Exploit for Payloader

Name: Exploit for Payloader
Rating: 5 (259 reviews)
2026-02-14 | CVSS 6.1
## https://sploitus.com/exploit?id=3D18327A-F332-51BF-9535-FE35DBD709BA
# ⚡ Payloader - Penetration Testing Aids

[! [React](https://img.shields.io/badge/React-19.2-61DAFB?logo=react&logoColor=white)](https://react.dev)
[! [TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org)
[! [Vite](https://img.shields.io/badge/Vite-8.0-646CFF?logo=vite&logoColor=white)](https://vite.dev)
[! [License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[! [Bilingual](https://img.shields.io/badge/i18n-中文%20%7C%20English-orange)](https://github.com/3516634930/Payloader)



---

## 📸 Preview of features

### Main Interface - Attack Category Navigation
> Tree navigation on the left side covers 23 types of web attacks + 11 types of intranet penetration, with quick tips on the right side to get you started.

! [Main Interface](screenshots/1-home.png)

### 🔗 Attack Chain Visualization - Complete Path from Reconnaissance to Exploitation
> **Core highlights**: Each Payload is equipped with a visual attack chain, with node flow charts to show the complete attack steps from "detecting injection points → determining the number of columns → determining the echo position → extracting data", so even novices can follow the attack step by step.

! [Attack chain visualization](screenshots/3-attack-chain.png)

### 🎓 Detailed tutorial - Vulnerability Principle + Exploitation Methods + Defensive Schemes
> Each Payload comes with a full tutorial:** Overview → Vulnerability Principles → Exploitation Methods → Defensive Measures** that doesn't just give you the commands, but teaches you why you fight the way you do!

! [Detailed tutorial](screenshots/2-tutorial.png)

### 💻 Execute commands - step-by-step + syntax parsing + one-click copying
> Separate command blocks for each step, support for **syntax highlighting** (19 colors) and **one-click copying**, just take it and use it!

! [Execute Commands](screenshots/4-commands.png)

### 🛠️ Tools Command Set - Penetration Tools Quick Reference Manual
> Built-in 114 commonly used commands for Nmap, SQLMap, Burp Suite, Metasploit, etc., each with Chinese description and syntax analysis.

! [tool commands](screenshots/5-tools.png)

### 🔐 Codec Tools - URL / Base64 / Hex / HTML / Unicode / JWT
> Built-in smart codecs, invoked at any time during the penetration process, support for 6 encoding formats to each other

! [Codec Tool](screenshots/6-encoder.png)

---

# 🇨🇳 Chinese documentation

## Project Profile

**Payloader** is a bilingual, interactive security payload reference platform for security researchers, penetration test engineers and red team members.

The project brings together **300+ carefully organized attack and defense payloads**, covering two major areas: web application security and intranet penetration, each payload contains a complete attack chain step by step, syntax highlighting and parsing, WAF/EDR bypassing scheme and learning tutorials.

> ⚠️ **Disclaimer**: This project is only for legally authorized security testing, learning and research, and defense reinforcement. Users are required to comply with local laws and regulations, and any unauthorized attacks have nothing to do with this project.

## Features

### Core Capabilities

| Functionality | Description |
|------|------|
| **178 Web Loads** | 23 Categories - From Classic SQL Injection to AI Security | **129 Intranet Loads** | 11 Categories - Information Gathering, Credential Theft, Lateralization, Security
| **129 Intranet Loads** | 11 Categories - Information Gathering, Credential Theft, Lateral Movement, Domain Attacks | **114 Tools
| **114 tool commands** | Nmap, SQLMap, Burp Suite, Metasploit, and more |
| **Complete Attack Chain** | Each payload contains reconnaissance → identification → exploitation → post-penetration steps (3+ steps) |
| **WAF/EDR Bypasses** | 176 Web Loads with specialized bypass variants |
| **Syntax Highlighting Analysis** | 4,700+ Syntax Breakdown entries, 19 color-coding types |
| **Learning Tutorials** | 177 loads with full tutorials (overview/vulnerability rationale/exploitation/defense scheme) |

