Test file upload endpoints for security vulnerabilities with malicious payloads.
npx skills add https://github.com/devtint/API_PENTEST --skill file-upload-devtint
Please help me install this Agent Skill. Skill: file-upload Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/file-upload Command: npx skills add https://github.com/devtint/API_PENTEST --skill file-upload-devtint
This Skill helps identify and exploit security vulnerabilities in file upload functionalities, preventing unauthorized code execution and server compromise.
Use the file-upload skill to test the '/api/upload' endpoint for vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To test file upload endpoints for vulnerabilities, you can submit payloads utilizing extension manipulation, content-type spoofing, and magic byte injection to detect risks like remote code execution and path traversal.
The best way to check if an API allows web shell uploads is by generating and submitting malicious file types disguised as benign formats, such as a PHP shell embedded in a JPEG, to verify execution.
Magic byte injection bypasses content-type validation by manipulating the file's internal signature bytes to spoof its true format, tricking server-side validation mechanisms into accepting malicious payloads.
Yes, you need python-magic and requests to test for OWASP unrestricted file upload weaknesses, as these libraries handle payload generation, format validation, and the HTTP submission of malicious files.
Yes, you can use this approach to test for XXE and XSS attacks by generating specialized payloads that exploit file parsing mechanisms, verifying if the server processes malicious XML or scripts upon upload.
dreadnodeGenerate deeply nested JSON payloads that bypass libmagic file type validation.
securityfortechDetect and exploit Server-Side Template Injection vulnerabilities in web applications.
dreadnodeTest gRPC-Web services for CORS misconfigurations and authentication bypasses.
florianbuetowScan code and dependencies for vulnerabilities mapped to CWEs.
