Swissky ha publicado una lista de Payloads útiles para atacar y probar aplicaciones web.

Archivos

• README.md - vulnerability description and how to exploit it
• Intruder - a set of files to give to Burp Intruder
• Images - pictures for the README.md
• Files - some files referenced in the README.md

Metodologías

• Methodology and Resources
  
  • Active Directory Attack.md
  • Linux - Persistence.md
  • Linux - Privilege Escalation.md
  • Metasploit - Cheatsheet.md
  • Methodology_and_enumeration.md
  • Network Pivoting Techniques.md
  • Network Discovery.md
  • Reverse Shell Cheatsheet.md
  • Subdomains Enumeration.md
  • Windows - Download and Execute.md
  • Windows - Mimikatz.md
  • Windows - Persistence.md
  • Windows - Post Exploitation Koadic.md
  • Windows - Privilege Escalation.md
  • Windows - Using credentials.md

CVE Exploits

• Apache Struts 2 CVE-2013-2251 CVE-2017-5638 CVE-2018-11776_.py
• Apache Struts 2 CVE-2017-5638.py
• Apache Struts 2 CVE-2017-9805.py
• Apache Struts 2 CVE-2018-11776.py
• Docker API RCE.py
• Drupalgeddon2 CVE-2018-7600.rb
• Heartbleed CVE-2014-0160.py
• JBoss CVE-2015-7501.py
• Jenkins CVE-2015-8103.py
• Jenkins CVE-2016-0792.py
• Shellshock CVE-2014-6271.py
• Tomcat CVE-2017-12617.py
• WebLogic CVE-2016-3510.py
• WebLogic CVE-2017-10271.py
• WebLogic CVE-2018-2894.py
• WebSphere CVE-2015-7450.py

Y mucho más, que se puede consultar en el repositotio de Github de Swissky.