Payloads All The Things is an MIT-licensed, community-maintained collection of web application security payloads, bypass techniques and pentest methodology notes, written for penetration testers, bug bounty hunters, CTF players and red teamers who need a reference they can copy from during an engagement.

What it is

Payloads All The Things is a documentation repository rather than an executable tool. It organises offensive security knowledge into per-vulnerability chapters, each of which follows the same layout: a README.md describing the vulnerability and how to exploit it alongside several payloads, an Intruder directory of files meant to be handed directly to Burp Intruder, an Images directory holding pictures referenced by the chapter, and a Files directory holding any supporting files the chapter quotes. The project is written up as Python in this registry and lives in the AllTheThings family on GitHub, where it has accumulated 80,960 stars and 17,377 forks.

The concrete problem it solves is fragmentation. Payload references for web application testing usually live in private note files, browser bookmarks and one-off gists that no one maintains and no one reviews. This project consolidates that material into one publicly reviewed set of chapters with a shared structure, so a tester does not have to rebuild injection strings, bypass variants and enumeration wordlists from scratch for every engagement. It replaces the ad-hoc personal cheatsheet with a versioned, forkable one — and because chapters follow the same file layout, a payload list found in one chapter can be located and reused in another without hunting for the right file.

Key capabilities

• Per-vulnerability README.md chapters with a description of the vulnerability, exploitation guidance and several payloads in the same place.
• Intruder directories containing ready-made files to give to Burp Intruder, avoiding manual copy-paste of payload lists.
• A _template_vuln folder that scaffolds a new chapter with the standard file structure, used when adding a vulnerability that is not covered yet.
• Images and Files directories per chapter, keeping screenshots and referenced supporting files alongside the write-up they belong to.
• A hosted alternative display version at https://swisskyrepo.github.io/PayloadsAllTheThings/ for reading the chapters without cloning the repository.
• Curated learning lists in _LEARNING_AND_SOCIALS/BOOKS.md and _LEARNING_AND_SOCIALS/YOUTUBE.md for study material beyond the payload chapters.
• Topic coverage spanning bug bounty, bypass, enumeration and methodology, with a CONTRIBUTING.md process and the hacktoberfest topic driving outside contributions.

Who uses it and how

• Penetration testers and bug bounty hunters working against web applications, who use the chapters as a reference during manual exploitation rather than as a scanner.
• Burp Suite users, who pull files straight from a chapter's Intruder directory into Intruder for fuzzing and enumeration runs.
• CTF players and learners, who read the descriptions and payloads to understand a class of vulnerability before attempting it.
• Red and internal teams, served by the sister project InternalAllTheThings for Active Directory and internal pentest cheatsheets, and HardwareAllTheThings for hardware and IoT pentesting.
• Contributors fixing gaps or adding a chapter, who copy _template_vuln and follow CONTRIBUTING.md; Hacktoberfest participants are a recurring slice of that group.

Getting started

There is no package to install and no service to deploy. Read the chapters on the hosted site at https://swisskyrepo.github.io/PayloadsAllTheThings/, or clone the repository and work from the chapter directories directly, copying _template_vuln if a new chapter is needed.

How it compares

The facts provide no list of paid products this project replaces. Within the AllTheThings family, it is the web application security member: InternalAllTheThings covers Active Directory and internal pentest cheatsheets, while HardwareAllTheThings covers hardware and IoT pentesting, and each is maintained as its own repository. Tooling such as ProjectDiscovery's Nuclei, a project sponsor, sits alongside it as an automated detection path rather than a substitute for the manual payload reference.

When to use it — and when not to

Payloads All The Things is a reference, not a runner: it ships no scanner, no service and no runtime dependencies such as a database or SMTP, so anyone expecting an executable tool will be disappointed. Payloads must still be adapted to the target's framework, encoding and filters, and the 36 open issues show that coverage gaps and stale chapters exist even in a repository this active. Teams that need automated, repeatable scanning should pair it with a scanner; teams that need a maintained, MIT-licensed body of manual exploitation knowledge will find it fits.