MADE WITH
PAYLOAD CMS

Tools and Techniques for Red Team / Penetration Testing

All about bug bounty (bypasses, payloads, and etc)

Awesome XSS stuff

Generate Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON/YAML/CSV.

Git All the Payloads! A collection of web attack payloads.

Python Remote Administration Tool (RAT)

CHAOS is a free and open-source Remote Administration Tool that allow generate binaries to control remote operating systems.

Penetration tests guide based on OWASP including test cases, resources and examples.

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

C++ GUI for TegraRcmSmash (Fusée Gelée exploit for Nintendo Switch)

Medusa，XSS、、CVE、、DNSLOG、、，

Java ｜A customizable Java in-memory webshell generation tool.

Java Vulnerability Exploitation Platform

RubberDucky like payloads for DigiSpark Attiny85

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

Java Web ，，

Burp Suite Certified Practitioner Exam Study

Learn how to build an incredible e-commerce webshop with an admin dashboard and CMS using Next 14, Stripe, TypeScript, and Payload CMS.

Reflective PE packer.

Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.

MSFvenom Payload Creator (MSFPC)

Payload for teensy like a rubber ducky but the syntax is different. this Human interfaes device ( HID attacks ). Penetration With Teensy. Brutal is a toolkit to quickly create various payload,powershell attack, virus attack and launch listener for a Human Interface Device ( Payload Teensy )

Athena OS is a Arch/Nix-based distro focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!

CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks

AppSec Payloads Arsenal for Pentration Tester and Bug Bounty Hunters

Infosec Wordlists and more.

Apkmod can decompile, recompile, sign APK, and bind the payload with any legit APP

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

ALL IN ONE Hacking Tool For Hackers, Penetration Tester and Cybersecurity. New Version Beginner to Advanced Tool. This Tool is made for educational purpose only! Author will not be responsible for any misuse of this toolkit!

The official Next.js website for payloadcms.com

Its a framework filled with alot of options and hacking tools you use directly in the script from brute forcing to payload making im still adding more stuff i now have another tool out called htkl-lite its hackers-tool-kit just not as big and messy to see updates check on my instagram @tuf_unkn0wn or if there are any problems message me on instagram

link is a command and control framework written in rust

RomBuster is a router exploitation tool that allows to disclosure network router admin password.

Agili AIGC - Agentic AI Agent AIGC（）。

AI Plugin is a powerful extension for the Payload CMS, integrating advanced AI capabilities to enhance content creation and management.

DJI Payload SDK Official Repository

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

transform your payload.exe into one fake word doc (.ppt)

Simple and easy Metasploit payload generator for Linux & Termux

Java ｜A customizable Java echo payload generation tool.

Generates malicious LNK file payloads for data exfiltration

PE loader with various shellcode injection techniques

Payload | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript

A fast & natively cross-platform Android OTA payload extractor written in Go

This repository contains full code examples from the book Gray Hat C#

AiScan-N ！Ai（），、、、、，Ai【CLI Agent】 ，Ai，（），，（），！ ：（、CTF、Web、、、、APT、）（）：https://mp.weixin.qq.com/s/7lsUdbrxkDy4P5pZhEWv7Q

Hide your payload into.jpg file

This repository contains payload to test NoSQL Injections

A collection of selected badUSB script for Flipper Zero, written by me. This repo is always Work In Progress.

Repository for Flipper Zero/USB Rubber Ducky payloads

[P1-$10,000] Google Chrome, Microsoft Edge and Opera - vulnerability reported by Maciej Pulikowski - System environment variables leak - CVE-2022-0337

Payload 3.0 enchantment packages

Modular penetration testing platform that enables you to write, test, and execute exploit code.

Authentication plugin for Payload CMS

Payload CMS plugin which provides a visual live editor directly in the Admin UI. Works for collections and globals. Compatible with any kind of JS/TS based frontend technology.

Bad char generator to instruct encoders such as shikata-ga-nai to transform those to other chars.

This plugin aims to provide you with very specific and improved fields for the Payload admin panel.

Open repository for learning dynamic shellcode loading (sample in many programming languages)

AI assistant that utilizes GPT language models to interpret and generate cybersecurity payloads

Armor is a simple Bash script designed to create encrypted macOS payloads capable of evading antivirus scanners.

RAT-el is an open source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server sends commands and the client executes the commands and sends the result back to the server. The client is completely undetectable by anti-virus software.

Pakkero is a binary packer written in Go made for fun and educational purpose. Its main goal is to take in input a program file (elf binary, script, even appimage) and compress it, protect it from tampering and intrusion.

Fully functional, from-scratch alternative to the Cobalt Strike Beacon (red teaming tool), offering transparency and flexibility for security professionals and enthusiasts.

