags and PDF rendering attack vectors\r\n- **Java Deserialization**: \r\n  - Comprehensive JSON deserialization section (Jackson etc)\r\n  - Enhanced with multiple attack vectors and exploitation techniques\r\n- **SQL Injection**:\r\n  - New PDO Prepared Statements section\r\n\r\n## 🐛 Bug Fixes & Corrections\r\n\r\n- Fixed numerous formatting inconsistencies\r\n- Corrected broken internal links\r\n- Updated deprecated tool references\r\n- Standardized code block formatting\r\n- Standardized bullet points and list formatting across all sections\r\n- Automated markdown linting detection now runs on all pull requests and commits.\r\n\r\n\r\n## 🌐 What's Changed\r\n* csv injection: google sheets formulas by @noraj in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/759\r\n* Update YOUTUBE.md by @Tednoob17 in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/765\r\n* Add missing -r flag for xxe excel file rebuilding with zip command by @sehraramiz in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/768\r\n* Fix extra parentheses in MySQL Injection.md by @DoongPark in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/769\r\n* FIX broken link by @Diebbo in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/772\r\n* Add support for `||` (concatenation) operator in PostgreSQL for time based SQL injection by @florianamette in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/779\r\n* Update README.md by @stenzzor in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/781\r\n\r\n## 👌New Contributors\r\n* @Tednoob17 made their first contribution in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/765\r\n* @sehraramiz made their first contribution in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/768\r\n* @DoongPark made their first contribution in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/769\r\n* @Diebbo made their first contribution in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/772\r\n* @florianamette made their first contribution in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/779\r\n* @stenzzor made their first contribution in https://github.com/swisskyrepo/PayloadsAllTheThings/pull/781\r\n\r\n**Full Changelog**: https://github.com/swisskyrepo/PayloadsAllTheThings/compare/4.1...4.2"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}