file-upload

Identify and validate file upload vulnerabilities in web applications.

1|1|Updated Mar 4, 2026

Search Tags:#vulnerability #web-security #bypass #uploads #pentest #file-upload

Ready to run

npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill file-upload-erkanrzgc

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: file-upload
Source: https://github.com/erkanrzgc/cyberm4fia-scanner/tree/main/core/ai_skills/offensive-file-upload
Command: npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill file-upload-erkanrzgc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a comprehensive checklist for assessing file upload endpoints, covering MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing risks, and race conditions.

Core Features & Use Cases

Comprehensive testing methodologies for file upload controls, including bypass techniques and defense checks.
Practical pentest guidance for web apps, APIs, and CMS upload features.
Remediation-oriented insights and secure configuration recommendations for upload handling.

Quick Start

Test a target upload endpoint by attempting common bypass techniques and document any successful or failed responses.

Frequently Asked Questions about file-upload

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for file upload vulnerabilities in a web application?▼

To test for file upload vulnerabilities, apply a structured methodology using reference payloads to assess upload controls. This involves validating weaknesses by manipulating MIME types, extensions, and magic bytes to document successful exploits and remediation steps.

What are common file upload bypass techniques used in pentesting?▼

Common file upload bypass techniques include MIME type validation evasion, extension filtering bypass, magic byte manipulation, and path traversal via filenames. These methods test whether web applications properly sanitize and restrict malicious file uploads.

Can I use this methodology to assess API endpoints and CMS upload features?▼

Yes, this methodology assesses API endpoints and CMS upload features. It provides practical pentest guidance and comprehensive testing methodologies applicable to web apps, APIs, and content management systems to validate upload controls.

How does stored XSS work through SVG or HTML file uploads?▼

Stored XSS via SVG or HTML uploads occurs when an application accepts and serves these files without proper sanitization. Testing this file upload weakness involves injecting malicious scripts into payloads to verify if script execution occurs upon access.

What is a magic byte manipulation attack in file upload testing?▼

Magic byte manipulation in file upload testing involves altering file signature bytes to spoof file type and bypass server-side content-type validation. This technique checks whether the application relies on insecure validation rather than robust server-side processing.

How do I document bypass techniques and remediation steps for upload vulnerabilities?▼

Document bypass techniques and remediation steps for upload vulnerabilities by recording attempted payloads, server responses, and successful bypass methods. This process provides remediation-oriented insights and secure configuration recommendations for upload handling.