跳到正文
cccskills
免费在 GitHub 公开

security-payloads

Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(11)

  • SKILL.md2.3 KB
  • references/Payloads/Anti-Virus/eicar-com.txt69 B
  • references/Payloads/File-Names/directory-traversal.zip3.0 KB
  • references/Payloads/File-Names/exec/Hello`hostname`World.txt11 B
  • references/Payloads/File-Names/exec/Hello$(hostname)World.txt12 B
  • references/Payloads/File-Names/max-length.zip172 B
  • references/Payloads/File-Names/null-byte/Hello.php%00World.txt32 B
  • references/Payloads/File-Names/null-byte/Hello%00World.txt8 B
  • references/Payloads/File-Names/README.md1.2 KB
  • references/Payloads/Flash/xssproject.swf1.0 KB
  • references/Payloads/README.md3.6 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

SecLists Payloads (Curated)

Description

Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.

Source: SecLists/Payloads Repository: https://github.com/danielmiessler/SecLists License: MIT

When to Use This Skill

Use this skill when you need:

  • Anti-virus testing
  • File upload testing
  • Path traversal testing
  • Security control validation

⚠️ IMPORTANT: Only use for authorized security testing, bug bounty programs, CTF competitions, or educational purposes.

Key Files in This Skill

  • EICAR test file
  • Null byte file names
  • Command execution file names

Usage Example

# Access files from this skill
import os

# Example: Load patterns/payloads
skill_path = "references/Payloads"

# List all available files
for root, dirs, files in os.walk(skill_path):
    for file in files:
        if file.endswith('.txt'):
            filepath = os.path.join(root, file)
            print(f"Found: {filepath}")
            
            # Read file content
            with open(filepath, 'r', errors='ignore') as f:
                content = f.read().splitlines()
                print(f"  Lines: {len(content)}")

Security & Ethics

Authorized Use Cases ✅

  • Authorized penetration testing with written permission
  • Bug bounty programs (within scope)
  • CTF competitions
  • Security research in controlled environments
  • Testing your own systems
  • Educational demonstrations

Prohibited Use Cases ❌

  • Unauthorized access attempts
  • Testing without permission
  • Malicious activities
  • Privacy violations
  • Any illegal activities

Complete SecLists Collection

This is a curated subset of SecLists. For the complete collection:


Generated by Skill Seeker | SecLists Payloads Collection License: MIT - Use responsibly with proper authorization

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.

中文简介正在准备中。当前显示原文说明。

ShulkwiSEC/bb-huge232026年7月11日 更新

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

中文简介正在准备中。当前显示原文说明。

ShulkwiSEC/bb-huge232026年7月11日 更新

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

ShulkwiSEC/bb-huge232026年7月11日 更新

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

中文简介正在准备中。当前显示原文说明。

ShulkwiSEC/bb-huge232026年7月11日 更新

Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.

中文简介正在准备中。当前显示原文说明。

ShulkwiSEC/bb-huge232026年7月11日 更新

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

中文简介正在准备中。当前显示原文说明。

ShulkwiSEC/bb-huge232026年7月11日 更新

查看 ShulkwiSEC 的全部技能

报告此技能的问题