An open-source security testing and vulnerability research reference for security researchers, penetration testers, bug bounty hunters, and developers. OWASP Incubator Project.
A curated reference of testing payloads, attack vectors, and methodology notes — not an automated scanner or exploit framework. Nothing here runs against a target on its own.
31 vulnerability categories, each a directory with a README.md (description, attack vectors, testing approach) and a *-payloads.txt file.
Browse all categories
| Category | Group |
|---|---|
| SQL Injection | Injection |
| NoSQL Injection | Injection |
| XSS | Injection |
| Command Injection | Injection |
| SSTI | Injection |
| SSJI | Injection |
| CSV Injection | Injection |
| LDAP Injection | Injection |
| Log Injection | Injection |
| XML Injection | Injection |
| Prompt Injection | Injection |
| Prototype Pollution | Injection |
| Path Traversal | Access control |
| IDOR | Access control |
| Open Redirect | Access control |
| Authentication Bypass | Auth |
| Password Reset | Auth |
| Weak Passwords | Auth |
| SSRF | Server-side |
| Deserialization | Server-side |
| File Upload | Server-side |
| Symbolic Link Attacks | Server-side |
| Timing Attacks | Server-side |
| Security Misconfiguration | Config & design |
| CORS Misconfiguration | Config & design |
| HTTP Request Smuggling | Config & design |
| JWT Vulnerabilities | Config & design |
| Business Logic | Config & design |
| Weak Cryptography | Config & design |
| Vulnerable Components | Config & design |
| Tor-Based Attacks | Network |
git clone https://github.com/OWASP/OWASP-Hunting.git
cd OWASP-Hunting
cat SQL-Injection/README.md
grep -r "onerror=" XSS/xss-payloads.txtNo build or install step — it's plain Markdown and text files. Read a category's README.md first; it gives the context the payload list assumes.
See CONTRIBUTING.md — workflow, payload standards, PR requirements, and the AI-assisted contribution policy. This project does not run any AI provider internally; the policy covers contributor AI use only.
For authorized testing only — systems you own, systems with explicit written permission, in-scope bug bounty programs, or controlled educational labs. Never against systems you're not authorized to test. See DISCLAIMER.md for full terms, and SECURITY.md to report a security issue in this repo.
MIT — see LICENSE. Copyright OWASP.
Official project page · OWASP Top 10 · OWASP API Security Top 10 · OWASP Testing Guide