Payload reference
Payloads with the reasoning attached — when to use them, what they defeat, and when they stopped working.
SQL injection53Breaking out of a string or numeric context so the database runs your syntax instead of treating it as data.Cross-site scripting28Getting a browser to execute script you supplied, in someone else's session.Server-side request forgery38Making the server issue an HTTP request you control, to somewhere it can reach and you cannot.Path traversal and file inclusion37Escaping the directory the application meant to give you, and sometimes getting the file executed on the way out.Command injection58Your input reaching a shell. The highest-severity finding on this site and usually the easiest to confirm.Template injection29Input reaching a template engine as template source rather than as data. Usually ends in code execution.XXE19An XML parser that resolves external entities, turned into file read and SSRF.Encoding and bypass49Transformations you apply to a payload that already works. Nothing here is worth using until you know which control you are trying to get past.