MADE WITH
PAYLOAD CMS

Tools and Techniques for Red Team / Penetration Testing

All about bug bounty (bypasses, payloads, and etc)

Awesome XSS stuff

Git All the Payloads! A collection of web attack payloads.

Generate Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON/YAML/CSV.

Python Remote Administration Tool (RAT)

CHAOS is a free and open-source Remote Administration Tool that allow generate binaries to control remote operating systems.

Penetration tests guide based on OWASP including test cases, resources and examples.

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

C++ GUI for TegraRcmSmash (Fusée Gelée exploit for Nintendo Switch)

Medusa，XSS、、CVE、、DNSLOG、、，

Java ｜A customizable Java in-memory webshell generation tool.

Java Vulnerability Exploitation Platform

RubberDucky like payloads for DigiSpark Attiny85

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

Java Web ，，

Burp Suite Certified Practitioner Exam Study

Reflective PE packer.

MSFvenom Payload Creator (MSFPC)

Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.

Payload for teensy like a rubber ducky but the syntax is different. this Human interfaes device ( HID attacks ). Penetration With Teensy. Brutal is a toolkit to quickly create various payload,powershell attack, virus attack and launch listener for a Human Interface Device ( Payload Teensy )

Athena OS is a Arch/Nix-based distro focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!

CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks

AppSec Payloads Arsenal for Pentration Tester and Bug Bounty Hunters

Infosec Wordlists and more.

Apkmod can decompile, recompile, sign APK, and bind the payload with any legit APP

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

ALL IN ONE Hacking Tool For Hackers, Penetration Tester and Cybersecurity. New Version Beginner to Advanced Tool. This Tool is made for educational purpose only! Author will not be responsible for any misuse of this toolkit!

The official Next.js website for payloadcms.com

Its a framework filled with alot of options and hacking tools you use directly in the script from brute forcing to payload making im still adding more stuff i now have another tool out called htkl-lite its hackers-tool-kit just not as big and messy to see updates check on my instagram @tuf_unkn0wn or if there are any problems message me on instagram

link is a command and control framework written in rust

RomBuster is a router exploitation tool that allows to disclosure network router admin password.

DJI Payload SDK Official Repository

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

transform your payload.exe into one fake word doc (.ppt)

Simple and easy Metasploit payload generator for Linux & Termux

Java ｜A customizable Java echo payload generation tool.

Generates malicious LNK file payloads for data exfiltration

PE loader with various shellcode injection techniques

Payload | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript

A fast & natively cross-platform Android OTA payload extractor written in Go

This repository contains full code examples from the book Gray Hat C#

AiScan-N ！Ai（），、、、、，Ai【CLI Agent】 ，Ai，（），，（），！ ：（、CTF、Web、、、、APT、）（）：https://mp.weixin.qq.com/s/7lsUdbrxkDy4P5pZhEWv7Q

Hide your payload into.jpg file

This repository contains payload to test NoSQL Injections

A collection of selected badUSB script for Flipper Zero, written by me. This repo is always Work In Progress.

Repository for Flipper Zero/USB Rubber Ducky payloads

[P1-$10,000] Google Chrome, Microsoft Edge and Opera - vulnerability reported by Maciej Pulikowski - System environment variables leak - CVE-2022-0337

Modular penetration testing platform that enables you to write, test, and execute exploit code.

Authentication plugin for Payload CMS

Payload CMS plugin which provides a visual live editor directly in the Admin UI. Works for collections and globals. Compatible with any kind of JS/TS based frontend technology.

Bad char generator to instruct encoders such as shikata-ga-nai to transform those to other chars.

This plugin aims to provide you with very specific and improved fields for the Payload admin panel.

Open repository for learning dynamic shellcode loading (sample in many programming languages)

AI assistant that utilizes GPT language models to interpret and generate cybersecurity payloads

Armor is a simple Bash script designed to create encrypted macOS payloads capable of evading antivirus scanners.

RAT-el is an open source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server sends commands and the client executes the commands and sends the result back to the server. The client is completely undetectable by anti-virus software.

Pakkero is a binary packer written in Go made for fun and educational purpose. Its main goal is to take in input a program file (elf binary, script, even appimage) and compress it, protect it from tampering and intrusion.

Fully functional, from-scratch alternative to the Cobalt Strike Beacon (red teaming tool), offering transparency and flexibility for security professionals and enthusiasts.

Web3 Ultimate Execution Engine

SPY BOMB is a tool used to generate various payloads for android,windows,ios,mac and many more it is very user friendly tool.

This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.

Android

Athena OS Nix configuration files focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain network camera credentials.

Complex payload encoder

A polyglot payload generator

Translator from USB-Rubber-Ducky payloads to a Digispark code.

