Payload of The Day #5 - SQL Injection via XML + WAF Bypass (PostgreSQL Edition)By Cybernerddd - Web App Pentester in Training Today’s payload is straight from a real PortSwigger lab where the SQL injection happens inside an XML POST request, protected by a WAF that blocks the usual keywords like UNION, SELECT, and comments. Sce...1Nov 27, 2025 · 2 min readfrom-zero-to-cyber.hashnode.dev
Payload Of The Day #4 - Blind SQL Injection (Time-Based User Extraction)By Cybernerddd Blind SQL Injection is one of the most fascinating parts of web exploitation because the application gives no visible output, yet you can still extract data silently using logic, timing, and creativity. Today’s payload focuses on time-...Nov 26, 2025 · 2 min readfrom-zero-to-cyber.hashnode.dev
Payload #3 - Bypassing File Upload Restrictions with web.config + Custom Extension.Reference: portswigger file upload via extension blacklist bypass The Situation You're facing a file upload filter that: Blocks .php, .phtml, .php5, etc. Serves uploaded files as plain text. Uses IIS(Internet Information Services) under the hood (...Sep 17, 2025 · 2 min readfrom-zero-to-cyber.hashnode.dev
Payload #2 – CSRF Auto-Submit Email Change (No Defense)This is a CSRF proof-of-concept payload for a no-defense target where cookies are sent automatically by the browser. The form submits itself when loaded, changing the victim’s email address. PAYLOAD: <form action="https://victim-site.com/my-account/c...Aug 14, 2025 · 1 min readfrom-zero-to-cyber.hashnode.dev
Payload of the Day #01-Dom XSS in jQuery Sink via location.hashTags: [XSS, DOM XSS, Web Security, jQuery, JavaScript] Series: Payload of the Day --- Context: This payload targets a DOM-based XSS vulnerability in a site that uses jQuery’s $() selector and pulls user input directly from location.hash. The vulnerab...Jul 25, 2025 · 1 min readfrom-zero-to-cyber.hashnode.dev
