How iamthefrogy/payloadsallthethings works
Payloads All The Things is a security-reference and utility collection, not a unified scanning application. An assessor consults a vulnerability or technique section, selects a payload or helper, and uses it against a separately operated web application or service. The tree shows concrete exploit scripts and generators for several categories; the README documents a broader chapter format, but those chapter files are not included here. Edges represent user-initiated use and demonstrated network interactions, not an inferred internal execution pipeline.
Main entry points: Jenkins CVE-2015-8103.py Jenkins exploit · Telerik CVE-2017-9248.py Telerik exploit · LFI2RCE.py LFI to RCE · phpinfolfi.py PHPInfo LFI
Components 17
CVE exploits
- CVE exploit collection
CVE Exploits - Jenkins exploit
CVE Exploits/Jenkins CVE-2015-8103.py - Telerik exploit
CVE Exploits/Telerik CVE-2017-9248.py
Web techniques
- File inclusion
File Inclusion - LFI to RCE
File Inclusion/Files/LFI2RCE.py - PHPInfo LFI
File Inclusion/Files/phpinfolfi.py - SSRF
Server Side Request Forgery - SSRF variants
Server Side Request Forgery/Files/ip.py - Deserialization
Insecure Deserialization - Ruby gadget verifier
Insecure Deserialization/Files/Ruby_universal_gadget_generate_verify.rb
Upload payloads
- Insecure uploads
Upload Insecure Files - FFmpeg AVI generators
Upload Insecure Files/CVE FFmpeg HLS - Image payload generators
Upload Insecure Files/Picture Compression - Image metadata payload
Upload Insecure Files/Picture Metadata/Build_image_to_LFI.py
Testing utilities
- WebSocket harness
Web Sockets/Files/ws-harness.py
Other components
- Security assessor
- Test target
Connections 20
- Security assessor → CVE exploit collection: consults
- Security assessor → File inclusion: selects technique
- Security assessor → SSRF: selects technique
- Security assessor → Deserialization: selects technique
- Security assessor → Insecure uploads: selects technique
- Security assessor → Jenkins exploit: runs exploit
- Security assessor → Telerik exploit: runs exploit
- Jenkins exploit → Test target: queries and connects
- Telerik exploit → Test target: sends requests
- Security assessor → LFI to RCE: runs helper
- LFI to RCE → Test target: sends request
- Security assessor → PHPInfo LFI: runs helper
- PHPInfo LFI → Test target: sends HTTP requests
- Security assessor → SSRF variants: runs generator
- Security assessor → Ruby gadget verifier: runs verifier
- Security assessor → FFmpeg AVI generators: generates AVI
- Security assessor → Image payload generators: generates image
- Security assessor → Image metadata payload: generates PNG
- Security assessor → WebSocket harness: runs harness
- WebSocket harness → Test target: sends WebSocket message