insecure-file-upload

Testing file upload endpoints for remote code execution involves uploading files with spoofed magic bytes, bypassed extensions, and path traversal payloads to analyze multipart/form-data mechanisms for unauthorized code execution flaws.

Magic byte spoofing is manipulating file headers to match expected file types, bypassing MIME type validation by passing content-type sniffing checks while delivering malicious executable content to the server.

Preventing SVG XSS and XXE via Office documents requires testing document import features for embedded malicious scripts and XML external entity payloads to validate that user-supplied file storage neutralizes active content.

Detecting ZIP slip and path traversal in file upload mechanisms involves analyzing archive extraction and file storage processes to identify if uploaded file names can escape target directories and overwrite system files.

Polyglot files are crafted payloads valid as multiple file formats simultaneously, used in vulnerability testing to bypass restrictive file type validation and execute embedded malicious code through insecure upload parsers.

Unrestricted file upload testing works on profile picture and document import features by analyzing user-supplied file storage to ensure only legitimate files are accepted and malicious content is neutralized.