Contributing to OWASP Hunting

Types of Contributions

• New Payloads — Add payloads to existing vulnerability categories
• New Categories — Propose and create new vulnerability classes
• Documentation — Improve README files and category descriptions
• Bug Fixes — Correct errors in existing payloads or documentation
• Organization — Improve structure and consistency
• Website — Improve pages, design, accessibility, and search

Contributing to this website

Website changes start from the website branch and use website as the pull request base. The site is published from that branch after a change is merged.

1. Fork the repository and create a focused branch from the latest website branch.
2. Edit the relevant files in src/ or public/ and review the page locally.
3. Run TypeScript, lint, build, and static export validation.
4. Open a pull request to OWASP/OWASP-Hunting:website.

Read the complete website contribution guide for the commands, file map, GitHub Pages requirements, and PR checklist. Payload collection changes follow the general contribution guide.

Payload Contribution Guidelines

• Quality over quantity — Well-documented, tested payloads over raw dumps
• Clear documentation — Each payload should be clearly explained in context
• Proper attribution — Credit original sources where applicable
• Educational focus — Include context about attack vectors and testing scenarios
• Legal compliance — All content must comply with applicable laws

Adding New Payloads

Identify the existing category that fits your payload, check for duplicates, then follow the formatting style of existing payload files.

Payload file format:

# Section Name
payload_1
payload_2
payload_3

# Another Section
# Comment explaining complex payload
another_payload

Creating New Categories

Create a new category when:

• The vulnerability type doesn’t fit existing categories
• There’s substantial content (15+ unique payloads)
• The category represents a distinct attack vector

Required structure:

New-Category/
├── README.md
└── new-category-payloads.txt

Payload Submission Process

The following steps submit payload collection changes to main.

1. Fork the upstream repository

git clone https://github.com/owasp/owasp-hunting.git
cd owasp-hunting

2. Create a branch

git checkout -b add-xss-payloads
# or
git checkout -b new-category-api-injection

3. Commit your changes

git add .
git commit -m "Add DOM-based XSS payloads for event handler contexts"
git push origin add-xss-payloads

4. Open a Pull Request

On GitHub, open a PR to the upstream repository with:

• A clear, descriptive title
• Description of what you’re adding and why it’s valuable
• Note if you’ve tested the payloads
• References to any relevant sources or documentation

Payload Quality Standards

Before submitting, verify:

• Payloads are properly formatted
• No duplicates exist
• Documentation is clear and accurate
• Follows existing structure and conventions
• No personal or sensitive information included
• Content is legal, ethical, and educational

Code of Conduct

• Be ethical — All contributions must be for legitimate purposes
• Be respectful — Treat all contributors professionally
• Be accurate — Verify payloads and techniques where possible