🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

hashcat.launcher is a cross-platform app that run and control hashcat

A Chrome/Firefox browser extension to show alerts for reflected query params, show Wayback archive links for the current path, show hidden elements and enable disabled elements.

Scope gathering tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi!

Finding XSS during recon

Tool for scope management

A community-powered collection of all known bug bounty platforms, vulnerability disclosure platforms, and crowdsourced security platforms currently active on the Internet.

A websocket-based reverse (javascript) shell for XSS attacks.

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

EarlyBird is a sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more.

Protects the Web Server (Apache) against web fuzzing and brute forcing of files and directories

Session Hijacking Visual Exploitation

XSS payloads designed to turn alert(1) into P1

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static a…

HVNC for Cobalt Strike

This extension will help you to detect GET/POST based XSS vulnerability in any website easily

The EXCLUSIVE Collection of 38,000+ Nuclei templates based on Wordfence intel. Daily updates for bulletproof WordPress security.

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

A Modern Framework for Bug Bounty Hunting

Tool to look for several security related Android application vulnerabilities

Webshell && Backdoor Collection

The Deepfake Offensive Toolkit

Tricks for penetration testing

List of Google Dorks for sites that have responsible disclosure program / bug bounty program

CTF framework and exploit development library

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me