/payload

description: AI-powered payload generation for XSS, SQLi, LFI, command injection, and more
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <type> <target-context>

Payload Generation

Type: `$1` Context: `$2`

Generate targeted security testing payloads using Hexstrike AI tools.

Step 1: Load Tools

Use ToolSearch to load:

• `ai_generate_payload` — contextual payload generation
• `ai_test_payload` — payload testing and validation
• `ai_generate_attack_suite` — comprehensive attack suite generation
• `advanced_payload_generation` — payloads with WAF evasion techniques

Step 2: Identify Payload Type

Map the requested type to the appropriate category:

• **xss** — Cross-site scripting (reflected, stored, DOM)
• **sqli** — SQL injection (union, blind, time-based, error-based)
• **lfi** — Local file inclusion / path traversal
• **rfi** — Remote file inclusion
• **cmdi** — Command injection (Unix, Windows)
• **ssrf** — Server-side request forgery
• **ssti** — Server-side template injection
• **xxe** — XML external entity injection
• **nosqli** — NoSQL injection (MongoDB, etc.)

Step 3: Generate Payloads

Run `ai_generate_payload` with:

• The vulnerability type from step 2
• Target context (URL, parameter, technology stack, WAF type)
• Request WAF-evasion variants if a WAF is known

Step 4: Generate Attack Suite

If a broader test is needed, run `ai_generate_attack_suite` to create a comprehensive set of payloads covering multiple injection points and evasion techniques.

Step 5: Advanced Evasion

If the target is WAF-protected, also run `advanced_payload_generation` with evasion context for:

• Encoding variations (URL, double-URL, Unicode, hex)
• Case manipulation
• Comment insertion
• Whitespace alternatives
• Concatenation techniques

Step 6: Test Payloads

Optionally run `ai_test_payload` against the target to validate which payloads succeed and which are blocked.

Step 7: Output

Present payloads organized by:

• **Clean payloads** — no evasion, for testing without WAF
• **WAF bypass payloads** — evasion techniques applied
• **Blind/out-of-band payloads** — for targets with no visible response

Include usage instructions for each payload (where to inject, expected response).