Tool for generation samples based on OpenAPI(fka Swagger) payload/response schema

This script allows you to steal some informations from a computer.

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

Analysing parameters with all payloads' bypass methods, aiming at benchmarking security solutions like WAF.

The BackDoor of HIPHP gives you the power to control websites based on PHP using HTTP/HTTPS protocol. By sending files, tokens and commands through port 80's POST/GET method, users can access a range of activities such as downloading and editing files. It also allows for connecting to Tor networks with password protection for extra security.

Extends payload CMS with Meta's lexical RichText editor - a much more advanced and customizable richtext editor

Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution

Plugin for PayloadCMS to integrate OAuth2

This repository contains a set of powerful plugins designed to enhance your Payload CMS projects. Whether you're managing complex content structures or optimizing the authoring experience, these plugins will help streamline your workflow.

Add analytics charts and information directly in your Payload admin.

Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski | Total Bug Bounty Reward: $5.000 | CVE-2021-21123 and 5 more...

Educational lab project exploring secure remote session design, authentication flows, logging, and detection considerations. Built for defensive research and blue-team understanding.

CVE、POC、CNVD++FUZZ,,.

E-commerce platform template using PayloadCMS, Next.js, TypeScript and TailwindCSS for modern online stores. Includes payment and delivery integrations

This script allows you to inject an invisible keylogger thanks to a Bad USB.

Arcane is a simple script designed to backdoor iOS packages (iphone-arm) and create the necessary resources for APT repositories.

This repository contains writeups for various CTFs I've participated in (Including Hack The Box).

Add an extra security layer to PayloadCMS using a Time-based One-time Password (TOTP).

PenTest Education: R-U-DEAD-YET? DOS Attack Implementation in Node.JS

SMB Relay Attack Script

DuckyScript language to DigiSpark payload converter (Online / C++)

Payload Skills to assist AI agents

Monorepo template with Remix and Payload

Payload encoding utility to effectively lower payload entropy.

Legacy OpenSource malware packer for.NET Framework executable files

This project aims to provide a comprehensive resource for understanding and testing Cross-Site Scripting (XSS) vulnerabilities, one of the OWASP Top 10 security risks. It is designed to be a useful resource for security researchers, penetration testers, and developers.

htk-lite is a lighter version of hackers-tool-kit but it still has the same hacking ability as hackers-tool-kit

MalQR is a collection of malicious QR Codes and Barcodes you can use to test the security of your scanners.

Cobalt Strike module x loader x profile x wike / A public collection of open resources for Cobalt Strike (only legal use in Red Team and penetration testing

SQL Injection Payload List

Simple script for the WHID injector - a rubberducky wifi

PowerShell payload generator

Collection of script templates to create infinite UAC prompts forcing a user to run as admin

A payload launcher made in javascript for the Nintendo Switch

A production-ready PayloadCMS starter with Better Auth, modern UI components, and full-stack development tools.

Go-deliver is a payload delivery tool coded in Go.

Add oAuth sign in to your Payload CMS site

Collection of various bite-sized Payload v3 plugins and tools

Windows Hacking FrameWork using Reverse Shell

checksum-reproducible tar archives (utility/library)

PoC - Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (Scanner and Exploit)

Modded Program for remote control of windows computers via telegram bot. Written in C#

Payload plugin for extending lexical typography options (Text color, Font size, Letter spacing, Line height, Font Family)

A new simple and powerfull packer for malware

AutoIt HackTool, Shortcuts.lnk Payloads Generator As LNK-KISSER.

A collection of powerful plugins designed to enhance Payload CMS

The purpose of this tool is to test the window10 defender protection and also other antivirus protection.

Payload CMS plugin for automatic Blurhash encoding of images

Open Source SaaS starter for creating applications with Next.js and Payload

Angular Full Stack Boilerplate Starter with PayloadCMS, Nx and Express. Free Open-Source Web App Boilerplate.

Digital marketplace it's a next.js full stack application (e-commerce platform). Digital Marketplace is a sophisticated full-stack e-commerce platform designed to deliver a seamless shopping experience for users. It incorporates cutting-edge technologies and frameworks to ensure robustness, efficiency, and scalability.

Fast psql-style database CLI/workbench for PostgreSQL, MySQL, SQLite, ClickHouse, MongoDB, Elasticsearch, and SQL over Parquet/CSV/JSON — with optional AI, SSH/Vault, Python & Django.

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

A Flask-based HTTP(S) command and control (C2) framework with a web interface. Custom Windows EXE/DLL implants written in C++. For educational use only.

İçerisinde 100'den fazla modül ve özelliği barındıran çok amaçlı bir siber güvenlik aracı.

Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog post as a tutorial sample

Automated PowerHacker Suite: Your all-in-one solution for ethical hacking. Conduct comprehensive network mapping, vulnerability assessments, password cracking, wireless network analysis, social engineering simulations, and more. Generate real-time reports with actionable insights to identify vulnerabilities and recommend countermeasures.

payloadcms/payload plugin for automatic image conversion to webp format.

Wiki&--Web、、、（Android）、、RCE、IOT。

Path Traversal Vulnerability Payload List

GUI (Graphic user interface) in HTML, CSS, JavaScript, to make easyer and faster to create payload (.txt) for you Flipper Zero's bad-USB function.

A collection of Payload plugins made by OVERSIGHT.

Meterpreter payload for all platforms

Astro + Payload CMS Turborepo

Artifact monitoring that ensures fairplay

Upload media to Cloudinary service

Fast, safe, and reliable Android OTA partition extractor

The primary goal of this project is to explain SQL Injection (one of the OWASP Top 10 vulnerabilities) and to provide a beneficial resource for the security community.

Loki.Rat is a fork of the Ares RAT, it integrates new modules, like recording, lockscreen, and locate options. Loki.Rat is a Python Remote Access Tool.

A demo theme for Payload CMS

¿Quieres empezar en el mundo hacking? En esta revista te enseño a instalar Kali Linux desde cero y a manipular herramientas esenciales en el Hacking Ético.

Better Auth, one plugin away from PayloadCMS.

Extended lexical editor features for Payload CMS (Text color, highlight, block background, embeds)

Block editor plugin for Payload CMS that adds a side-by-side live-preview iframe and sidebar to the edit view.

List of payloads: reverse shell, bind shell, webshell.

CrawlLama is an local AI agent that answers questions via Ollama and integrates web- and RAG-based research.

Payload CMS plugin for event tracking, auditing, and security. Monitor activities and analyze user behavior.

Send Payload CMS uploads to Amazon S3

Termux Auto-Metasploit

(Windows/Linux/Mac) Remote Administration Tool

Implementação em.net para auxiliar na geração de payloads e QRCodes para pagamento PIX, o sistema de pagamento instantâneo do Brasil.

Download a.NET payload and run it on memory

Simple C# Keylogger (Keyboard Layout)

Create a powershell malware loader to run C#.cs code on runtime

「」Test a list of payloads and see if you can bypass it

Extends payloadcms with Auth0 integration

Gerar payload para qrcode estático PIX. (Sistema de pagamento instantâneo do Brasil) Sem a necessidade de conexão com um PSP.

A Redis cache plugin for Payload CMS

A project worth exploring.

Better Auth adapter and plugins for Payload CMS

OS Command Injection Vulnerability Payload List

Purelove is a lightweight penetration testing framework, in order to better security testers testing holes with use.

A Payload CMS plugin that integrates PageSpeed Insights into your project.

This script allows you to take control of a PC with a reverseShell attack.

A Domain Payload implementation.

A collection of Payloads for the WHID Cactus

A simple cryptor for.NET/Native files with Injection and obfuscation

An Open-source E Commerce Store built with Payload and Next.js

Meshcore web client

Use Invoke-PSImage to deliver a payload in an Image

PandaCrypter is a C#-based tool designed to convert PowerShell scripts into obfuscated batch files (.bat) with encryption and additional features for execution control.

trolo - an easy to use script for generating Payloads that bypasses antivirus

Log4j, POC, POC、、、、Log4j、java、.

Payload storage adapter for Bunny.net

Python Exploitation is a collection of special tools for providing high quality penetration testing using pure python programming language.

A plugin for Payload CMS that adds a collapsible Tree list view.

DigiBee is a Full-Stack built with Next.js for frontend and Payload as backend. It is a modern digital product marketplace where you can sell your digital products like e-books, courses, templates, etc. It is a fully functional marketplace with a lot of features.

Automatic Web Vulnerability Scanner.

SQL Injection Payloads List.

「」XSS Payload List

Módulo python para gerar payload pix

Injectra injects shellcode payloads into MacOS applications and package installers.

Sitemap Plugin for PayloadCMS

This script allows you to create a hidden admin account on your victim's PC.

ROP Benchmark is a tool to compare ROP compilers

a proxy server to bypass CORS enabled servers

Payloads for MediaTek Download Agents

Various tools for my flipperzero

Awesome modification of the original "Rickroll". Arduino script + Ducky script

Catalogue de payloads destinés au téléversement de fichiers. Il s'agit d'un ensemble de plusieurs fichiers contenant du code malveillant à utiliser lors des tests d'intrusion, rassemblés en un seul endroit.