### Interactive features

| Functions | Description |
|------|------|
| 🌐 **Chinese/English Bilingual Switching** | One-click switch Chinese/English interface, default Chinese |
| 🌓 **Dark/Bright Mode** | User-level theme preference, auto-save |
| 🔗 **Attack chain visualization** | Node-based attack step-by-step flowchart |
| 📋 **One-click copying** | Copy single step or all commands, support variable substitution |
| 🔍 **Global Search** | Real-time fuzzy search by name/description/label/category |
| 🔄 **Global Variable Replacement** | Define variables like TARGET_IP, DOMAIN, etc. and replace them automatically across the platform | |

## Local use

### Environment requirements

- **Node.js** >= 18.0
- **npm** >= 8.0 (or pnpm / yarn)

### Installation and startup

```bash
# 1. Clone the project
git clone https://github.com/3516634930/Payloader.git
cd Payloader

# 2. Install the dependencies
npm install

# 3. Start the development server
npm run dev
``

Once started, open `http://localhost:5173` in your browser.

### Build the production version

``bash
npm run build
``

The build product is in the `dist/` directory, and is a pure static file (HTML + CSS + JS) that can be used by opening `dist/index.html` in your browser.

## Server deployment

The Payloader build is a purely static site, no backend services are required, and any way to host static files is fine.

### Way 1: Nginx deployment (recommended)

```bash
# 1. Build locally
npm run build

# 2. Upload the dist/ directory to the server
scp -r dist/ user@your-server:/var/www/payloader

# 3. Configure Nginx
```

Nginx configuration example:

```nginx
server {
listen 80; server_name your-domain.com;
server_name your-domain.com; ``nginx server { listen 80; server_name your-domain.com

root /var/www/payloader;
root /var/www/payloader; index index.html;

location / {
try_files $uri $uri/ /index.html; }
}

# Static resource caching
location /assets/ {
expires 1y; add_header Cache-Control "public, immutable"; }
add_header Cache-Control "public, immutable";
}

# Enable gzip compression
gzip on; gzip_types text/plain text/css
gzip_types text/plain text/css application/json application/javascript text/xml; }
}
``

```bash
# 4. reloading Nginx
sudo nginx -t && sudo nginx -s reload
```

### Way 2: Docker deployment

Create a `Dockerfile` in the root directory of your project:

``dockerfile
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json . /
RUN npm install
COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]
``

Then run it:

``bash
# Build the image
docker build -t payloader .

# Start the container
docker run -d -p 8080:80 --name payloader payloader
``

Just visit `http://your-server:8080`.

