Guide · Open source
How to use PayloadsAllTheThings: navigate, copy payloads and test safely
Updated · written with AI from the project's own documentation and checked against our catalogue data
PayloadsAllTheThings is an open-source collection of Markdown documents that list useful payloads and bypass techniques for web application security. This guide shows you how to get a local copy, how each vulnerability folder is organised, and how to use the Intruder files and examples responsibly. By the end you will know where to look when you need payload variations for a known vulnerability class.
PayloadsAllTheThingsswisskyrepo/PayloadsAllTheThings · ★ 82.3k · MIT Install options & downloads Quick start
- 1Clone the repository. Run the git clone command from the README to download the full set of Markdown files to your computer.
- 2Pick a vulnerability folder. Choose the folder whose name matches the flaw you want to understand or test.
- 3Read the README.md. Read the description and exploitation notes before copying any payload.
- 4Check the Intruder files if needed. If you are working in Burp Intruder, look in the section's Intruder folder for the provided files.
- 5Test within your permissions. Run payloads only against systems you own or have explicit permission to test, such as a lab or CTF.
What PayloadsAllTheThings is and who it is for
PayloadsAllTheThings is a reference, not a course or a scanner. The project is organised as one folder per vulnerability topic, and each section describes a vulnerability, how it can be exploited, and sample inputs.
It suits penetration testers who want a quick list of payload variations, students learning how common web vulnerabilities are exploited, CTF players who need alternative syntax when a standard payload is blocked, and security engineers building test cases for input filters or web application firewalls.
- Good fit: quick reference for a known vulnerability class
- Good fit: learning how common web flaws are exploited
- Not a fit: complete beginners who need guided, step-by-step lessons
- Not a fit: automated scanning, since the project provides payloads to read or copy and does not run tests
Clone the repository to your computer
The project uses a clone-and-build install method, and the README lists no prerequisites. To get a local copy, run the clone command from the README. The payloads are plain Markdown files, so you can browse them in any text editor or on GitHub.
An online display version is also available on the project homepage if you prefer not to work with files locally.
- Open a terminal in the folder where you want the project stored
- Run the clone command shown in the code block
- Open the new PayloadsAllTheThings folder in your editor or file browser
git clone https://github.com/swisskyrepo/PayloadsAllTheThingsUnderstand the folder structure of each section
Every section contains the same set of files. Each vulnerability folder has a README.md that describes the vulnerability and how to exploit it, including several payloads. Start there for any topic.
The other parts are optional support material. An Intruder folder holds files to give to Burp Intruder, an Images folder holds pictures used by the README, and a Files folder holds files the README references. If you want to add a new topic, the README says you can copy the _template_vuln folder.
- README.md: vulnerability description, exploitation notes and payloads
- Intruder: files to load into Burp Intruder
- Images: pictures referenced by the README
- Files: other files referenced by the README
- _template_vuln: the starting folder for new chapters
Find and use payloads for a vulnerability
Pick the folder that matches the vulnerability you are testing, then open its README.md. Read the description first so you understand the context, then compare the listed payloads with the behaviour of the application you are authorised to test.
When a standard payload is blocked by a filter, look through the variations in the same README. Copy only what you need and record what you tried and what happened, since the payloads are a starting point rather than a verified result.
- Choose the vulnerability folder by name
- Read the description and exploitation notes in README.md
- Check the Intruder folder if you want to run a set of inputs in Burp Intruder
- Test only systems you have explicit permission to test
Contribute or learn more
The README asks contributors to read CONTRIBUTING.md before opening changes. The project also links to selected books and a YouTube channel list for further learning, and to sister projects InternalAllTheThings for Active Directory and internal testing and HardwareAllTheThings for hardware and IoT.
Because the payloads are offensive material, use them only in authorised environments such as your own lab, a CTF, or a scoped engagement.
- Read CONTRIBUTING.md before contributing
- Browse the linked Books and YouTube lists for learning material
- Use a lab or authorised target for all testing
What people use it for
- A penetration tester checks a list of payload variations for a known input-validation issue.
- A student reads how a common web vulnerability is described and exploited in a section README.
- A CTF player looks for alternative payload syntax when a standard one is filtered.
- A security engineer uses the examples as test cases for an input filter or web application firewall.
Frequently asked questions
How do I install PayloadsAllTheThings?
The project uses a clone-and-build method. Run git clone https://github.com/swisskyrepo/PayloadsAllTheThings in a terminal to get a local copy of the Markdown files. The README lists no prerequisites for this step.
Is PayloadsAllTheThings free to use?
The project is released under the MIT licence. Check the LICENSE file in the repository for the full terms before reusing material in another project.
Does PayloadsAllTheThings include an automated scanner?
No. The project is a reference list of payloads and bypass techniques that you read or copy. It does not run tests against a target, so you need your own tools to send and check inputs.
What is the PayloadsAllTheThings Burp Intruder folder for?
Some sections include an Intruder folder with files to give to Burp Intruder. Each section's README.md explains the vulnerability and the payloads, and the Intruder files provide inputs you can load into that tool.
What are good alternatives to PayloadsAllTheThings?
Comparable projects include HackTricks, the OWASP Cheat Sheet Series, SecLists and FuzzDB. Each covers security testing material, so pick based on whether you need payload lists, guidance, or wordlists.
Can I use PayloadsAllTheThings to test a website I do not own?
Only with explicit permission. The payloads are offensive material, so use them in your own lab, a CTF, or an authorised engagement.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
PayloadsAllTheThings suits penetration testers, students and CTF players who want a quick, searchable reference of payload variations for known web vulnerability classes. Beginners who need guided lessons, or anyone who wants an automated scanner, should pick a course or a tool instead.
Install options & downloads