# iamthefrogy/payloadsallthethings architecture

> Architecture diagram of the GitHub repository iamthefrogy/payloadsallthethings, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/iamthefrogy/payloadsallthethings
- Repository: https://github.com/iamthefrogy/payloadsallthethings

## Overview

Payloads All The Things is a security-reference and utility collection, not a unified scanning application. An assessor consults a vulnerability or technique section, selects a payload or helper, and uses it against a separately operated web application or service. The tree shows concrete exploit scripts and generators for several categories; the README documents a broader chapter format, but those chapter files are not included here. Edges represent user-initiated use and demonstrated network interactions, not an inferred internal execution pipeline.

Main entry points: [`CVE Exploits/Jenkins CVE-2015-8103.py`](https://github.com/iamthefrogy/payloadsallthethings/blob/master/CVE%20Exploits/Jenkins%20CVE-2015-8103.py) (Jenkins exploit), [`CVE Exploits/Telerik CVE-2017-9248.py`](https://github.com/iamthefrogy/payloadsallthethings/blob/master/CVE%20Exploits/Telerik%20CVE-2017-9248.py) (Telerik exploit), [`File Inclusion/Files/LFI2RCE.py`](https://github.com/iamthefrogy/payloadsallthethings/blob/master/File%20Inclusion/Files/LFI2RCE.py) (LFI to RCE), [`File Inclusion/Files/phpinfolfi.py`](https://github.com/iamthefrogy/payloadsallthethings/blob/master/File%20Inclusion/Files/phpinfolfi.py) (PHPInfo LFI)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_exploits["CVE exploits"]
  node_vuln_catalog["CVE exploit collection"]
  node_jenkins_exploit["Jenkins exploit"]
  node_telerik_exploit["Telerik exploit"]
end

subgraph group_techniques["Web techniques"]
  node_file_inclusion["File inclusion"]
  node_lfi_rce["LFI to RCE<br/>[LFI2RCE.py]"]
  node_phpinfo_lfi["PHPInfo LFI<br/>[phpinfolfi.py]"]
  node_ssrf["SSRF"]
  node_ssrf_generator["SSRF variants<br/>[ip.py]"]
  node_deserialization["Deserialization"]
  node_ruby_gadget["Ruby gadget verifier"]
end

subgraph group_payloads["Upload payloads"]
  node_upload["Insecure uploads"]
  node_ffmpeg_generators["FFmpeg AVI generators"]
  node_image_payloads["Image payload generators"]
  node_metadata_payload["Image metadata payload"]
end

subgraph group_harness["Testing utilities"]
  node_websocket_harness["WebSocket harness<br/>[ws-harness.py]"]
end

node_assessor(("Security assessor"))
node_target(("Test target"))

node_assessor -->|"consults"| node_vuln_catalog
node_assessor -->|"selects technique"| node_file_inclusion
node_assessor -->|"selects technique"| node_ssrf
node_assessor -->|"selects technique"| node_deserialization
node_assessor -->|"selects technique"| node_upload
node_assessor -->|"runs exploit"| node_jenkins_exploit
node_assessor -->|"runs exploit"| node_telerik_exploit
node_jenkins_exploit -->|"queries and connects"| node_target
node_telerik_exploit -->|"sends requests"| node_target
node_assessor -->|"runs helper"| node_lfi_rce
node_lfi_rce -->|"sends request"| node_target
node_assessor -->|"runs helper"| node_phpinfo_lfi
node_phpinfo_lfi -->|"sends HTTP requests"| node_target
node_assessor -->|"runs generator"| node_ssrf_generator
node_assessor -->|"runs verifier"| node_ruby_gadget
node_assessor -->|"generates AVI"| node_ffmpeg_generators
node_assessor -->|"generates image"| node_image_payloads
node_assessor -->|"generates PNG"| node_metadata_payload
node_assessor -->|"runs harness"| node_websocket_harness
node_websocket_harness -->|"sends WebSocket message"| node_target