### Way 3: Preview directly with Node.js

``bash
# Build and preview on the server
npm run build
npm run preview -- --host 0.0.0.0 --port 8080
```

> Note: `vite preview` is not suitable for production environments with high concurrency, use it only for quick preview or intranet use.

### Way 4: GitHub Pages / Vercel / Netlify

Import your repository directly into these platforms, set the build command to `npm run build` and the output directory to `dist`, and you can deploy it automatically.

## Stats

### Web Application Security - 23 categories, 178 loads

| Classification | Load Count |
|------|--------|
| SQL/NoSQL injection (MySQL/MSSQL/Oracle/PostgreSQL/SQLite/MongoDB/Redis) | 17 |
| XSS Cross-Site Scripting (Reflective/Stored/DOM/mXSS/CSP Bypass) | 12 |
| SSRF server-side request forgery (AWS/GCP/Azure metadata, DNS rebinding) | 12 |
| RCE Remote Code Execution (PHP/Command Injection/Deserialization/File Upload) | 12 |
| XXE XML External Entity Injection (Blind Injection/OOB/File Read/XLSX/DOCX) | 9 |
| SSTI template injection (Jinja2/FreeMarker/Velocity/Thymeleaf and other 10 engines) | 10 |
| LFI/RFI File Inclusion (Wrappers/Log Poisoning/Phar Deserialization) | 12 | CSRF Cross-Site Request Injections (CSRF)
| CSRF Cross-Site Request Forgery (JSON/SameSite bypass/Token bypass) | 7 |
| API Security (GraphQL/REST/JWT/IDOR/BOLA/Bulk Assignments) | 12 |
| Framework Vulnerabilities (Spring/Struts2/WebLogic/ThinkPHP/Fastjson/Log4j/Shiro) | 18 |
| Authentication Vulnerabilities (Bypass/Blast/OAuth/SAML/2FA) | 10 |
| File Vulnerabilities (Upload Bypass/Arbitrary Download/Competing Conditions/Zip Slip) | 8 |
| Cache and CDN Security (Cache Poisoning/Cache Spoofing/CDN Bypass) | 3 |
| HTTP Request Smuggling (CL-CL/CL-TE/TE-CL/TE-TE) | 4 |
| Open Redirection (Basic/Bypass/Redirect to SSRF) | 3 |
| Clickjacking (Basic/Combined with XSS) | 2 |
| Business Logic Vulnerabilities (IDOR/Competitive Conditions/Price Tampering/Process Bypass) | 5 |
| JWT Security (None Algorithm/Weak Keys/KID Injection/JKU Forgery) | 4 |
| Supply Chain Attacks (Counterfeit Packets/CI-CD Poisoning/Dependency Obfuscation) | 3 |
| Prototype Chain Pollution (Server-side RCE/Client-side XSS/NoSQL Injection) | 3 |
| Cloud Security (SSRF Metadata/S3 Misconfiguration/IAM Privileging/K8s Escape) | 4 |
| WebSocket Security (Hijacking/Smuggling/Authentication Bypass) | 3 |
| AI Security (Prompt Injection / Model Stealing / Adversarial Samples / RAG Poisoning) | 4 |

### Intranet Penetration - 11 categories, 129 loads

| Classification | Description |
| ------|------|
| Information Gathering | BloodHound/SPN Scanning/Port Scanning/Domain Information/ACL Enumeration |
| Credential Stealing | Mimikatz/Kerberoasting/AS-REP Roasting/SAM&NTDS/DPAPI |
| Lateral Move | PsExec/WMI/Pass-the-Hash/NTLM Relay/WinRM/DCOM/RDP | Privilege Enhancement | Token Enumeration | Credentials Stealing
| Privilege Boost | Token Stealing/UAC Bypass/DLL Hijacking/Potato/SUID/Sudo/Kernel |
| Privilege Maintenance | Registry/Scheduled Tasks/WMI Events/Golden Ticket/Silver Ticket/Masterkey |
| Tunneling and Proxies | FRP/Chisel/SSH/DNS/ICMP/Ligolo/EW |
| Domain Attacks | Zerologon/PrintNightmare/PetitPotam/DCSync/DCShadow/ADCS |
| ADCS Attacks | ESC1-ESC8 Full Attack Chain |
| No Kill Bypass | AMSI Bypass/ETW Patch/API Decoupling/Process Injection/DLL Sideloading |
| Exchange Attacks | ProxyLogon/ProxyShell/ProxyToken/Mailbox Access |
| SharePoint Attacks | Enumeration/File Access |

### Tool Commands - 8 categories, 114 commands

Reconnaissance (Nmap/Masscan/Gobuster/Amass), Web Penetration (SQLMap/Burp/Nikto), Vulnerability Exploitation (Metasploit/ysoserial), Cryptographic Attacks (Hydra/Hashcat/John), Intranet (CrackMapExec/ Impacket/Rubeus), system commands, bounce shell (12 languages), encoding and decoding.

## User's Guide

### Browse Load

1. Select **Web Application** or **Intranet Penetration** from the left navigation bar.
2. Expand the category tree and click on the payload to view the details.
3. Details include: execution steps, WAF bypass, attack chain visualization, tutorials.

### Language switching

Click the **Chinese/EN** button on the top bar to switch between English and Chinese. Preferences are automatically saved.

### Global Search

Input keywords (e.g. `SQL Injection`, `Mimikatz`, `SSRF`) in the top search bar, and the sidebar filters the matching results in real time.

### Global variable replacement

1. Click the **🔧 Variables** button in the top bar to open the Variables panel.
2. Set the variable, e.g. `TARGET_IP` = `192.168.1.100`