A simple plugin to help you manage permissions in Payload with user roles.

Provide ability to export collections as CSV or JSON

A payload cms plugin for kanban board view

Meilisearch integration plugin for Payload CMS.

A few SQL and XSS attack tools

Agentic Workflow Platform

Fast & Silent Script For Rubber Ducky To Inject Reverse Shell

A fully featured template for building performant and scalable content-driven websites with Payload CMS and Astro.

Whatsapp Automatic Payload Generator [CVE-2019-11932]

This library implements a collection protection in Payload CMS using Google reCAPTCHA v3.

Improved FTP server payload for PS4 and command line FTP server for Linux.

Perform MiTM attack and remove encryption on Windows Remote Registry Protocol.

NIP44 encrypted messages for nostr. Spec and implementations

UI state management with RxJS.

Download and loader.NET payload

Like Redux, but smaller

H-SPLOIT-PAYLOAD GENERATE METASPLOIT PAYLOAD IN 1 CLICK

The official Payload E-Commerce Template

The official password protection plugin for Payload

Amerta is a modern, developer-first e-commerce framework built on top of Payload CMS and Next.js. It is designed to replace legacy platforms with a fully typed, scalable architecture that provides absolute control over the storefront and admin experience.

Payload CMS V3 Boilerplate for Railway, by FUNKYTON

Backdoor for Rubella on Shell's

Cayenne Low Power Payload (LLP)

HoppEye is a simple payload picker for BashBunny based on linking payloads to LED color.

rMETAshell takes a shell command and an image, video or text file as input. It then injects the command into the file using metadata comments. After injection, it generates a one-liner execution method for retrieving and executing the injected command from a remote location.

Payload CMS starter template with Puck visual page editing, page-tree, and Better Auth

CVE-2024-37051 poc and exploit

A project worth exploring.

Jarbou3 is rat tool coded in python with C&C which can accept multiple connections from clients

The official Zapier plugin for Payload

Shared library implementations that transform the containing process into a shell when loaded (useful for privilege escalation, argument injection, file overwrites, LD_PRELOAD, etc.).

A production-ready search plugin that integrates Typesense with Payload CMS, offering fast, typo-tolerant search with real-time synchronization.

Mavlink library for.NET

A collection of Payload CMS plugins and tools that can be used to create a website builder in Payload.

A powerful command menu plugin for Payload CMS that enhances navigation and accessibility within the admin panel with keyboard shortcuts.

Injects position-dependent code into a code cave in an executable file, and applies relocations.

Payload on the backend with a custom endpoint using (Server-Sent Events) SSE to send updates to the client, The client listens for updates using the EventSource API.

Network Traffic Identification with Convolutional Neural Networks

Lightweight PS5 file manager that is browser based

A plugin for payload cms for google maps auto complete

CVE-2022-21907: detection, protection, exploitation and demonstration. Exploitation: Powershell, Python, Ruby, NMAP and Metasploit. Detection and protection: Powershell. Demonstration: Youtube.

Exfiltration based on custom X509 certificates

Offensive penetration testing. Perform multiple attack types against web applications, vulnerable programs and OSes in predefined and safe test environment

ADR is a trojan that retrieves all information on the computer and all data stored in applications using chormuim. It recovers cookies, tokens, passwords and saved bank cards. This malware is undetectable by Windows Defender, Chrome, Virustotal (4/71).

Send Payload CMS uploads and deletes to ImageKit

Payload plugin that lets you add custom tabs for iframes, useful for things like Figma and other embeds

A fully open-source status page with Gatus backend and Payload CMS

Payload starter by 9d8

Obfuscate Python code, stage payloads, and evade defenses

A modern, open-source status page built with Next.js and PayloadCMS, designed for flexible and reliable infrastructure monitoring.

Automatic image optimization plugin for PayloadCMS 3.x — compress & convert uploads to modern formats (WebP, AVIF) on the fly, including all size variants. Works with cloud storage.

This tool will allows u to deauth or kick off an specific device from an given AP

SPG: Simple MSFVenom Payload Generator

The ultimate access control gatekeeper for Payload CMS v3 - Advanced RBAC with wildcard support, auto role assignment, and flexible configuration

Append a hash to upload filenames in Payload CMS, and optimize your CDN caching strategy

This plugin allows you to use an instagram connected feed as content to be shown inside payload blog.

Unity + StreamDeck – Call the Unity Editor using deep links with custom payloads

ssshh its a secret;)

A joke program that blasts the screen with visual junk. Computer stroke simulator.

Kusanagi is a bind and reverse shell payload generator with obfuscation and badchar support.

Payload injector and HID emulator for Android like Hak5 and rubber ducky