IntruderPayloads - Burpsuite入侵者有效载荷集合， BurpB

项目说明

!alt tag

IntruderPayloads

A collection of Burpsuite Intruder payloads, BurpBounty payloads (), fuzz lists and pentesting methodologies. To pull down all 3rd party repos, run install.sh in the same directory of the IntruderPayloads folder.

Author: -

OWASP TESTING CHECKLIST:

-----------------------------------------------------------------------

Spiders, Robots and Crawlers IG-001

Search 引擎 Discovery/Reconnaissance IG-002

Identify application entry points IG-003

Testing for Web Application Fingerprint IG-004

Application Discovery IG-005

Analysis of Error Codes IG-006

SSL/TLS Testing (SSL , Algorithms, Key length, Digital Cert. ) - SSL Weakness CM‐001

DB Listener Testing - DB Listener weak CM‐002

Infrastructure Configuration Management Testing - Infrastructure Configuration management weakness CM‐003

Application Configuration Management Testing - Application Configuration management weakness CM‐004

Testing for File Extensions Handling - File extensions handling CM‐005

Old, backup and unreferenced files - Old, backup and unreferenced files CM‐006

Infrastructure and Application Admin Interfaces - Access to Admin interfaces CM‐007

Testing for HTTP Methods and XST - HTTP Methods enabled, XST permitted, HTTP Verb CM‐008

Credentials transport over an encrypted channel - Credentials transport over an encrypted channel AT-001

Testing for user enumeration - User enumeration AT-002

Testing for Guessable (Dictionary) User Account - Guessable user account AT-003

Brute Force Testing - Credentials Brute forcing AT-004

Testing for bypassing authentication schema - Bypassing authentication schema AT-005

Testing for remember password and pwd reset - remember password, weak pwd reset AT-006

Testing for Logout and Browser Cache Management - - Logout function not properly implemented, browser cache weakness AT-007

Testing for CAPTCHA - Weak Captcha implementation AT-008

Testing Multiple Factors Authentication - Weak Multiple Factors Authentication AT-009

Testing for Race Conditions - Race Conditions AT-010

Testing for Session Management Schema - Bypassing Session Management Schema, Weak Session Token SM-001

Testing for Cookies attributes - Cookies are set not ‘HTTP Only’, ‘Secure’, and no time SM-002

Testing for Session Fixation - Session Fixation SM-003

Testing for Exposed Session - Exposed sensiti SM-004

Testing for CSRF - CSRF SM-005

Testing for Path Tra - Path Tra AZ-001

Testing for bypassing authorization schema - Bypassing authorization schema AZ-002

Testing for Pri Escalation - Pri Escalation AZ-003

Testing for Business Logic - Bypassable business logic BL-001

Testing for Reflected Cross Site Scripting - Reflected XSS DV-001

Testing for Stored Cross Site Scripting - Stored XSS DV-002

Testing for DOM based Cross Site Scripting - DOM XSS DV-003

Testing for Cross Site Flashing - Cross Site Flashing DV-004

SQL Injection - SQL Injection DV-005

LDAP Injection - LDAP Injection DV-006

ORM Injection - ORM Injection DV-007

XML Injection - XML Injection DV-008

SSI Injection - SSI Injection DV-009

XPath Injection - XPath Injection DV-010

IMAP/SMTP Injection - IMAP/SMTP Injection DV-011

Code Injection - Code Injection DV-012

OS Commanding - OS Commanding DV-013

Buffer o - Buffer o DV-014

Incubated - Incubated DV-015

Testing for HTTP Splitting/Smuggling - HTTP Splitting, Smuggling DV-016

Testing for SQL Wildcard Attacks - SQL Wildcard DS-001

Locking Customer Accounts - Locking Customer Accounts DS-002

Testing for DoS Buffer O - Buffer O DS-003

User Specified Object Allocation - User Specified Object Allocation DS-004

User Input as a Loop Counter - User Input as a Loop Counter DS-005

Writing User Provided Data to Disk - Writing User Provided Data to Disk DS-006

Failure to Release Resources - Failure to Release Resources DS-007

Storing too Much Data in Session - Storing too Much Data in Session DS-008

WS Information Gathering - N.A. WS-001

Testing WSDL - WSDL Weakness WS-002

XML Structural Testing - Weak XML Structure WS-003

XML content-le - XML content-le

HTTP GET parameters/REST Testing - WS HTTP GET parameters/REST WS-005

Naughty SOAP attachments - WS Naughty SOAP attachments WS-006

Replay Testing - WS Replay Testing WS-007

AJAX - N.A. AJ-001

AJAX Testing - AJAX weakness AJ-002

项目信息

开发语言：BlitzBasic

Star 数：3983

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。