3. All `{{TARGET_IP}}` placeholders in the load are automatically highlighted and replaced.
4. The copied command includes variable substitution

Built-in default variables:

| variable name | default value | usage |
|--------|--------|------|
| `TARGET_IP` | `192.168.1.100` | target IP |
| `TARGET_DOMAIN` | `target.com` | Target Domain |
| `ATTACKER_IP` | `10.10.14.1` | Attacker IP |
| `LPORT` | `4444` | listener port |

## Project structure

``
Payloader/
├── public/ # Static resources
├── src/
│ ├── App.tsx # Entry & global state
│ ├── main.tsx # React mount points
│ ├── i18n/
│ │ └── index.ts # Internationalization System (Chinese/English)
│ ├── components/
│ │ ├── Header.tsx # Topbar (theme/search/language/variables)
│ │ ├── Sidebar.tsx # Side Navigation (Tree/Search Filter)
│ │ ├── MainContent.tsx # Main content routing
│ ├── PayloadDetail.tsx # Load details (attack chaining/copying/highlighting)
│ │ ├── ToolDetail.tsx # Tool command details
│ │ ├── SyntaxModal.tsx # Syntax decomposition popup (19 colors)
│ └── EncodingTools.tsx # Encoding and decoding tools
│ ├── data/
│ │ ├── webPayloads.ts # Web load data (18,700+ rows)
│ │ ├── intranetPayloads.ts # Intranet Payloads (5,900+ rows)
│ │ ├── toolCommands.ts # Tool Commands data (3,800+ rows)
│ │ └── navigation.ts # Navigation tree definition
│ ├── types/
│ │ └─ index.ts # TypeScript type definitions
│ └─ styles/
│ └── global.css # Global styles (dark/light theme variables)
├── index.html
├── vite.config.ts
├── tsconfig.json
└── package.json
``

## Technology stack

| technology | version | usage |
|------|------|------|
| [React](https://react.dev) | 19.2 | UI Framework |
| [TypeScript](https://www.typescriptlang.org) | 5.9 | TypeSafe |
| [Vite](https://vite.dev) | 8.0 (beta) | Build Tools |
| Self-Developed i18n | - | Bilingual Systems |
| CSS Variables | - | Theme System | localStorage | - - | Themes
| localStorage | - | User Preferences Persistence | - | LocalStorage | - | LocalStorage | - | User Preferences Persistence

**Zero External UI Dependencies** - No UI libraries, pure handwritten CSS, extremely lightweight.


# 🇬🇧 English Documentation

## Screenshots

> See [📸 Feature Preview](#-Feature Preview) above for full screenshots - Attack Chain Visualization, Step-by-step Tutorials, Tool Commands, and Encoding Tools.

## About

**Payloader** is a bilingual (Chinese/English) interactive security payload reference platform for security researchers, penetration testers, and red teamers.

It features **300+ curated payloads** across Web application security and intranet penetration, each with complete attack chain steps, syntax- It features **300+ curated payloads** across Web application security and intranet penetration, each with complete attack chain steps, syntax- highlighted breakdowns, WAF/EDR bypass variants, and learning tutorials.

> ⚠️ **Disclaimer**: This project is for authorized security testing, learning, and defense hardening only. Users must comply with local laws. Any unauthorized attacks are unrelated to local security. unauthorized attacks are unrelated to this project.

## Features

### Core

| Feature | Description
|---------|-------------|
| **178 Web Payloads** | 23 categories - from classic SQL injection to AI security | | **129 Intranet Payloads** | 11 categories - recon, credential theft, lateral movement, domain attacks
| **129 Intranet Payloads** | 11 categories - recon, credential theft, lateral movement, domain attacks |
| **114 Tool Commands** | Nmap, SQLMap, Burp Suite, Metasploit and more |
| **Full Attack Chains** | Each payload has recon → identify → exploit → post-exploit steps (3+) |
| **WAF/EDR Bypass** | 176 Web payloads include dedicated WAF bypass variants |
| **Syntax Highlighting** | 4,700+ syntax breakdown entries with 19 color-coded types |
| **Tutorials** | 177 payloads with full tutorials (overview / vulnerability / exploitation / defense) |

### Interactive

| Feature | Description |
|---------|-------------|
| 🌐 **Bilingual i18n** | Full Chinese ↔ English toggle, default Chinese |
| 🌓 **Dark / Light Mode** | Per-user theme with auto-saved preference |
| 🔗 **Attack Chain Visualization** | Node-based visual flow of attack steps |
| 📋 **One-click Copy** | Copy single step or all commands with variable substitution |
| 🔍 **Global Search** | Real-time fuzzy search by name / description / tag / category |
| 🔄 **Global Variables** | Define TARGET_IP, DOMAIN, etc. - auto-replace in all payloads |

| auto-replace in all payloads | Local Usage

### Requirements

- **Node.js** >= 18.0
- **npm** >= 8.0 (or pnpm / yarn)

### Install & Run

