wildhunter logo
The arsenal

Payloads.

Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.

SQL InjectionXSSSSRFCommand InjectionSSTIFile Inclusion (LFI)Path TraversalInsecure DeserializationNoSQL InjectionGraphQLJWTCORSRequest SmugglingOpen RedirectFile UploadIDOROAuthAccount TakeoverRace ConditionCRLF InjectionCSRFLDAP InjectionXXEWeb Cache Deception

SQL Injection

Lets an attacker interfere with the queries an application makes to its database — reading other users' data, modifying records, or dumping the entire schema. It happens wherever user input is concatenated into a SQL string instead of passed as a bound parameter.

Severity guide

Critical when it reads/modifies other users' data or bypasses auth; every paid SQLi report starts with a proven boolean or error differential, not a tool scan.

Where to look

entry points to test first

01

Search boxes & filters

Free-text search, category filters, sort/order parameters — often interpolated into WHERE/ORDER BY clauses.

02

IDs in URLs and JSON

?id=, product codes, invoice numbers — anything numeric-looking still gets concatenated on legacy stacks.

03

Headers & cookies

X-Forwarded-For, Referer, user-agent logging, session lookups by cookie value — frequently forgotten by developers.

04

Report/CSV/PDF exports

Data-export features build big dynamic queries from many optional filters — a classic blind-spot.

05

Mobile/API endpoints

Older API versions and mobile backends often skip the parameterization the main site has.

How to hunt it

in order, start to finish

  1. Find inputs that reach a query

    Enumerate every parameter that filters, sorts or looks up data. Note the exact response shape of a normal request first — you'll diff against it constantly.

  2. Break the syntax

    Append a single quote (') and compare. An error, a 500, or a visibly different page means your character changed the query — that's the door.

  3. Confirm with a differential

    Send a pair: one condition that is always TRUE (' OR 1=1 --) and one that is always FALSE (' AND 1=2 --). If the responses differ consistently while a normal request matches neither, you have proven injection — no errors needed.

  4. Fingerprint the DBMS

    Error text, or version probes per backend: @@version (MySQL/MSSQL), sqlite_version() (SQLite), SELECT version() (Postgres). Every payload after this is backend-specific.

  5. Escalate the read

    UNION SELECT requires matching column counts (use ORDER BY N to find them). When UNION is impossible, extract blind: substring()-based boolean cycling, or time-based (sleep/benchmark/pg_sleep) when nothing is reflected.

  6. Automate only after proof

    Hand the confirmed request to sqlmap with --level/--risk as needed — but understand the bug yourself first. Tools break on WAFs and edge cases, and a manual proof survives triage.

Filter & validation bypasses

when your first tries get blocked
  • 01Whitespace stripped? Use comments as separators: UNION/**/SELECT or parentheses.
  • 02Quote-blocked? Use numeric context (AND 1=1), hex literals (0x...), or CHAR() concatenation.
  • 03Keywords blocked? Try CaSe variation, inline comments inside keywords (UNI/**/ON), or equivalent functions (SUBSTR vs SUBSTRING).
  • 04WAF logs patterns? Double URL-encoding (%2527) and chunked request encoding dodge single-pass inspection.

Impact ladder

what makes it payable
  1. 01Auth bypass — logging in as any user without a password.
  2. 02Cross-user data access — reading other tenants' records (PII = critical).
  3. 03Full database dump — schema, credentials, everything in one session.
  4. 04In rare stacks (MSSQL xp_cmdshell, Postgres COPY), direct OS command execution.

Payloads

8 · from PayloadsAllTheThings
' OR '1'='1'--

Classic auth bypass — the WHERE clause always matches.

page.asp?id=1' or 1=1 -- true

Always-true probe; response should look like the normal record.

page.asp?id=1 and 1=2 -- false

Always-false partner; if this response differs from the one above, injection is confirmed.

'||'DERP

String-concatenation probe — reveals how the backend joins your input into the query.

' or 1=1 limit 1 --

Same bypass with LIMIT for Postgres/MySQL quirks.

'%2B'HERP

URL-encoded + concatenation for MSSQL backends.

1 ORDER BY 10--

Column-count discovery for UNION — increase N until the query errors.

1 UNION SELECT @@version--

MySQL/MSSQL version pull once the column count matches.

Toolssqlmap/ghauri/
Full SQL Injection section ↗

Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.

Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.

Payloads — wildhunter