skills.rest
mlvpatel
mlvpatelCOMMUNITY
Explore all skills by this author →
GitHub

payload-forge

Catalog curated security payloads and GF patterns for web vulnerability testing.

1|Updated Apr 3, 2026
Search Tags:#xss#bypass#payloads#ssrf#vulnerability-testing#ssti#gf-patterns
One-click install
npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill payload-forge
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: payload-forge
Source: https://github.com/mlvpatel/sentinel-ai-offensive/tree/main/skills/payload-forge
Command: npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill payload-forge

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Curated security payloads, bypass tables, and wordlists empower testers to identify, validate, and determine submitability of findings across a wide range of web vulnerabilities.

Core Features & Use Cases

  • Payload libraries for XSS, SSRF, SQLi, XXE, NoSQLi, command injection, SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, and MFA bypass.
  • GF pattern names for rapid parameter-type identification.
  • An always-rejected bug list and a conditional-chain table to guide risk assessment and reporting.
  • Use cases include validating vulnerability findings, preparing PoCs, and ensuring submissions adhere to policies.

Quick Start

Inspect the payload categories and begin with basic XSS payloads to test input handling on a target page.

Frequently Asked Questions about payload-forge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the right payloads for XSS and SSRF vulnerability testing?▼

Payload libraries for XSS and SSRF provide curated injection strings and bypass techniques to identify, validate, and determine the submitability of web vulnerability findings.

What is the best way to use GF patterns for rapid parameter identification?▼

GF pattern names guide testers by rapidly matching and identifying specific parameter types within target URLs, streamlining the process of applying the correct payload category.

How do I ensure my vulnerability submissions adhere to bug bounty policies?▼

An always-rejected bug list and conditional-chain table guide risk assessment and reporting, ensuring your proof-of-concept submissions adhere strictly to platform policies.

Does this payload library cover server-side template injection and HTTP smuggling?▼

Yes, the payload catalog explicitly covers server-side template injection (SSTI), HTTP smuggling, WebSocket, and MFA bypass scenarios alongside XSS, SQLi, XXE, and path traversal.

How do I prepare PoCs for command injection and NoSQLi vulnerabilities?▼

You prepare PoCs by inspecting the curated payload categories for command injection and NoSQLi, selecting appropriate injection strings to validate input handling on target pages.

When should I not submit a vulnerability finding during bug hunting?▼

You should not submit a finding if it matches the always-rejected bug list or fails the conditional-chain ruleset, which exists to guide risk assessment and prevent invalid reports.

Related Skills

Explore More Software Engineering Skills→
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
cybersecwomancybersecwoman
5

report-writing

Generate bug bounty reports with impact statements and CVSS scoring.

Community
Advanced
0xhaaz0xhaaz

security-arsenal

Provide security payloads, bypass tables, and submission rules for bug bounty hunting.

Community
Advanced
mejangomejango

fuzzing-obstacles

Patch code with conditional compilation flags to bypass checksum and validation obstacles for fuzzing builds.

Community
Advanced