What problem does it solve?
This Skill eliminates the gap in manual file upload security testing by providing a structured, comprehensive playbook that covers all trust boundaries (accept, store, process, serve) and the wide variety of validation bypasses and exploitation paths that are easy to miss during ad-hoc testing.
Core Features & Use Cases
- 4-Stage Testing Framework: Guides systematic testing across the accept, store, process, and serve stages to catch bugs hidden in unvalidated phases of the upload workflow.
- Server-Specific Bypass Guidance: Covers parsing quirks and known CVEs for IIS, Nginx, Apache, Tomcat, WebLogic, and Apache Flink to bypass extension, MIME, and magic byte checks.
- Exploitation Chaining: Maps upload flaws to downstream vulnerabilities including XSS, XXE, command injection, path traversal, and business logic bugs for full impact demonstration.
- Use Case: When testing a web application that accepts user avatar uploads, document imports, or archive processing, use this Skill to systematically identify validation bypasses, storage abuse, and upload-to-RCE chains.
Quick Start
Use the upload-insecure-files skill to test the target application's file upload feature, first mapping its accept, store, process, and serve stages then testing validation bypass payloads tailored to its server stack.
