file-upload

Start by mapping all upload functionality, then test baseline uploads before attempting bypasses: extension manipulation, Content-Type header changes, magic byte forging, and polyglot files. Verify impact by checking whether uploaded files execute, render active content, or traverse directories.

Common bypasses include double extensions (shell.php.jpg), alternate executable extensions (.phtml, .php5), case variation (.PhP), null bytes, trailing dots or spaces, MIME type spoofing, and prepending valid magic bytes like GIF89a to malicious payloads.

Yes. SVG files can contain embedded JavaScript that executes when rendered in a browser, producing stored XSS. They can also carry XXE entities or external image references that trigger SSRF against internal services.

The methodology references Burp Suite or OWASP ZAP for request interception, ExifTool for metadata injection, Fuxploider as a dedicated upload scanner, ffuf for fuzzing endpoints and extensions, and Weevely for web shell generation.

Only test upload endpoints within an authorized scope such as a sanctioned pentest or bug bounty program. Uploading web shells or malicious payloads to systems without written permission is illegal and outside this checklist's intended use.