Exploit / Attack-Payload Detector
Client-Side · No UploadPaste a request or log line and spot injection payloads — even URL/Base64-encoded ones
Runs entirely in your browser — the text you paste never leaves this page and is never logged. It decodes URL-, HTML- and Base64-encoded input before matching, so obfuscated attacks are still caught.
What this is: a client-side attack-payload detector — the same idea as a WAF/IDS signature set (ModSecurity CRS, Snort), made interactive. It flags well-known injection techniques (SQLi, XSS, command injection, path traversal, SSRF, template injection, Log4Shell/JNDI, NoSQL/LDAP/XXE, CRLF, unsafe deserialization) and decodes URL-, HTML- and Base64-encoded input first so obfuscated attempts still match. Like every real signature detector it can be evaded by a novel encoding and can occasionally false-positive on ordinary text — so every finding shows its line, the technique, and the exact matched string for you to judge. It never executes anything.