Github · GitHub Repository Radar
swisskyrepo PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Stars
80,605
Forks
17,341
Watchers: 80,605
Language
License: MIT License
Repository Radar Score
65 / 100
Growth
- 7d
- +0
- 30d
- +0
- %
- 0.0%
Not enough metric snapshots yet to chart growth for this repository.
Score breakdown
- popularity 92
- growth 0
- activity 90
- freshness 100
- community 90
Need help integrating this stack?
Our team builds with modern open-source stacks. Tell us what you are shipping.
Get a quote →A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques!
You can also contribute with a 🍻 IRL, or using the sponsor button.
An alternative display version is available at PayloadsAllTheThingsWeb.
Every section contains the following files, you can use the _template_vuln folder to create a new chapter:
- README.md - vulnerability description and how to exploit it, including several payloads
- Intruder - a set of files to give to Burp Intruder
- Images - pictures for the README.md
- Files - some files referenced in the README.md
You might also like the other projects from the AllTheThings family :
- InternalAllTheThings - Active Directory and Internal Pentest Cheatsheets
- HardwareAllTheThings - Hardware/IOT Pentesting Wiki
You want more? Check the Books and YouTube channel selections.
Be sure to read CONTRIBUTING.md
Thanks again for your contribution! ❤️
This project is proudly sponsored by these companies.
| Logo | Description |
|---|---|
 |
SerpApi is a real time API to access Google search results. It solves the issues of having to rent proxies, solving captchas, and JSON parsing. |
 |
ProjectDiscovery - Detect real, exploitable vulnerabilities. Harness the power of Nuclei for fast and accurate findings without false positives. |
 |
VAADATA - Ethical Hacking Services |
Repository Radar analysis
Deterministic insights derived from public metadata and our observations — not personal testing or reviews.
Why this repository is interesting
- High absolute popularity (80,605 stars) signals broad adoption.
- Maintained recently (last push 3 weeks ago).
Who should use it
- Developers working primarily with Python
- Security-minded engineers reviewing tooling options
Potential use cases
- Reference or evaluate Python open-source approaches in this domain
Strengths
- Recent repository activity
- README present in our index
- Declared license: MIT License
- Substantial fork count (17,341) suggests reuse and contribution interest
Limitations / considerations
- Insights are derived from public metadata and our observations — not a substitute for code review
What to watch
- Re-check last push, issues, and releases on GitHub before production adoption
Strong signals: Strong community interest · Active maintenance
Source: GitHub (public metadata) + Repository Radar analysis. We do not claim ownership of third-party repositories.
Similar repositories
home-assistant/core
★ 90,228 · Python · radar 67
huggingface/transformers
★ 164,744 · Python · radar 66
scrapy/scrapy
★ 64,185 · Python · radar 66
TheAlgorithms/Python
★ 224,253 · Python · radar 65
roboflow/supervision
★ 49,863 · Python · radar 65
EbookFoundation/free-programming-books
★ 395,970 · Python · radar 62