hunt-file-upload

To exploit file upload vulnerabilities for RCE and SSRF, systematically test extension handling, MIME types, and backend processing libraries using bypass techniques like extension manipulation, magic byte spoofing, and polyglot file generation.

SSRF via image processing libraries occurs when backend processors like ImageMagick or FFmpeg handle malicious payloads during avatar uploads or document processing, allowing attackers to trigger server-side requests through specially crafted XML or SVG files.

Magic byte spoofing bypasses file upload validation by injecting valid file signatures at the start of a malicious payload, tricking MIME type checks into accepting webshells or polyglot files intended for RCE exploitation.

Yes, you can trigger SSRF through headless browser PDF generation by uploading malicious payloads that force the backend document processor to render external resources, exploiting the server's internal network access.

Yes, this approach targets web application features such as avatar uploads, document processors, and import/export functions to validate security impact through systematic testing of backend processing libraries.

Automated scanners often overlook complex file upload vulnerabilities that require advanced bypass combinations, making manual systematic testing of extension handling and backend library processing necessary to validate RCE and SSRF impact.