Hackus Codex

Your offensive security knowledge base.

Curated payloads, attack chains, and methodologies — built for hunters who ship.

Quick Ref Vulnerabilities Attack Chains

---

What's Inside

• Quick Reference

  ---

  Copy-paste payloads for XSS, SQLi, SSRF, SSTI, LFI, NoSQL, IDOR, Deserialization, LLM attacks, and more.

  Grab payloads

• Vulnerability Guides

  ---

  From detection to escalation. Server-side, client-side, auth, logic, infrastructure, and AI security.

  Explore vulns

• Attack Chains

  ---

  Turn low-severity bugs into critical impact. XSS→ATO, SSRF→RCE, Self-XSS escalation, and more.

  Chain attacks

• Frameworks

  ---

  Platform-specific security guides for FastAPI, Next.js, and BaaS (Supabase, Firebase).

  Framework guides

---

By The Numbers

12 Quick Ref sheets	100+ Total pages
10 Attack Chains	9 Template engines (SSTI)
6 Vuln categories	Real H1 report references

---

Philosophy

• Payload-dense — Less prose, more payloads
• Copy-paste ready — Tested, working techniques
• Chain-focused — Escalate everything
• No gatekeeping — The knowledge wants to be free

---

Sources & Credits

This codex aggregates knowledge from across the security community:

• PortSwigger Web Security Academy — Research and methodology
• HackTricks — Comprehensive technique reference
• PayloadsAllTheThings — Payload collections
• HackerOne Disclosed Reports — Real-world examples
• Original research — From bug bounty hunting experience

If you find value here, support the original creators.

---

• Open Source

  ---

  Built with MkDocs Material.

• For Hunters

  ---

  By hunters. Ship bugs, get paid.