# Patt Fetcher > Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment - Skill: `wufufu770/patt-fetcher` (Agent Skill) - Install (CLI): `npx skillmds@latest add wufufu770/patt-fetcher` - Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/patt-fetcher/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - License: Apache-2.0 - Author: wufufu770 (https://skillmd.com/u/wufufu770) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/wufufu770/patt-fetcher --- ## TL;DR - **目的**：Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment - **适用**：辅助/通用 - **输入**：目标漏洞类型（如 ssrf/xss/sqli）+ 工具链（curl/sqlmap/ffuf） - **输出**：PATT payload 列表 - **红线**：仅限授权范围内；扫描限速 `-c 10 -rl 10`；所有动作记 oplog - **关联**：上游：003-src-session-start → 下游：177-attack-path-stitcher, 172-agentic-actions-auditor, 173-analyzing-network-packets-with-scapy ## When to Use - Target presents indicators of the vulnerability class this skill covers - Fingerprint or recon indicates the relevant technology stack is in use - Authorized testing scope covers the target endpoint or component - Findings need to be validated through this skill's methodology ## When NOT to Use - Target is clearly outside this skill's scope (refer to other web-vulns skills) - No authorization for testing - Need reconnaissance rather than exploitation (use 1-recon-osint skills instead) # PATT Fetcher Fetches payloads from PayloadsAllTheThings on demand. Use `model="haiku"` when spawning for lightweight operation. ## Quick Start ```bash # 克隆 PayloadsAllTheThings git clone https://github.com/swisskyrepo/PayloadsAllTheThings.git # 按漏洞类型查找 ls PayloadsAllTheThings/ | grep -i "sqli\|xss\|ssrf" ``` ## URL Map | Category | Raw URL | |---|---| | SQL Injection | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/SQL%20Injection/README.md | | XSS | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/XSS%20Injection/README.md | | Command Injection | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Command%20Injection/README.md | | SSTI | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Server%20Side%20Template%20Injection/README.md | | XXE | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/XXE%20Injection/README.md | | SSRF | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Server%20Side%20Request%20Forgery/README.md | | Path Traversal | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Directory%20Traversal/README.md | | File Inclusion | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/File%20Inclusion/README.md | | LDAP Injection | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/README.md | | NoSQL Injection | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/NoSQL%20Injection/README.md | | Active Directory | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md | | Linux PrivEsc | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md | | Windows PrivEsc | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md | | Reverse Shells | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md | | Linux Persistence | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md | | Windows Persistence | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md | | Linux Evasion | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Linux%20-%20Evasion.md | | Windows Evasion | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Windows%20-%20AMSI%20Bypass.md | | Hash Cracking | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Hash%20Cracking.md | | Network Pivoting | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Network%20Pivoting%20Techniques.md | | Mass Assignment | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Mass%20Assignment/README.md | | Open Redirect | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Open%20Redirect/README.md | | OAuth Misconfig | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/OAuth%20Misconfiguration/README.md | | SAML Injection | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/SAML%20Injection/README.md | | CORS Misconfig | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/CORS%20Misconfiguration/README.md | | Race Condition | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Race%20Condition/README.md | | Prototype Pollution | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Prototype%20Pollution/README.md | | Type Juggling | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Type%20Juggling/README.md | | Deserialization | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Insecure%20Deserialization/README.md | | GraphQL | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/GraphQL%20Injection/README.md | | AWS | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md | | Azure | https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md | ## Workflow 1. Match category to URL Map (case-insensitive) 2. WebFetch the raw URL 3. Find first H2 heading matching query → return up to 100 lines 4. Return extracted payloads to caller ## Error Handling - **404**: PATT may have restructured — check https://github.com/swisskyrepo/PayloadsAllTheThings - **Rate limit**: Back off and retry; if persistent, note the category as unavailable and proceed with built-in payloads - **Unknown category**: Ask caller for direct raw URL