PayloadForge

PayloadForge is a modular, Python-based CLI tool developed for educational and defensive cybersecurity research.

It generates structured payload templates demonstrating how common web vulnerabilities work and how modern defenses detect and block them.

---

Features

1. XSS Module

Supports:

• Reflected XSS

• Stored XSS

• DOM-based XSS

Context Awareness:

• HTML context

• Attribute context

• JavaScript context

Includes:

• Bypass logic metadata

• Encoding simulation

• Case manipulation logic

• Tag switching examples

2. SQL Injection Module

Supports:

• Error-based injection

• Union-based injection

• Blind (boolean + time-based template only)

Database Types:

• MySQL

• PostgreSQL

• MSSQL

Includes:

• Comment-based bypass

• Case variation

• No live database interaction

3. Command Injection Module

Supports:

• Linux patterns

• Windows patterns

Includes:

• Command separators as strings only

• OS-based logic

• Explanation of why filters fail

Execution disabled by default

4. Advanced Capabilities

• URL Encoding
• Base64 Encoding
• Hex Encoding
• Comment insertion obfuscation
• Whitespace abuse
• Mixed obfuscation
• WAF detection reasoning
• JSON export
• TXT export

---

Project Structure

PayloadForge/
│
├── main.py
│
├── modules/
│   ├── xss.py
│   ├── sqli.py
│   └── command_injection.py
│
├── core/
│   ├── encoder.py
│   ├── obfuscator.py
│   ├── exporter.py
│   └── waf_notes.py
│
└── README.md

---

Installation

git clone https://github.com/abds059/PayloadForge
cd PayloadForge
python main.py --help

---

Usage Examples

• Basic XSS

  python main.py --module xss

• Context-aware XSS

  python main.py --module xss --xss-type reflected --context html

• SQLi (MySQL Union-based)

  python main.py --module sqli --db mysql --sqli-type union

• Command Injection (Linux)

  python main.py --module cmd --os linux

• Encoding Example

  python main.py --module xss --encode url

• Obfuscation Example

  python main.py --module xss --obfuscate comment

• Export Example

  Export JSON:

  python main.py --module sqli --export json

  Export TXT:

  python main.py --module xss --export txt

---

Disclaimer

This framework is strictly for academic learning, defensive research, and authorized security testing within legal environments.

It does not execute live commands or interact with real databases.

Users must adhere to responsible disclosure practices and ethical standards; any unauthorized use is strictly prohibited, and the authors assume no liability for misuse.

---

Authors

• Abdur Rehman Siddiqui
• Areeba Zehra Jafri