Attack Payload Vault & Test Vectors
How to curate, categorize, and deploy offensive security payloads, test vectors, and fuzzing strings across security engagements.
The Payload Vault provides a centralized repository for indexing, organizing, and deploying exploit payloads, polyglots, and fuzzing vectors across your organization.
Organizing Payload Collections
Payloads in blackLen are structured hierarchically:
- Payload Collection: The parent category representing a specific attack vector or testing domain (e.g., Blind SQL Injection, DOM-Based XSS, Server-Side Template Injection).
- Payload Items: Individual test strings, bypass variations, and encoded test vectors belonging to the collection.
Payload Item Attributes
Every payload item within a collection includes execution metadata:
| Attribute | Options / Description | Purpose |
|---|---|---|
| Context | URL Parameter, Path, Header, Cookie, Body (Form), Body (JSON), XML, File Upload, Other | Specifies the injection point or transport medium. |
| Risk Level | Info, Low, Medium, High, Critical | Categorizes the potential impact of successful execution. |
| Encoding | Base64, URL Encoded, Unicode, Double URL, etc. | Documents specific WAF/filter evasion encoding applied to the string. |
| Payload String | Raw text / code snippet | The exact string to be injected during testing. |
| Notes | Freeform text | Explanations of syntax requirements or target environment constraints. |
Deployment & Checklist Linking
- One-Click Copy: Payloads feature one-click clipboard copying from both the central Payload Vault and project views.
- Checklist Linkage: Attach individual payload items to relevant checklist verification steps for quick access during manual testing.
- Platform Filtering: Filter payloads by platform (
Web,Mobile,Network,Cloud) to quickly find vectors relevant to the active engagement.