upload-insecure-files

Extension validation bypasses include double extensions (shell.php.jpg), case variations (shell.PhP), trailing dots or spaces, null bytes (shell.php%00.jpg), and IIS semicolon truncation (shell.asp;.jpg). The right technique depends on whether the server checks extension, MIME type, or magic bytes.

Test the four trust boundaries separately: accept, store, process, and serve. Upload a benign marker file first to map rename and retrieval behavior, then try one validation bypass and one active-content payload, and finally probe background processors like image resizers or archive extractors.

A polyglot file is valid in two or more formats simultaneously, such as a GIF with an appended JAR or a PNG with PHP code in its metadata. It passes format-specific validation while still delivering an executable payload when parsed by a different component.

Yes, crafted HLS playlist (.m3u8) files can make FFmpeg fetch arbitrary URLs server-side, including cloud metadata endpoints like 169.254.169.254. The concat protocol can also read local files such as /etc/passwd and embed them in output.

Successful upload alone is insufficient; you also need the file's web-accessible path and a server configuration that parses it as code. Check for path discovery issues, forced-download Content-Disposition headers, and whether the web server handler actually executes the extension.

Yes, it covers S3 presigned URL abuse, Azure Blob SAS token scope issues, and GCS signed URLs. Key checks include whether Content-Type is included in SignedHeaders and whether the full key path or only a prefix is signed.