Grammar-Based Generation
Generates syntactically valid payloads from production rules using context-free grammar, not random strings. Produces realistic attack vectors for comprehensive security testing.
Craft
Payload Generator
Grammar-based fuzzing payloads for comprehensive security testing. XSS available now with 937 active vectors across 50 categories. SQL, Command, and NoSQL injection coming soon.
$
▊
⚡ Live preview • Payloads rotate every 8 seconds
937
Active Vectors
50
Categories
17
Injection Contexts
2019-2025
Techniques
Payload Coverage
Comprehensive fuzzing payloads across multiple injection types
- mXSS (Mutation XSS) ✓
- CSP Bypass ✓
- DOM Clobbering ✓
- Prototype Pollution ✓
- Template Injection ✓
- Unicode Normalization ✓
- SVG/MathML XSS ✓
- Dangling Markup ✓
- Attribute Injection ✓
- Attribution Reporting API ✓
- Browser Extension XSS ✓
- CSS Injection ✓
- CSS Injection (legacy) ✓
- Compute Pressure API ✓
- DOM-Based XSS ✓
- Event Handlers ✓
- FedCM ✓
- Fenced Frames ✓
- File Upload XSS ✓
- Filter Bypass ✓
- HTML Injection ✓
- Header Injection → XSS ✓
- Import Map Hijacking ✓
- JSONP XSS ✓
- JavaScript Context ✓
- Manifest V3 Bypass ✓
- Mobile WebView XSS ✓
- Modern Browser APIs ✓
- Modern CSS Syntax (legacy delivery) ✓
- Modern Event Surface ✓
- Modern Frameworks ✓
- Module Preload ✓
- NoSQL Injection → XSS ✓
- Polyglot XSS ✓
- Private Network Access ✓
- Sanitizer API Bypass ✓
- Sanitizer Bypass ✓
- Script Gadgets ✓
- Search Element ✓
- Server-Side Template Injection ✓
- Service Worker XSS ✓
- Shadow DOM XSS ✓
- Trusted Types Bypass ✓
- URL Injection (legacy) ✓
- WAF Bypass ✓
- WebAssembly XSS ✓
- WebCodecs API ✓
- Window Controls Overlay ✓
- XSLT Injection ✓
- postMessage XSS ✓
Currently showing 8 advanced techniques
- UNION-based SQLi ⋯
- Boolean-based Blind SQLi ⋯
- Time-based Blind SQLi ⋯
- Error-based SQLi ⋯
- Stacked Queries ⋯
- Second-Order SQLi ⋯
- Shell Metacharacters ⋯
- Command Chaining ⋯
- Command Substitution ⋯
- Inline Execution ⋯
- Path Traversal ⋯
- Environment Variable Injection ⋯
- MongoDB Operator Injection ⋯
- JavaScript Injection ⋯
- NoSQL Tautologies ⋯
- JSON Injection ⋯
Why Craft?
Built for professional penetration testers and security researchers
Multi-Injection Coverage
Comprehensive payload generation across multiple injection types. XSS available now with 50 categories (mXSS, CSP bypass, DOM clobbering, etc.). SQL, Command, and NoSQL injection in development.
REST API
FastAPI server with parallel generation, rate limiting, and comprehensive documentation.
Simple REST API
Generate fuzzing payloads with a single HTTP request. XSS available now, more types coming soon.
POST /payloads
curl -X POST https://api-staging.craft.exploit.design/payloads \
-H "Content-Type: application/json" \
-H "X-API-Key: your-api-key-here" \
-d '{
"count": 10,
"categories": ["csp_bypass", "dom_clobbering"],
"format": "json"
}'Response:
{
"count": 10,
"format": "json",
"payloads": [
{
"payload": "<svg/onload=alert(1)>",
"category": "svg_xss",
"metadata": {...}
},
...
]
}Authenticated
Secure API key authentication with PostgreSQL-backed key management and expiration
Fast
Parallel generation with ThreadPoolExecutor for high throughput
Categorized
Filter by attack category or get random vectors from all 50 categories