wufufu770 TL;DR
- 目的：Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment
- 适用：辅助/通用
- 输入：目标漏洞类型（如 ssrf/xss/sqli）+ 工具链（curl/sqlmap/ffuf）
- 输出：PATT payload 列表
- 红线：仅限授权范围内；扫描限速
-c 10 -rl 10；所有动作记 oplog - 关联：上游：003-src-session-start → 下游：177-attack-path-stitcher, 172-agentic-actions-auditor, 173-analyzing-network-packets-with-scapy
When to Use
- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology
When NOT to Use
- Target is clearly outside this skill's scope (refer to other web-vulns skills)
- No authorization for testing
- Need reconnaissance rather than exploitation (use 1-recon-osint skills instead)
PATT Fetcher
Fetches payloads from PayloadsAllTheThings on demand. Use model="haiku" when spawning for lightweight operation.
Quick Start
# 克隆 PayloadsAllTheThings
git clone https://github.com/swisskyrepo/PayloadsAllTheThings.git
# 按漏洞类型查找
ls PayloadsAllTheThings/ | grep -i "sqli\|xss\|ssrf"
URL Map
Workflow
- Match category to URL Map (case-insensitive)
- WebFetch the raw URL
- Find first H2 heading matching query → return up to 100 lines
- Return extracted payloads to caller
Error Handling
- 404: PATT may have restructured — check https://github.com/swisskyrepo/PayloadsAllTheThings
- Rate limit: Back off and retry; if persistent, note the category as unavailable and proceed with built-in payloads
- Unknown category: Ask caller for direct raw URL