hunt-file-upload

Test file upload endpoints for RCE and XSS by injecting payloads across PHP, JSP, and ASP.NET stacks. This Skill identifies insecure handling and validates evidence through test requests, interpreting server behavior to confirm exploitability.

Common file upload bypass techniques include double extension, null byte injection, case variants, content-type spoofing, ZIP slip, and SVG/HTML payloads. This Skill documents these vectors and analyzes how servers respond to each bypass attempt.

Insecure file upload handling leads to remote code execution when attackers upload executable payloads to accessible directories. This Skill identifies unauthenticated upload vectors and validates RCE risks by analyzing server behavior across multiple web stacks.

Yes, this Skill tests upload handling across PHP, JSP, and ASP.NET stacks during bug-bounty programs. It enforces detection of common bypass vectors and generates evidence-ready results with actionable remediation guidance for pentest reports.

Document file upload vulnerabilities by capturing server responses to bypass payloads and mapping them to RCE, XSS, or SSRF risks. This Skill validates evidence through test requests and guides secure remediation recommendations for reporting.

File upload testing detects SSRF and directory traversal risks by analyzing how servers process uploaded content. This Skill identifies unauthenticated upload vectors that attackers can abuse to achieve these vulnerabilities beyond standard RCE and XSS.