hunt-file-upload

Name: hunt-file-upload
Availability: InStock
Author: entrovyx

Identify and exploit file upload vulnerabilities including RCE, SSRF, and XSS.

3|1|Updated Jul 2, 2026

Search Tags:#vulnerability #pentesting #ssrf #file-upload #rce #offsec

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-file-upload-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-file-upload
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-file-upload
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-file-upload-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and exploiting complex file upload vulnerabilities, which are often overlooked by automated scanners but represent critical entry points for RCE and SSRF.

Core Features & Use Cases

Bypass Techniques: Provides a comprehensive library of 10+ techniques including extension manipulation, magic byte spoofing, and polyglot file generation.
Advanced Exploitation: Guides the user through SSRF via image processing libraries (ImageMagick/FFmpeg) and headless browser PDF generation.
Use Case: When testing an avatar upload or document import feature, use this skill to systematically verify if the application is vulnerable to RCE via webshells or SSRF via malicious XML/SVG payloads.

Quick Start

Use the hunt-file-upload skill to test the current target for file upload bypasses and SSRF vulnerabilities by applying the recommended payload sequence.

Frequently Asked Questions about hunt-file-upload

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit file upload vulnerabilities for RCE and SSRF?▼

To exploit file upload vulnerabilities for RCE and SSRF, systematically test extension handling, MIME types, and backend processing libraries using bypass techniques like extension manipulation, magic byte spoofing, and polyglot file generation.

What is SSRF via image processing libraries?▼

SSRF via image processing libraries occurs when backend processors like ImageMagick or FFmpeg handle malicious payloads during avatar uploads or document processing, allowing attackers to trigger server-side requests through specially crafted XML or SVG files.

How do I bypass file upload validation using magic byte spoofing?▼

Magic byte spoofing bypasses file upload validation by injecting valid file signatures at the start of a malicious payload, tricking MIME type checks into accepting webshells or polyglot files intended for RCE exploitation.

Can I trigger SSRF through headless browser PDF generation?▼

Yes, you can trigger SSRF through headless browser PDF generation by uploading malicious payloads that force the backend document processor to render external resources, exploiting the server's internal network access.

Does this approach test avatar uploads and document import features?▼

Yes, this approach targets web application features such as avatar uploads, document processors, and import/export functions to validate security impact through systematic testing of backend processing libraries.

What are the limitations of automated scanners for file upload vulnerabilities?▼

Automated scanners often overlook complex file upload vulnerabilities that require advanced bypass combinations, making manual systematic testing of extension handling and backend library processing necessary to validate RCE and SSRF impact.