Skip to main content

​
Usage

vulcn payloads [options]

​
Options

OptionDescription
-c, --category <category>Filter by category (xss, sqli, ssrf, etc.)
-f, --file <file>Also show payloads from custom file

​
Description

The payloads command lists all available built-in payload sets. Use this to discover what payloads are available for security testing.

​
Examples

​
List All Payloads

vulcn payloads
Output: 
📦 Available Payloads

XSS
  xss-basic        Basic XSS payloads (15 payloads)
  xss-event        Event handler XSS (12 payloads)
  xss-svg          SVG-based XSS (8 payloads)
  xss-polyglot     Polyglot XSS payloads (5 payloads)

SQL Injection
  sqli-basic       Basic SQLi payloads (10 payloads)
  sqli-error       Error-based SQLi (8 payloads)
  sqli-blind       Blind SQLi payloads (6 payloads)
  sqli-union       UNION-based SQLi (5 payloads)

Other
  ssrf-basic       SSRF payloads (5 payloads)
  xxe-basic        XXE payloads (4 payloads)
  cmd-basic        Command injection (6 payloads)
  path-traversal   Path traversal (8 payloads)
  open-redirect    Open redirect (4 payloads)

Total: 13 payload sets, 91 payloads

​
Filter by Category

vulcn payloads --category xss

​
Include Custom File

vulcn payloads --file ./my-payloads.yml

​
Built-in Payload Sets

​
XSS Payloads

NameDescriptionCount
xss-basicBasic XSS payloads with script tags and event handlers15
xss-eventEvent handler payloads (onerror, onclick, etc.)12
xss-svgSVG-based XSS payloads8
xss-polyglotPolyglot payloads that work in multiple contexts5

​
SQL Injection Payloads

NameDescriptionCount
sqli-basicBasic SQL injection payloads10
sqli-errorError-based SQL injection8
sqli-blindBlind SQL injection (time-based)6
sqli-unionUNION-based SQL injection5

​
Other Payloads

NameDescriptionCount
ssrf-basicServer-Side Request Forgery payloads5
xxe-basicXML External Entity payloads4
cmd-basicCommand injection payloads6
path-traversalDirectory traversal payloads8
open-redirectOpen redirect payloads4

​
PayloadsAllTheThings

Vulcn can fetch payloads from PayloadsAllTheThings, a comprehensive collection of security payloads. 
vulcn run session.vulcn.yml --payload payloadbox:xss
Available PayloadBox types:
TypeDescription
xssXSS payloads
sql-injectionSQL injection payloads
xxeXXE payloads
command-injectionCommand injection payloads
open-redirectOpen redirect payloads
path-traversalPath traversal payloads

​
Custom Payloads

Create your own payload file: 
# my-payloads.yml
version: "1"
payloads:
  - name: my-xss-payloads
    category: xss
    description: Custom XSS payloads for my application
    payloads:
      - "<script>alert(document.domain)</script>"
      - "<img src=x onerror=alert(1)>"
      - "javascript:alert(1)"
    detectPatterns:
      - "alert\\("

  - name: my-sqli-payloads
    category: sqli
    description: Custom SQLi payloads
    payloads:
      - "' OR '1'='1"
      - "1; DROP TABLE users--"
      - "1 UNION SELECT * FROM users"
Use with --payload-file: 
vulcn run session.vulcn.yml --payload-file ./my-payloads.yml
Or configure in vulcn.config.yml: 
plugins:
  - name: "@vulcn/plugin-payloads"
    config:
      builtin: true
      files:
        - ./my-payloads.yml