```bash
# 1. Clone the repository
git clone https://github.com/3516634930/Payloader.git
cd Payloader

# 2. Install dependencies
npm install

# 3. Start dev server
npm run dev
```

Open `http://localhost:5173` in your browser.

### Build for Production

``bash
npm run build
``

Output goes to `dist/` - pure static files (HTML + CSS + JS). You can open `dist/index.html` directly in a browser.

## Server Deployment

Payloader builds into a pure static site - no backend required. Any static file hosting works.

### Option 1: Nginx (Recommended)

```bash
# 1. Build locally
npm run build

# 2. Upload dist/ to your server
scp -r dist/ user@your-server:/var/www/payloader

# 3. Configure Nginx (see below)
```

Nginx config example.

```nginx
server {
listen 80; server_name your-domain.com; server_name
server_name your-domain.com; ```nginx server { listen 80; server_name your-domain.com; server_name

root /var/www/payloader;
root /var/www/payloader; index index.html;

location / {
try_files $uri $uri/ /index.html; }
}

# Cache static assets
location /assets/ {
expires 1y; add_header Cache-Control "public, immutable"; }
add_header Cache-Control "public, immutable"; }
}

# Enable gzip
gzip on; gzip_types text/plain text/css application/json application/javascript
gzip_types text/plain text/css application/json application/javascript text/xml; }
}
``

```bash
# 4. Reload Nginx
sudo nginx -t && sudo nginx -s reload
```

### Option 2: Docker

Create a `Dockerfile` in the project root.

``dockerfile
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json . /
RUN npm install
COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]
``

Then run.

``bash
# Build image
docker build -t payloader .

# Start container
docker run -d -p 8080:80 --name payloader payloader
``

Visit `http://your-server:8080`.

### Option 3: Node.js Preview Server

``bash
# Build and preview on server
npm run build
npm run preview -- --host 0.0.0.0 --port 8080
```

> Note: `vite preview` is not suitable for production high-traffic use. Use it for quick preview or internal use only.

### Option 4: GitHub Pages / Vercel / Netlify

Import the repository into any of these platforms. Set build command to `npm run build` and output directory to `dist`. Deployment is automatic.

## Data Stats

### Web Application Security - 23 Categories, 178 Payloads

| Category | Count | Payloads
|----------|-------|
| SQL/NoSQL Injection (MySQL/MSSQL/Oracle/PostgreSQL/SQLite/MongoDB/Redis) | 17 |
| XSS (Reflected/Stored/DOM/mXSS/CSP Bypass) | 12 |
| SSRF (AWS/GCP/Azure metadata, DNS rebinding) | 12 |
| RCE (PHP/Command Injection/Deserialization/Upload) | 12 |
| XXE (Blind/OOB/File Read/XLSX/DOCX) | 9 |
| SSTI (Jinja2/FreeMarker/Velocity/Thymeleaf + 6 more) | 10 |
| LFI/RFI (Wrappers/Log Poisoning/Phar Deserialization) | 12 | CSRF (JSON/Log Poisoning/Phar Deserialization)
| LFI/RFI (Wrappers/Log Poisoning/Phar Deserialization) | 12 | CSRF (JSON/SameSite bypass/Token bypass) | 7 |
| API Security (GraphQL/REST/JWT/IDOR/BOLA/Mass Assignment) | 12 |
| Framework Vulnerabilities (Spring/Struts2/WebLogic/ThinkPHP/Fastjson/Log4j/Shiro) | 18 |
| Auth Vulnerabilities (Bypass/Brute Force/OAuth/SAML/2FA) | 10 |
| File Vulnerabilities (Upload Bypass/Arbitrary Download/Race Condition/Zip Slip) | 8 |
| Cache & CDN Security | 3 | HTTP Request Smuggling
| HTTP Request Smuggling (CL-CL/CL-TE/TE-CL/TE-TE) | 4 |
| Open Redirect | 3 | | Clickjacking | | Clickjacking | | Clickjacking
| Clickjacking | 2 | Business Logic Vulns
| Business Logic Vulns (IDOR/Race Condition/Price Tampering) | 5 | JWT Security (None)
| JWT Security (None Algorithm/Weak Key/KID Injection/JKU Spoofing) | 4 | | Supply Chain Attacks
JWT Security (None Algorithm/Weak Key/KID Injection/JKU Spoofing) | 4 | Supply Chain Attacks | 3 |
| Prototype Pollution | 3 | Cloud Security (SSRF)
| Cloud Security (SSRF Metadata/S3/IAM/K8s) | 4 | | WebSocket Security | 4
| Cloud Security (SSRF Metadata/S3/IAM/K8s) | 4 | | WebSocket Security | 3 |
| AI Security (Prompt Injection/Model Stealing/Adversarial/RAG Poisoning) | 4 | | Cloud Security (SSRF Metadata/S3/IAM/K8s) | 4 | | WebSocket Security

### Intranet Penetration - 11 Categories, 129 Payloads

Reconnaissance, Credential Theft, Lateral Movement, Privilege Escalation, Persistence, Tunneling & Proxy, Domain Attacks, ADCS Attacks (ESC1-ESC8 ), Evasion, Exchange Attacks, SharePoint Attacks.

### Tool Commands - 8 Categories, 114 Commands

 John), Intranet (CrackMapExec/Impacket/Rubeus), System Commands, Reverse Shells (12 languages), Encoding/Decoding.

## Usage Guide

### Browse Payloads
1. Select **Web Application** or **Intranet Penetration** from the sidebar
2. Expand the category tree, click a payload to view details
3. Details include: execution steps, WAF bypass, attack chain visualization, tutorial

### Language Toggle
Click the **Chinese/EN** button in the top bar to switch languages. Preference is auto-saved.

### Global Search
Type keywords in the search bar (e.g. `SQL Injection`, `Mimikatz`, `SSRF`). The sidebar filters in real-time.

### The sidebar filters in real-time.
1. Click **🔧 Variables** in the top bar
2. Set variables like `TARGET_IP` = `192.168.1.100`. 3.
3. All `{{TARGET_IP}}` placeholders auto-replace with highlights
4. Copied commands include variable substitution

| Variable | Default | Purpose |
|----------|---------|---------|
| `TARGET_IP` | `192.168.1.100` | Target IP |
| `TARGET_DOMAIN` | `target.com` | Target domain |
| `ATTACKER_IP` | `10.10.14.1` | Attacker IP |
| `LPORT` | `4444` | Listen port |

| | `LPORT` | `4444` | Listen port | ## Project Structure

| `4444` | Listen port | ## Project Structure
Payloader/
public/ # Static assets
├── src/ │ ├── App.tsx # Entry & global state
│ ├── App.tsx # Entry & global state
│ ├── main.tsx # React mount point
│ ├── i18n/ │ └── i18n/ # React mount point
│ └── index.ts # i18n system (zh/en)
│ ├── components/
│ │ ├── Header.tsx # Top bar
│ │ ├── Sidebar.tsx # Side navigation
│ │ ├── MainContent.tsx # Main content router
│ │ ├── PayloadDetail.tsx # Payload detail
│ │ ├── ToolDetail.tsx # Tool command detail
│ │ ├── SyntaxModal.tsx # Syntax breakdown modal
│ └── EncodingTools.tsx # Encoding/decoding tools
│ ├── data/
│ │ ├── webPayloads.ts # Web payloads (18,700+ lines)
│ ├── intranetPayloads.ts # Intranet payloads (5,900+ lines)
│ │ ├── toolCommands.ts # Tool commands (3,800+ lines)
│ └── navigation.ts # Navigation tree
│ ├── types/
│ └─ index.ts # TypeScript types
│ └─ styles/ │ └─ global.ts # TypeScript types
│ └─ global.css # Global styles (dark/light) │ └─ index.html/ │ └─ global.css # Global styles (dark/light)
├─ index.html
├── vite.config.ts
├── tsconfig.json
└── package.json
```

## Tech Stack

| Tech | Version | Purpose |
|------|---------|---------|
| [React](https://react.dev) | 19.2 | UI Framework |
| [TypeScript](https://www.typescriptlang.org) | 5.9 | Type Safety |
| [Vite](https://vite.dev) | 8.0 (beta) | Build Tool |
| Custom i18n | - | Bilingual System | CSS Variables | - | Bilingual System | - | Bilingual System | - | Bilingual System
| Custom i18n | - | Bilingual System | CSS Variables | - | Theme System | localStorage | - - | LocalStorage
| localStorage | - | User Preference Persistence |

**Zero external UI dependencies** - no UI library, pure handwritten CSS.


## 📄 License

[MIT License](LICENSE)

---



**⭐ If this program was helpful to you, please give a Star!

**⭐ Star this repo if you find it useful!**

[GitHub](https://github.com/3516634930/Payloader)