Payload Builder

Quick reference of security test payloads. Click a payload to copy it, then paste into your request. Use responsibly — only on targets you own or have permission to test.

Filter payloads

Click any payload to copy to clipboard.

Payloads

What is Payload Builder?

Build attack payloads for XSS, SQLi, SSTI, SSRF, path traversal, and command injection. Customizable with encoding options.

FAQ

What payload types are available?: XSS (script tags, event handlers), SQLi (UNION, blind, time-based), SSTI (Jinja2, Twig), SSRF (internal IPs), path traversal (../), command injection (;, |).
How do I use these for testing?: Inject payloads into input fields, URL parameters, and headers. Use browser dev tools to observe if the payload executes.

Related Tools

CSRF PoC Generator
JWT Attacker
Regex Tester