What problem does it solve?
Reflected File Download (RFD) vulnerabilities are frequently missed during web application penetration tests because each individual condition (reflection, filename control, permissive content handling) appears harmless in isolation. This Skill provides a systematic methodology to confirm all three conditions, weaponize the finding, and prove client-side command execution rather than reporting a theoretical risk.
Core Features & Use Cases
- Reflection Discovery: Locate endpoints that echo attacker input into response bodies, with emphasis on JSON APIs and JSONP callbacks as the cleanest sinks.
- Filename and Extension Control Testing: Probe trailing path segments, semicolon/matrix parameters, encoded slashes, and download parameters to determine whether the browser saves responses with attacker-controlled executable names like setup.bat.
- Payload Crafting and Validation: Build leading-command batch payloads (e.g., ||calc||) and confirm execution in a real browser on a Windows victim VM, including OOB callback verification.
- Use Case: During an authorized bug bounty engagement, you find a JSONP endpoint /api/data?callback= that reflects input at the body start. You confirm /api/data/setup.bat returns the same body, craft ?callback=||calc||, and demonstrate that a victim downloading and running the file executes arbitrary commands from a trusted domain.
Quick Start
Ask the AI to test the target application's JSONP callback endpoint for Reflected File Download by checking reflection, filename control via path suffixes, and Content-Disposition headers.
