file-upload

Test file upload vulnerabilities using Burp Suite, ExifTool, and custom scripts.

2.9k|469|Updated Mar 4, 2026

Search Tags:#xss #penetration testing #web security #file upload #vulnerability testing #rce

Ready to run

npx skills add https://github.com/SnailSploit/Claude-Red --skill file-upload-snailsploit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: file-upload
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-file-upload
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill file-upload-snailsploit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security professionals identify and exploit vulnerabilities in file upload functionalities, preventing unauthorized code execution and data breaches.

Core Features & Use Cases

Comprehensive Testing: Covers MIME type bypass, extension validation, magic byte manipulation, and path traversal.
Exploitation Guidance: Provides methods for achieving Remote Code Execution (RCE), Cross-Site Scripting (XSS), and Server-Side Request Forgery (SSRF).
Use Case: When performing a web application penetration test, use this Skill to systematically test an image upload feature for vulnerabilities that could allow uploading a web shell.

Quick Start

Use the file-upload skill to test for bypasses on the upload endpoint at https://example.com/upload.

Frequently Asked Questions about file-upload

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test file upload vulnerabilities in a web application?▼

Testing file upload vulnerabilities involves systematically bypassing MIME type and extension validation using tools like Burp Suite. You manipulate magic bytes and path traversal to exploit endpoints, enabling Remote Code Execution (RCE), Cross-Site Scripting (XSS), or Server-Side Request Forgery (SSRF).

What techniques bypass file upload validation to achieve RCE?▼

To achieve RCE through file upload validation bypass, you manipulate MIME types, alter file extensions, and spoof magic bytes. These techniques allow uploading a web shell payload that executes server commands, exploiting improper server-side validation.

Can I use ExifTool and Burp Suite for testing file upload bypasses?▼

Yes, you can use ExifTool to embed malicious payloads within image metadata and Burp Suite to intercept and manipulate upload requests. This combination effectively tests MIME type validation and magic byte manipulation bypasses for vulnerabilities.

What is the best way to exploit XSS through an image upload feature?▼

Exploiting XSS through an image upload feature involves injecting malicious scripts into file metadata or SVG payloads. By bypassing extension and MIME validation, the stored file executes the script when rendered by the victim's browser.

Does file upload testing cover Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI)?▼

Yes, file upload testing covers SSRF and LFI by uploading specially crafted files that manipulate server-side parsing. This allows attackers to force the server to make internal requests or include local files, expanding the vulnerability assessment scope.