Exploitation

Payloads

• https://github.com/swisskyrepo/PayloadsAllTheThings
• https://github.com/payloadbox

Metasploit

• Install on server: https://docs.metasploit.com/docs/using-metasploit/getting-started/nightly-installers.html

Public exploits

• https://www.kali.org/tools/exploitdb/#searchsploit

SQL injection (SQLi)

• https://github.com/sqlmapproject/sqlmap
• Tamper agent scripts for sqlmap (WAF bypass): https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423
• https://github.com/r0oth3x49/ghauri

Cross-site scripting (XSS)

• https://github.com/s0md3v/XSStrike
• https://github.com/mandatoryprogrammer/xsshunter

Command Injection

• https://github.com/commixproject/commix

SSRF

• https://github.com/swisskyrepo/SSRFmap