offensive-file-upload

Name: offensive-file-upload
Author: SnailSploit

2.8kstars447forks

How to install offensive-file-upload?

snailsploit/claude-red/offensive-file-upload

$npx -y skills add SnailSploit/Claude-Red --skill offensive-file-upload

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: File Upload Vulnerabilities
2
3	## Metadata
4	- Skill Name: file-upload
5	- Folder: offensive-file-upload
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/file-upload.md
7
8	## Description
9	File upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`file upload, MIME bypass, extension bypass, magic byte, path traversal upload, SVG XSS, polyglot, upload bypass, malicious upload, web shell upload`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# File Upload Vulnerabilities
29
30	## Mechanisms
31
32	```mermaid
33	flowchart TD
34	A[File Upload Vulnerabilities] --> B[Insufficient File Type Validation]
35	A --> C[Improper Extension Handling]
36	A --> D[Inadequate File Content Analysis]
37	A --> E[Unsafe File Storage]
38	A --> F[File Operation Mishandling]
39	A --> G[Directory Traversal]
40	A --> H[Race Conditions]
41
42	B --> I[Remote Code Execution]
43	C --> I
44	D --> J[Client-Side Attacks]
45	E --> I
46	F --> K[Denial of Service]
47	G --> L[Arbitrary File Access]
48	H --> I
49	```
50
51	File upload vulnerabilities occur when web applications allow users to upload files without implementing proper validation, filtering, and handling mechanisms.
52	These vulnerabilities can lead to various attacks, ranging from simple web defacement to complete server compromise through remote code execution.
53
54	The core technical issues behind file upload vulnerabilities include:
55
56	- Insufficient File Type Validation: Failure to properly validate the actual content/type of uploaded files
57	- Improper Extension Handling: Not restricting dangerous file extensions or allowing easy bypasses
58	- Inadequate File Content Analysis: Not checking the actual file content versus relying only on extension or content-type
59	- Unsafe File Storage: Storing files in executable directories or with dangerous permissions
60	- File Operation Mishandling: Not securely handling file operations during the upload process
61	- Directory Traversal Vulnerabilities: Allowing manipulation of upload paths
62	- Race Conditions: Timing issues during validation and moving of uploaded files
63	- Archive Extraction Flaws: Insecure handling of archive formats like ZIP or TAR (e.g., Symlink abuse, Zip Slip)
64
65	File upload vulnerabilities can manifest in various upload functionality patterns:
66
67	- Profile Picture Uploads: Common in user profiles and social media
68	- Document Repositories: File sharing services and document management systems
69	- Media Uploads: Image, video, and audio uploaders
70	- Bulk Import Features: CSV, XML, and other data import functionality
71	- Content Management Systems: Templates, plugins, themes, and media libraries
72
73	## Hunt
74
75	### Identifying File Upload Vulnerabilities
76
77	#### Target Discovery
78
79	1. Map File Upload Functionality:
80	- Profile picture uploads
81	- Document/attachment uploads
82	- Import/export features
83	- Media galleries
84	- CMS admin sections
85	- Backup/restore features
86	- Avatar/image uploads
87
88	2. Identify Upload Processing Patterns:
89	- Client-side validation patterns (JavaScript checks)
90	- Server-side validation indicators
91	- File type restrictions mentioned in UI
92	- Error messages related to file types
93
94	3. Testing Prerequisites:
95	- Collection of test files (various formats)
96	- Proxy for intercepting requests (Burp Suite, ZAP)
97	- Web shells for testing execution
98	- MIME-type tools for manipulation
99	- Containerized/sandboxed converters ready for validation (e.g., bwrap/seccomp profiles)
100
101	#### Testing Methodologies
102
103	1. Basic File Upload Testing:
104	- Test uploading standard expected files (baseline)
105	- Attempt uploading executable file types (PHP, ASP, JSP, etc.)
106	- Modify content-type headers during upload
107	- Change file extensions after client-side validation
108
109	2. Extension-Based Testing:
110	- Test alternate extensions for web shells:
111	```
112	.php, .php3, .php4, .php5, .phtml, .phar, .phpt, .pht, .phps, .php2, .php6, .php7, .inc, .shtml, .pgif
113	.asp, .aspx, .ashx, .asmx, .cer, .asa
114	.jsp, .jspx, .jsw, .jsv, .jspf
115	.cfm, .cfml, .cfc, .dbm (Coldfusion)
116	.pl, .py, .rb, .cgi
117	```
118	- Test double extensions:
119	```
120	file.jpg.php
121	file.php.jpg
122	file.php.jpeg
123	file.php%00.jpg # Null byte (older versions)
124	file.php%20.jpg # URL encoded space
125	file.php%0d%0a.jpg # C