click node_vuln_catalog "https://github.com/iamthefrogy/payloadsallthethings/tree/master/CVE%20Exploits"
click node_jenkins_exploit "https://github.com/iamthefrogy/payloadsallthethings/blob/master/CVE%20Exploits/Jenkins%20CVE-2015-8103.py"
click node_telerik_exploit "https://github.com/iamthefrogy/payloadsallthethings/blob/master/CVE%20Exploits/Telerik%20CVE-2017-9248.py"
click node_file_inclusion "https://github.com/iamthefrogy/payloadsallthethings/tree/master/File%20Inclusion"
click node_lfi_rce "https://github.com/iamthefrogy/payloadsallthethings/blob/master/File%20Inclusion/Files/LFI2RCE.py"
click node_phpinfo_lfi "https://github.com/iamthefrogy/payloadsallthethings/blob/master/File%20Inclusion/Files/phpinfolfi.py"
click node_ssrf "https://github.com/iamthefrogy/payloadsallthethings/tree/master/Server%20Side%20Request%20Forgery"
click node_ssrf_generator "https://github.com/iamthefrogy/payloadsallthethings/blob/master/Server%20Side%20Request%20Forgery/Files/ip.py"
click node_deserialization "https://github.com/iamthefrogy/payloadsallthethings/tree/master/Insecure%20Deserialization"
click node_ruby_gadget "https://github.com/iamthefrogy/payloadsallthethings/blob/master/Insecure%20Deserialization/Files/Ruby_universal_gadget_generate_verify.rb"
click node_upload "https://github.com/iamthefrogy/payloadsallthethings/tree/master/Upload%20Insecure%20Files"
click node_ffmpeg_generators "https://github.com/iamthefrogy/payloadsallthethings/tree/master/Upload%20Insecure%20Files/CVE%20FFmpeg%20HLS"
click node_image_payloads "https://github.com/iamthefrogy/payloadsallthethings/tree/master/Upload%20Insecure%20Files/Picture%20Compression"
click node_metadata_payload "https://github.com/iamthefrogy/payloadsallthethings/blob/master/Upload%20Insecure%20Files/Picture%20Metadata/Build_image_to_LFI.py"
click node_websocket_harness "https://github.com/iamthefrogy/payloadsallthethings/blob/master/Web%20Sockets/Files/ws-harness.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_vuln_catalog,node_jenkins_exploit,node_telerik_exploit toneBlue
class node_file_inclusion,node_lfi_rce,node_phpinfo_lfi,node_ssrf,node_ssrf_generator,node_deserialization,node_ruby_gadget toneAmber
class node_upload,node_ffmpeg_generators,node_image_payloads,node_metadata_payload toneMint
class node_websocket_harness toneRose
class node_assessor,node_target toneIndigo
```

## Components

### CVE exploits

- [CVE exploit collection](https://github.com/iamthefrogy/payloadsallthethings/tree/master/CVE%20Exploits): `CVE Exploits`
- [Jenkins exploit](https://github.com/iamthefrogy/payloadsallthethings/blob/master/CVE%20Exploits/Jenkins%20CVE-2015-8103.py): `CVE Exploits/Jenkins CVE-2015-8103.py`
- [Telerik exploit](https://github.com/iamthefrogy/payloadsallthethings/blob/master/CVE%20Exploits/Telerik%20CVE-2017-9248.py): `CVE Exploits/Telerik CVE-2017-9248.py`

### Web techniques

- [File inclusion](https://github.com/iamthefrogy/payloadsallthethings/tree/master/File%20Inclusion): `File Inclusion`
- [LFI to RCE](https://github.com/iamthefrogy/payloadsallthethings/blob/master/File%20Inclusion/Files/LFI2RCE.py): `File Inclusion/Files/LFI2RCE.py`
- [PHPInfo LFI](https://github.com/iamthefrogy/payloadsallthethings/blob/master/File%20Inclusion/Files/phpinfolfi.py): `File Inclusion/Files/phpinfolfi.py`
- [SSRF](https://github.com/iamthefrogy/payloadsallthethings/tree/master/Server%20Side%20Request%20Forgery): `Server Side Request Forgery`
- [SSRF variants](https://github.com/iamthefrogy/payloadsallthethings/blob/master/Server%20Side%20Request%20Forgery/Files/ip.py): `Server Side Request Forgery/Files/ip.py`
- [Deserialization](https://github.com/iamthefrogy/payloadsallthethings/tree/master/Insecure%20Deserialization): `Insecure Deserialization`
- [Ruby gadget verifier](https://github.com/iamthefrogy/payloadsallthethings/blob/master/Insecure%20Deserialization/Files/Ruby_universal_gadget_generate_verify.rb): `Insecure Deserialization/Files/Ruby_universal_gadget_generate_verify.rb`

### Upload payloads

- [Insecure uploads](https://github.com/iamthefrogy/payloadsallthethings/tree/master/Upload%20Insecure%20Files): `Upload Insecure Files`
- [FFmpeg AVI generators](https://github.com/iamthefrogy/payloadsallthethings/tree/master/Upload%20Insecure%20Files/CVE%20FFmpeg%20HLS): `Upload Insecure Files/CVE FFmpeg HLS`
- [Image payload generators](https://github.com/iamthefrogy/payloadsallthethings/tree/master/Upload%20Insecure%20Files/Picture%20Compression): `Upload Insecure Files/Picture Compression`
- [Image metadata payload](https://github.com/iamthefrogy/payloadsallthethings/blob/master/Upload%20Insecure%20Files/Picture%20Metadata/Build_image_to_LFI.py): `Upload Insecure Files/Picture Metadata/Build_image_to_LFI.py`

### Testing utilities

- [WebSocket harness](https://github.com/iamthefrogy/payloadsallthethings/blob/master/Web%20Sockets/Files/ws-harness.py): `Web Sockets/Files/ws-harness.py`

### Other components

- **Security assessor**
- **Test target**

## Connections

- Security assessor → CVE exploit collection: consults
- Security assessor → File inclusion: selects technique
- Security assessor → SSRF: selects technique
- Security assessor → Deserialization: selects technique
- Security assessor → Insecure uploads: selects technique
- Security assessor → Jenkins exploit: runs exploit
- Security assessor → Telerik exploit: runs exploit
- Jenkins exploit → Test target: queries and connects
- Telerik exploit → Test target: sends requests
- Security assessor → LFI to RCE: runs helper
- LFI to RCE → Test target: sends request
- Security assessor → PHPInfo LFI: runs helper
- PHPInfo LFI → Test target: sends HTTP requests
- Security assessor → SSRF variants: runs generator
- Security assessor → Ruby gadget verifier: runs verifier
- Security assessor → FFmpeg AVI generators: generates AVI
- Security assessor → Image payload generators: generates image
- Security assessor → Image metadata payload: generates PNG
- Security assessor → WebSocket harness: runs harness
- WebSocket harness → Test target: sends WebSocket message