🎯 Target Configuration
🚀 Actions
🔍 Attack Payloads
📁 SQL Injection
Basic SQLi - Authentication Bypass
sqli
Union Based SQLi
sqli
Time-Based Blind SQLi (MSSQL)
sqli
MySQL Time-Based Blind
sqli
PostgreSQL Time-Based
sqli
SQLite Time-Based
sqli
Error-Based SQLi
sqli
Stacked Queries (Destructive)
sqli
📁 Cross-Site Scripting (XSS)
Basic Script Alert
xss
Image Onerror Event
xss
SVG Onload Event
xss
XSS Polyglot
xss
DOM-based XSS
xss
SSTI (Server-Side Template Injection)
xss
Angular SSTI
xss
📁 Cross-Site Request Forgery
Invalid CSRF Token
csrf
Missing CSRF Token
csrf
Privileged Action Without Referer
csrf
📁 Command Injection
Basic Command Injection (Linux)
cmdi
Windows Command Injection
cmdi
Blind Command Injection (Time Delay)
cmdi
Backtick Execution
cmdi
$() Command Substitution
cmdi
📁 Path Traversal & LFI
Basic Path Traversal
lfi
Double URL Encoded Traversal
lfi
Null Byte Traversal (Legacy)
lfi
Windows Path Traversal
lfi
PHP Filter Wrapper
lfi
Apache Log File Access
lfi
📁 Server-Side Request Forgery
Localhost Access (IPv4)
ssrf
Localhost Access (IPv6)
ssrf
AWS Metadata Service
ssrf
GCP Metadata Service
ssrf
File Protocol Access
ssrf
DNS Rebinding Test
ssrf
📁 Known CVE Patterns
Log4Shell (CVE-2021-44228)
cve
Shellshock (CVE-2014-6271)
cve
Spring4Shell (CVE-2022-22965)
cve
Apache Struts RCE (CVE-2017-5638)
cve
Ghostscript (CVE-2018-16509)
cve
Fastjson Deserialization (CVE-2017-18349)
cve
📁 Other Web Attacks
XXE - File Extraction
xxe
XXE - Out-of-Band
xxe
NoSQL Injection (MongoDB)
nosql
LDAP Injection
ldap
Open Redirect
redirect
📁 SAP NetWeaver
SAP Code Injection (CVE-2022-22532)
sap
SAP NetWeaver File Upload (CVE-2025-31324)
sap
SAP NetWeaver Deserialization RCE (CVE-2025-42999)
sap