Payload Libraries

Copy-pasteable, report-cited payloads harvested from the disclosed HackerOne corpus. Replace placeholders (TARGET, COLLAB, VICTIM) with your authorized target and collaborator. Each payload links back to the report it came from; open hackerone.com/reports/<id> for context.

Library	Class page
xss.md	vulnerabilities/xss
sqli.md	vulnerabilities/sqli
ssrf.md	vulnerabilities/ssrf
command-injection.md	vulnerabilities/command-injection
code-injection.md	vulnerabilities/code-injection
ssti.md	vulnerabilities/ssti
path-traversal.md	vulnerabilities/path-traversal
open-redirect.md	vulnerabilities/open-redirect
xxe.md	vulnerabilities/xxe
request-smuggling.md	vulnerabilities/request-smuggling
crlf-http-splitting.md	vulnerabilities/crlf-http-splitting
deserialization.md	vulnerabilities/deserialization

> These are real payloads from disclosed reports, provided for authorized testing and defensive > research only. Test only systems you have permission to test.