archive-path-traversal

What problem does it solve?

This Skill addresses the critical risk of unvalidated server-side archive extraction, which can allow attackers to perform path traversal, read or write arbitrary files, and escalate privileges via maliciously crafted archive uploads.

Core Features & Use Cases

• Malicious Archive Crafting: Generate proof-of-concept ZIP, TAR, and compressed archive files with embedded traversal sequences, symlinks, hardlinks, and modified permissions.
• Multi-Vector Testing: Supports testing for Zip Slip, symlink attacks, hardlink collisions, setuid escalation, polyglot MIME bypasses, and Unicode path confusion flaws.
• Use Case: Use this Skill to test web applications that accept user-uploaded archives (such as bulk file import, theme/plugin installers, or backup restore features) to identify extraction vulnerabilities before malicious actors can exploit them.

Quick Start

Use the archive-path-traversal skill to craft a test archive that validates whether the target's file upload endpoint is vulnerable to Zip Slip path traversal attacks.