Web3 Ultimate Execution Engine

SPY BOMB is a tool used to generate various payloads for android,windows,ios,mac and many more it is very user friendly tool.

This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.

Android

Athena OS Nix configuration files focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain network camera credentials.

Complex payload encoder

A polyglot payload generator

Translator from USB-Rubber-Ducky payloads to a Digispark code.

Tool for generation samples based on OpenAPI(fka Swagger) payload/response schema

This script allows you to steal some informations from a computer.

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

Analysing parameters with all payloads' bypass methods, aiming at benchmarking security solutions like WAF.

The BackDoor of HIPHP gives you the power to control websites based on PHP using HTTP/HTTPS protocol. By sending files, tokens and commands through port 80's POST/GET method, users can access a range of activities such as downloading and editing files. It also allows for connecting to Tor networks with password protection for extra security.

Extends payload CMS with Meta's lexical RichText editor - a much more advanced and customizable richtext editor

A Payload CMS 3 plugin for Auth.js/NextAuth 5

Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution

Plugin for PayloadCMS to integrate OAuth2

Add analytics charts and information directly in your Payload admin.

This repository contains a set of powerful plugins designed to enhance your Payload CMS projects. Whether you're managing complex content structures or optimizing the authoring experience, these plugins will help streamline your workflow.

Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski | Total Bug Bounty Reward: $5.000 | CVE-2021-21123 and 5 more...

Educational lab project exploring secure remote session design, authentication flows, logging, and detection considerations. Built for defensive research and blue-team understanding.

CVE、POC、CNVD++FUZZ,,.

E-commerce platform template using PayloadCMS, Next.js, TypeScript and TailwindCSS for modern online stores. Includes payment and delivery integrations

This script allows you to inject an invisible keylogger thanks to a Bad USB.

Add an extra security layer to PayloadCMS using a Time-based One-time Password (TOTP).

This repository contains writeups for various CTFs I've participated in (Including Hack The Box).

Arcane is a simple script designed to backdoor iOS packages (iphone-arm) and create the necessary resources for APT repositories.

PenTest Education: R-U-DEAD-YET? DOS Attack Implementation in Node.JS

SMB Relay Attack Script

DuckyScript language to DigiSpark payload converter (Online / C++)

Payload Skills to assist AI agents

Monorepo template with Remix and Payload

This project aims to provide a comprehensive resource for understanding and testing Cross-Site Scripting (XSS) vulnerabilities, one of the OWASP Top 10 security risks. It is designed to be a useful resource for security researchers, penetration testers, and developers.

Legacy OpenSource malware packer for.NET Framework executable files

Payload encoding utility to effectively lower payload entropy.

htk-lite is a lighter version of hackers-tool-kit but it still has the same hacking ability as hackers-tool-kit

MalQR is a collection of malicious QR Codes and Barcodes you can use to test the security of your scanners.

Cobalt Strike module x loader x profile x wike / A public collection of open resources for Cobalt Strike (only legal use in Red Team and penetration testing

A Payload CMS plugin for OpenAPI (3.0, 3.1) specification generation

SQL Injection Payload List

PowerShell payload generator

Simple script for the WHID injector - a rubberducky wifi

Collection of script templates to create infinite UAC prompts forcing a user to run as admin

Payload CMS MCP Server

A payload launcher made in javascript for the Nintendo Switch

A production-ready PayloadCMS starter with Better Auth, modern UI components, and full-stack development tools.

Go-deliver is a payload delivery tool coded in Go.

Add oAuth sign in to your Payload CMS site

Collection of various bite-sized Payload v3 plugins and tools

Windows Hacking FrameWork using Reverse Shell

PoC - Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (Scanner and Exploit)

A free chat platform that encrypts conversation information throughout the process to protect your security and privacy. No information is collected from you and no permissions are required from you.End of chat Clear all records

checksum-reproducible tar archives (utility/library)

Modded Program for remote control of windows computers via telegram bot. Written in C#

A workflow plugin for Payload CMS

Payload plugin for extending lexical typography options (Text color, Font size, Letter spacing, Line height, Font Family)

A new simple and powerfull packer for malware

A monorepo built on Payload 3 to demonstrate the use of frameworks other than Next.js for their frontend.

AutoIt HackTool, Shortcuts.lnk Payloads Generator As LNK-KISSER.

CrawlLama is an local AI agent that answers questions via Ollama and integrates web- and RAG-based research.

A collection of powerful plugins designed to enhance Payload CMS

The purpose of this tool is to test the window10 defender protection and also other antivirus protection.

Open Source SaaS starter for creating applications with Next.js and Payload

A plugin to vectorize collections for RAG in Payload 3.0

Payload CMS plugin for automatic Blurhash encoding of images

Digital marketplace it's a next.js full stack application (e-commerce platform). Digital Marketplace is a sophisticated full-stack e-commerce platform designed to deliver a seamless shopping experience for users. It incorporates cutting-edge technologies and frameworks to ensure robustness, efficiency, and scalability.

Angular Full Stack Boilerplate Starter with PayloadCMS, Nx and Express. Free Open-Source Web App Boilerplate.

Fast psql-style database CLI/workbench for PostgreSQL, MySQL, SQLite, ClickHouse, MongoDB, Elasticsearch, and SQL over Parquet/CSV/JSON — with optional AI, SSH/Vault, Python & Django.

Puck visual page builder plugin for Payload CMS

A Flask-based HTTP(S) command and control (C2) framework with a web interface. Custom Windows EXE/DLL implants written in C++. For educational use only.

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

İçerisinde 100'den fazla modül ve özelliği barındıran çok amaçlı bir siber güvenlik aracı.

Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog post as a tutorial sample

Automated PowerHacker Suite: Your all-in-one solution for ethical hacking. Conduct comprehensive network mapping, vulnerability assessments, password cracking, wireless network analysis, social engineering simulations, and more. Generate real-time reports with actionable insights to identify vulnerabilities and recommend countermeasures.

Wiki&--Web、、、（Android）、、RCE、IOT。

payloadcms/payload plugin for automatic image conversion to webp format.

Free, modern, and accessible e-commerce platform built with Next.js 16 and Payload CMS. Features a dynamic storefront, flexible content management, and a production-ready commerce flow.

Path Traversal Vulnerability Payload List

GUI (Graphic user interface) in HTML, CSS, JavaScript, to make easyer and faster to create payload (.txt) for you Flipper Zero's bad-USB function.

A collection of Payload plugins made by OVERSIGHT.

Meterpreter payload for all platforms

Block editor plugin for Payload CMS that adds a side-by-side live-preview iframe and sidebar to the edit view.

Astro + Payload CMS Turborepo

Artifact monitoring that ensures fairplay

Upload media to Cloudinary service

Fast, safe, and reliable Android OTA partition extractor

The primary goal of this project is to explain SQL Injection (one of the OWASP Top 10 vulnerabilities) and to provide a beneficial resource for the security community.

Loki.Rat is a fork of the Ares RAT, it integrates new modules, like recording, lockscreen, and locate options. Loki.Rat is a Python Remote Access Tool.

A demo theme for Payload CMS

¿Quieres empezar en el mundo hacking? En esta revista te enseño a instalar Kali Linux desde cero y a manipular herramientas esenciales en el Hacking Ético.

Payload CMS plugin for event tracking, auditing, and security. Monitor activities and analyze user behavior.

Better Auth, one plugin away from PayloadCMS.

Extended lexical editor features for Payload CMS (Text color, highlight, block background, embeds)

List of payloads: reverse shell, bind shell, webshell.

Send Payload CMS uploads to Amazon S3

Termux Auto-Metasploit

(Windows/Linux/Mac) Remote Administration Tool

Implementação em.net para auxiliar na geração de payloads e QRCodes para pagamento PIX, o sistema de pagamento instantâneo do Brasil.

Download a.NET payload and run it on memory

Create a powershell malware loader to run C#.cs code on runtime

Simple C# Keylogger (Keyboard Layout)

「」Test a list of payloads and see if you can bypass it

Better Auth adapter and plugins for Payload CMS

Extends payloadcms with Auth0 integration

Gerar payload para qrcode estático PIX. (Sistema de pagamento instantâneo do Brasil) Sem a necessidade de conexão com um PSP.

A Redis cache plugin for Payload CMS

A project worth exploring.

OS Command Injection Vulnerability Payload List

Purelove is a lightweight penetration testing framework, in order to better security testers testing holes with use.

Meshcore web client

This script allows you to take control of a PC with a reverseShell attack.

A collection of Payloads for the WHID Cactus

A Domain Payload implementation.

A simple cryptor for.NET/Native files with Injection and obfuscation

A Payload CMS plugin that integrates PageSpeed Insights into your project.

An Open-source E Commerce Store built with Payload and Next.js

Use Invoke-PSImage to deliver a payload in an Image

PandaCrypter is a C#-based tool designed to convert PowerShell scripts into obfuscated batch files (.bat) with encryption and additional features for execution control.

trolo - an easy to use script for generating Payloads that bypasses antivirus

Payload storage adapter for Bunny.net

Log4j, POC, POC、、、、Log4j、java、.

Python Exploitation is a collection of special tools for providing high quality penetration testing using pure python programming language.

DigiBee is a Full-Stack built with Next.js for frontend and Payload as backend. It is a modern digital product marketplace where you can sell your digital products like e-books, courses, templates, etc. It is a fully functional marketplace with a lot of features.

A plugin for Payload CMS that adds a collapsible Tree list view.

Next generation LMS focused on simplicity. Moodle and Canvas alternative in a single binary.

Automatic Web Vulnerability Scanner.

SQL Injection Payloads List.

Módulo python para gerar payload pix

「」XSS Payload List

Injectra injects shellcode payloads into MacOS applications and package installers.

A turborepo template featuring Sveltekit and Payload CMS, ready to be deployed to a single node server - specifically using https://railway.app.

Sitemap Plugin for PayloadCMS

This script allows you to create a hidden admin account on your victim's PC.

ROP Benchmark is a tool to compare ROP compilers

a proxy server to bypass CORS enabled servers

Various tools for my flipperzero

Join the javascript community of developers made with @payload

This is a small business marketing website that is my main template.

Payloads for MediaTek Download Agents

A payload cms plugin for kanban board view

Catalogue de payloads destinés au téléversement de fichiers. Il s'agit d'un ensemble de plusieurs fichiers contenant du code malveillant à utiliser lors des tests d'intrusion, rassemblés en un seul endroit.

A simple plugin to help you manage permissions in Payload with user roles.

Awesome modification of the original "Rickroll". Arduino script + Ducky script

Provide ability to export collections as CSV or JSON

A real-time sync plugin for PayloadCMS that provides reactive queries (like Convex) and optimistic mutations.

A few SQL and XSS attack tools

Meilisearch integration plugin for Payload CMS.

A fully featured template for building performant and scalable content-driven websites with Payload CMS and Astro.

Agentic Workflow Platform

Fast & Silent Script For Rubber Ducky To Inject Reverse Shell

The official Payload E-Commerce Template

Improved FTP server payload for PS4 and command line FTP server for Linux.

Perform MiTM attack and remove encryption on Windows Remote Registry Protocol.

Whatsapp Automatic Payload Generator [CVE-2019-11932]

Add OpenID Connect (OIDC) sign in to your Payload CMS

This library implements a collection protection in Payload CMS using Google reCAPTCHA v3.

Amerta is a modern, developer-first e-commerce framework built on top of Payload CMS and Next.js. It is designed to replace legacy platforms with a fully typed, scalable architecture that provides absolute control over the storefront and admin experience.

UI state management with RxJS.

Like Redux, but smaller

Next.js 16.3+, Medusajs 2+ and payloadcms 3+ ecommerce template

Download and loader.NET payload

NIP44 encrypted messages for nostr. Spec and implementations

H-SPLOIT-PAYLOAD GENERATE METASPLOIT PAYLOAD IN 1 CLICK

Payload CMS V3 Boilerplate for Railway, by FUNKYTON

Backdoor for Rubella on Shell's

HoppEye is a simple payload picker for BashBunny based on linking payloads to LED color.

Cayenne Low Power Payload (LLP)

The official password protection plugin for Payload

A full-featured, reusable reservation/booking plugin for Payload CMS 3.x. Designed for salons, clinics, consultants, and any business that needs appointment scheduling with conflict prevention, status workflows, and admin UI components.

Next.js 13 App Router Payload CMS Monorepo

Payload CMS starter template with Puck visual page editing, page-tree, and Better Auth

PayloadCMS plugin for automatic scheduled posts

rMETAshell takes a shell command and an image, video or text file as input. It then injects the command into the file using metadata comments. After injection, it generates a one-liner execution method for retrieving and executing the injected command from a remote location.

Masquerade plugin allow to switch users and surf the site as that user (no password required). That person can switch back to their own user account at any time.

A collection of Payload CMS plugins and tools that can be used to create a website builder in Payload.

This is an extended version of the Payload CMS import-export plugin, providing additional features and enhancements.

A production-ready search plugin that integrates Typesense with Payload CMS, offering fast, typo-tolerant search with real-time synchronization.

A project worth exploring.

CVE-2024-37051 poc and exploit

Jarbou3 is rat tool coded in python with C&C which can accept multiple connections from clients

The official Zapier plugin for Payload

Mavlink library for.NET

A powerful command menu plugin for Payload CMS that enhances navigation and accessibility within the admin panel with keyboard shortcuts.

Shared library implementations that transform the containing process into a shell when loaded (useful for privilege escalation, argument injection, file overwrites, LD_PRELOAD, etc.).

Payload on the backend with a custom endpoint using (Server-Sent Events) SSE to send updates to the client, The client listens for updates using the EventSource API.