Predefined payload lists - Port Swigger
Summary: PortSwigger's Burp Intruder ships with built-in payload lists for generating attack payloads, usable with any payload type that takes a list of strings, and users can also load their own custom payload lists through Burp's Settings dialog. Several predefined lists - including CGI Scripts, Fuzzing - full, Fuzzing - JSON_XML injection, Fuzzing - out of band, and the path traversal and quick fuzzing lists - contain placeholders such as {file}, {base}, {domain}, and foo@{domain} that must be replaced with actual values before an attack runs.
What's compelling: The tooling that makes fuzzing and injection testing fast also makes it easy to fire off an attack with placeholders like {domain} or {file} left unreplaced, so the discipline of checking each list's required values before execution sits with the tester, not the scanner.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026