Payloads64
Test payloads from PayloadsAllTheThings by weakness class, passage by passage with their code blocks.
| Topic | Passages | Code blocks |
|---|---|---|
| Cross-site Scripting | ||
| XSS InjectionCross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. | 91 | 116 |
| CSS InjectionCSS Injection is a vulnerability that occurs when an application allows untrusted CSS to be injected into a web page. This can be exploited to exfiltrate sensitive data, such as CSRF tokens or other secrets, by manipulating the page layout or triggering network requests based on element attributes. | 9 | 12 |
| XS-LeakCross-Site Leaks (XS-Leaks) are side-channel vulnerabilities allowing attackers to infer sensitive information from a target origin without reading the response body. They exploit browser behaviors, timing differences, and observable side effects rather than traditional XSS data exfiltration. | 7 | 1 |
| TabnabbingReverse tabnabbing is an attack where a page linked from the target page is able to rewrite that page, for example to replace it with a phishing site. As the user was originally on the correct page they are less likely to notice that it has been changed to a phishing site, especially if the site lo… | 4 | 1 |
| DOM ClobberingDOM Clobbering is a technique where global variables can be overwritten or "clobbered" by naming HTML elements with certain IDs or names. This can cause unexpected behavior in scripts and potentially lead to security vulnerabilities. | 3 | – |
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky. The repository. Data as of 2026-11-15.