People who liked this also viewed

6 picks

Type

offensive-file-upload

2.8kstars447forks

View on GitHub

How to install offensive-file-upload?

snailsploit/claude-red/offensive-file-upload

$npx -y skills add SnailSploit/Claude-Red --skill offensive-file-upload

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: File Upload Vulnerabilities
2
3	## Metadata
4	- Skill Name: file-upload
5	- Folder: offensive-file-upload
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/file-upload.md
7
8	## Description
9	File upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`file upload, MIME bypass, extension bypass, magic byte, path traversal upload, SVG XSS, polyglot, upload bypass, malicious upload, web shell upload`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# File Upload Vulnerabilities
29
30	## Mechanisms
31
32	```mermaid
33	flowchart TD
34	A[File Upload Vulnerabilities] --> B[Insufficient File Type Validation]
35	A --> C[Improper Extension Handling]
36	A --> D[Inadequate File Content Analysis]
37	A --> E[Unsafe File Storage]
38	A --> F[File Operation Mishandling]
39	A --> G[Directory Traversal]
40	A --> H[Race Conditions]
41
42	B --> I[Remote Code Execution]
43	C --> I
44	D --> J[Client-Side Attacks]
45	E --> I
46	F --> K[Denial of Service]
47	G --> L[Arbitrary File Access]
48	H --> I
49	```
50
51	File upload vulnerabilities occur when web applications allow users to upload files without implementing proper validation, filtering, and handling mechanisms.
52	These vulnerabilities can lead to various attacks, ranging from simple web defacement to complete server compromise through remote code execution.
53
54	The core technical issues behind file upload vulnerabilities include:
55
56	- Insufficient File Type Validation: Failure to properly validate the actual content/type of uploaded files
57	- Improper Extension Handling: Not restricting dangerous file extensions or allowing easy bypasses
58	- Inadequate File Content Analysis: Not checking the actual file content versus relying only on extension or content-type
59	- Unsafe File Storage: Storing files in executable directories or with dangerous permissions
60	- File Operation Mishandling: Not securely handling file operations during the upload process
61	- Directory Traversal Vulnerabilities: Allowing manipulation of upload paths
62	- Race Conditions: Timing issues during validation and moving of uploaded files
63	- Archive Extraction Flaws: Insecure handling of archive formats like ZIP or TAR (e.g., Symlink abuse, Zip Slip)
64
65	File upload vulnerabilities can manifest in various upload functionality patterns:
66
67	- Profile Picture Uploads: Common in user profiles and social media
68	- Document Repositories: File sharing services and document management systems
69	- Media Uploads: Image, video, and audio uploaders
70	- Bulk Import Features: CSV, XML, and other data import functionality
71	- Content Management Systems: Templates, plugins, themes, and media libraries
72
73	## Hunt
74
75	### Identifying File Upload Vulnerabilities
76
77	#### Target Discovery
78
79	1. Map File Upload Functionality:
80	- Profile picture uploads
81	- Document/attachment uploads
82	- Import/export features
83	- Media galleries
84	- CMS admin sections
85	- Backup/restore features
86	- Avatar/image uploads
87
88	2. Identify Upload Processing Patterns:
89	- Client-side validation patterns (JavaScript checks)
90	- Server-side validation indicators
91	- File type restrictions mentioned in UI
92	- