Skip to content

PayloadsAllTheThings (PATT) integration and 50+ added payload files across 35+ attack categories#13

Open
Stickman230 wants to merge 22 commits intotransilienceai:mainfrom
Stickman230:main
Open

PayloadsAllTheThings (PATT) integration and 50+ added payload files across 35+ attack categories#13
Stickman230 wants to merge 22 commits intotransilienceai:mainfrom
Stickman230:main

Conversation

@Stickman230
Copy link

@Stickman230 Stickman230 commented Mar 14, 2026

Integrated & addapted payloads from https://github.com/swisskyrepo/PayloadsAllTheThings

Interates directly into the attacks/ tree, filling coverage gaps for categories that previously had no copy-paste payloads.

What's added:

  • 50+ payload files across P0/P1/P2 priority categories, each under attacks//payloads/
  • PATT_STANDARD.md — curation standard for future contributions
  • A patt-fetcher agent (Haiku) for on-demand long-tail payload lookup
  • Updated README.md with changes

Ranking

  • P0 (Critical): SQLi, XSS, Command Injection, SSTI, XXE, SSRF, Path Traversal, LFI/RFI/Wrappers, LDAP, NoSQL MongoDB, Active Directory, Privilege Escalation, Reverse Shells, Hash Cracking, Network Pivoting, Persistence, Evasion, Mass Assignment, Open Redirect, OAuth
  • P1 (Importrant): NoSQL Redis/Cassandra, SAML, CORS, Race Conditions, Deserialization Java/PHP, Type Juggling, Prototype Pollution
  • P2 (Added support): AWS, Azure, DNS, GraphQL, Hashcat rules — all token-optimized

Design decisions:

  • Payloads injected into existing attacks/ tree (no new parallel skill)
  • All files < 200 lines, optimized for developer self-testing (no install steps, no post-exploitation bloat)
  • Full PATT source metadata in each file's frontmatter for traceability

This pull requests contributes directly to theses points in the community guidelines

    1. Improve Documentation
    1. Contribute Code
    1. Add New Tools

Stickman230 and others added 22 commits March 13, 2026 23:24
@Stickman230
docs: add PATT_STANDARD.md — integration standard for future sessions
775b2d1
@Stickman230
feat: add patt-fetcher Haiku agent for on-demand PATT payload lookup
ad9a43e
@Stickman230
feat: add P0 injection payload files (SQL, XSS, CMDi, SSTI, XXE, SSRF…
75f1458 
…, path traversal, LFI, LDAP, NoSQL)
@Stickman230
feat: add P0 system and web payload files (AD, privesc, shells, hash …
8461fd3 
…cracking, pivoting, persistence, evasion, mass assignment, open redirect, OAuth)
@Stickman230 @claude
feat: complete PATT integration chunks 4-5 (enrichment, stubs, SKILL.md)
8724f0d 
Chunk 4 enrichments:
- sql-injection.md: add second-order SQLi + MSSQL xp_cmdshell section
- ssti-cheat-sheet.md: add sandbox escape via Python class hierarchy + filter bypass

Chunk 5 P1 stubs (priority: high):
- nosql-injection/payloads/redis.md
- nosql-injection/payloads/cassandra.md
- cors/payloads/misconfigs.md
- race-conditions/payloads/techniques.md
- prototype-pollution/payloads/basic.md
- saml-injection/payloads/basic.md
- deserialization/payloads/java.md
- deserialization/payloads/php.md
- type-juggling/payloads/basic.md

Chunk 5 P2 stubs (priority: medium):
- aws/payloads/techniques.md
- azure/payloads/techniques.md
- dns/payloads/techniques.md
- hash-cracking/payloads/rules.md
- graphql/payloads/injection.md

SKILL.md: append Payload Reference section

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stubs — NoSQL Redis and Cassandra payloads
6b645ca 
Redis: SSRF/Gopher RCE, CONFIG SET webshell/crontab/SSH, slave replication
RCE (4.x/5.x), CRLF injection, Lua eval, auth brute force. Gopherus tool noted.
Cassandra: CQL injection patterns, UDF Java RCE (pre-3.0), keyspace enum via
system_schema, default creds (cassandra/cassandra), PHAR-style analysis.
Note: PATT NoSQL README is MongoDB-only; content curated from security research.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stub — SAML Injection payloads
d4e79f0 
Signature stripping, XML comment injection (NameID fragmentation), XXE inside
SAML response, XSLT RCE via Transform, XSW1/3/7 patterns, SSRF via XSLT
unparsed-text(), bypass table for null bytes/case/whitespace/base64 NameID.
Tools: SAMLRaider, XSW plugin, ZAP SAML Support.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stub — CORS Misconfiguration payloads
3c46008 
Origin reflection exploit (XHR + fetch), null origin via data: iframe, regex
bypass patterns (prefix/suffix/dot injection), detection header checklist,
multi-origin test list, POST with CORS, internal pivot via wildcard.
Tools: Corsy, CORScanner, CorsOne, of-cors.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stub — Race Condition payloads
8793725 
HTTP/2 single-packet attack (Burp parallel group), Turbo Intruder basic +
multi-endpoint templates, HTTP/1.1 last-byte sync, limit-overrun target
checklist (gift cards, votes, 2FA, TOCTOU), rate-limit bypass patterns.
Tools: Turbo Intruder, Raceocat, h2spacex.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stubs — Deserialization Java and PHP payloads
223723f 
Java: detection magic bytes (AC ED/rO0), ysoserial gadget chains (CC1/CC6/
Groovy1/URLDNS), Jackson CVEs (2017-7525, 2017-17485, 2019-12384, 2020-36180),
SnakeYAML RCE, JSF ViewState secrets + tools.
PHP: unserialize() magic methods (__wakeup/__destruct/__toString), type juggling
auth bypass, phpggc gadget chains (Laravel/Symfony/Monolog), PHAR deserialization
via file functions, JPEG magic bytes bypass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stub — Type Juggling payloads
793862f 
PHP loose == bypass table, boolean serialized auth bypass, magic hash collisions
(MD5/SHA1 with 0e prefix), HMAC bypass via brute-force, switch/case juggling,
array comparison bypass ([] == false), strcmp([], x) null return.
Mitigation: === strict comparison, PHP 8 saner string comparisons.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
docs: P1 enrichment — add missing PATT techniques to existing cheat s…
95d5525 
…heets

nosql-injection-cheat-sheet.md:
- Redis injection via SSRF/Gopher (RCE goals table, Gopherus reference)
- CRLF injection into Redis stream
- Cassandra CQL injection, UDF Java RCE, default creds, keyspace enum

insecure-deserialization-cheat-sheet.md:
- Jackson CVE payloads (2017-7525, 2017-17485, 2019-12384, 2020-36180)
- SnakeYAML RCE payload
- JSF ViewState hardcoded secrets table + decode commands
- PHAR deserialization via file functions + JPEG magic byte bypass
- Reference-based R: collision technique

race-conditions-cheat-sheet.md:
- h2spacex (Scapy HTTP/2 single-packet library)
- Raceocat tool with CLI examples
- State machine disruption: partial object construction + null token race

cors-cheat-sheet.md:
- CorsOne fast discovery tool
- of-cors for internal network wildcard exploitation
- Preflight cache poisoning technique (missing Vary: Origin)

All additions tagged <!-- PATT enrichment 2026-03-14 -->

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P1 stub — Prototype Pollution payloads + cheat sheet enric…
d10799e 
…hment

payloads/basic.md: CSPP URL payloads, SSPP JSON vectors, Express.js gadgets,
EJS escapeFunction RCE, NODE_OPTIONS RCE, auth bypass via config pollution,
bypass table, tools list (pp-finder, PPScan, silent-spring).

prototype-pollution-cheat-sheet.md (PATT enrichment 2026-03-14):
- Added pp-finder, silent-spring, BlackFan collection, yuske SSPP gadget DB
- EJS escapeFunction RCE gadget
- Node.js NODE_OPTIONS env injection RCE
- Kibana CVE-2019-7609 canonical reference

Completes all P1 stubs: NoSQL Redis/Cassandra, SAML, CORS, Race Conditions,
Deserialization Java/PHP, Type Juggling, Prototype Pollution (9 total).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat: fill P2 stubs — AWS, Azure, DNS, Hash Cracking rules, GraphQL i…
76981ae 
…njection payloads

Curated PATT content for all 5 P2 payload stubs:
- AWS techniques: IMDS v1/v2 SSRF, S3 enumeration, IAM privesc paths, Pacu, credential abuse
- Azure techniques: IMDS token theft, ARM API abuse, Key Vault extraction, MicroBurst, elevateAccess
- DNS techniques: zone transfer (AXFR), rebinding setup via Singularity, subdomain takeover, DNS tunneling, SSRF bypass
- Hash cracking rules: rule file reference (best64/OneRule/d3ad0ne/dive), wordlist sources (CrackStation/SecLists), mask/hybrid attacks, CUPP/CeWL, hashcat optimisation
- GraphQL injection: introspection, batching brute-force, alias bypass, IDOR, SSRF, NoSQL/SQLi, DoS nesting, Clairvoyance for disabled introspection

Also restored 9 accidentally-deleted working-tree files (file-inclusion, nosql-redis, file-upload, reverse-shells, race-conditions-labs) from HEAD — content unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
refactor: optimize P2 payload files for token efficiency
35ed0f9 
Removed low-value content across all 5 files (~60 lines cut):
- AWS: deduplicated get-caller-identity, removed redundant IMDS endpoint list
- Azure: collapsed ARM API curl block to 3 lines, ROADtools to 2 lines
- DNS: removed Cache Poisoning (resolver-level, not app pentest) and DNS Tunnel (post-exploitation) sections
- Hash Cracking: replaced RainbowCrack build commands with online lookup URLs, removed PACK/statsgen niche workflow
- GraphQL: trimmed IDOR to 2 examples, DoS to single payload

All sections retain maximum signal for developer self-testing use case.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
refactor(p0-payloads): token audit — remove post-exploit and placehol…
d5be063 
…der content

- tunneling.md: remove Meterpreter pivoting section (MSF post-exploitation,
  not relevant for developer self-test)
- evasion/windows.md: remove incomplete ETW bypass section (placeholder
  '...' literal, non-functional code)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
docs(readme): reflect PATT payload integration
55c2f7f 
- Add curated PATT payload files to What's Inside and feature list
- Update repo structure to show attacks/<category>/payloads/ layout
- Add patt-fetcher agent to orchestration agents
- Add payload files row to project stats table (50+ files, P0/P1/P2)
- Mark AWS/Azure cloud payload coverage as complete in roadmap

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
feat(structure): restructure repo into multi-plugin marketplace layout
c4634ca 
- Add .claude-plugin/plugin.json and marketplace.json at repo root
- Create plugins/ directory with 5 independent plugins:
  - pentest: core pentest framework (3 agents, 6 skills)
  - hackerone: bug bounty integration (1 agent, 1 skill)
  - ai-threat-testing: OWASP LLM Top 10 (10 agents, 1 skill)
  - techstack-identification: recon suite (5 agents, 26 skills, hooks)
  - skiller: skill creation meta-tool (1 agent, 1 skill)
- Each plugin has its own .claude-plugin/plugin.json
- Flatten all content from .claude/ and projects/ into plugin roots
- Remove legacy .claude/agents/, .claude/skills/, projects/pentest/.claude/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
fix(techstack-identification): wire hooks properly for plugin format
633fce6 
- Move hook scripts from hooks/skills/ to hooks/scripts/
- Add hooks.json mapping lifecycle events to scripts:
  - PreToolUse (Bash|WebSearch|WebFetch): network check + rate limit check
  - PostToolUse (*): execution logging and evidence capture

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230 @claude
docs(readme): rewrite to reflect multi-plugin marketplace structure
139714f 
- Replace .claude/ path references with plugins/ structure
- Document all 5 plugins: pentest, hackerone, ai-threat-testing,
  techstack-identification, skiller
- Add plugin install commands as primary installation method
- Update architecture diagram and repository structure section
- Add techstack hooks documentation
- Update stats table with accurate counts
- Add OWASP LLM Top 10 coverage to feature list

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Stickman230
Merge pull request #1 from Stickman230/feature/claude-plugin-marketpl…
5c40340 
…ace-structure

Feature/claude plugin marketplace structure
@Stickman230 @claude
fix(gitignore): track plugin manifests excluded by *.json rule
701f962 
- Add negation rules to allow .claude-plugin/plugin.json and
  marketplace.json through the blanket *.json gitignore
- Force-add all 7 plugin manifest files now visible to git

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Stickman230