## https://sploitus.com/exploit?id=D4F074BD-D3BD-5E33-B39C-A70C8FF5F243
# Burp Intruder Payloads
> You're welcome, hacker!
## About
The primary goal of this project is to explain web vulnerabilities and provide a beneficial resource for the security community. This repo is a ready-to-use collection of payload lists for **Burp Suite Intruder** — SQL injection, XSS, command injection, SSRF, XXE, SSTI, Log4Shell and more. One payload per line, just load into the Payloads tab and go.
Use it for authorized security testing and learning only. Test only systems you own or have permission to test.
## Payload Files
| File | Category |
| --- | --- |
| [sql.txt](sql.txt) | SQL Injection (auth bypass, UNION, time/error-based, WAF bypass) |
| [patht.txt](patht.txt) | Path / Directory Traversal & LFI |
| [xss.txt](xss.txt) | Cross-Site Scripting (XSS) |
| [xss-polyglots.txt](xss-polyglots.txt) | XSS polyglots & universal payloads |
| [cmd.txt](cmd.txt) | Command Injection (Linux / Windows) |
| [ssrf.txt](ssrf.txt) | Server-Side Request Forgery (SSRF) |
| [ssrf-upload.txt](ssrf-upload.txt) | SSRF via upload endpoints |
| [xxe.txt](xxe.txt) | XML External Entity (XXE) |
| [xxe-upload.txt](xxe-upload.txt) | XXE via upload / file content |
| [upload.txt](upload.txt) | File Upload payloads |
| [upload-waf.txt](upload-waf.txt) | File Upload WAF bypass |
| [ssti.txt](ssti.txt) | Server-Side Template Injection (SSTI) |
| [log4j.txt](log4j.txt) | Log4Shell (CVE-2021-44228) payloads |
| [jwt.txt](jwt.txt) | JSON Web Token (JWT) attacks |
| [crlf.txt](crlf.txt) | CRLF Injection |
| [redirect.txt](redirect.txt) | Open Redirect |
| [header.txt](header.txt) | Header injection / IP spoofing bypass |
| [xpath.txt](xpath.txt) | XPath Injection |
| [nosql.txt](nosql.txt) | NoSQL / MongoDB Injection |
| [ldap.txt](ldap.txt) | LDAP Injection |
| [csrf.txt](csrf.txt) | CSRF token / method override bypass |
| [mass-assignment.txt](mass-assignment.txt) | Mass Assignment / Overposting |
| [waf-bypass-payloads.txt](waf-bypass-payloads.txt) | All-in-one WAF bypass collection |
## How to Use in Burp Suite Intruder
1. Open Burp Suite and send a request to your target.
2. Right-click → **Send to Intruder**.
3. In the **Positions** tab, select the parameter you want to test.
4. Go to the **Payloads** tab.
5. Select **Simple list** as the payload type.
6. Click **Load...** and choose a file from this repo.
7. Click **Start attack**.
## Notes
- Replace placeholders such as `evil.com`, `YOUR-SERVER-IP`, and `shell.php` with your own values.
- Some multiline payloads (e.g. XXE) are meant to be used in request bodies, not as simple URL payloads.
## License
MIT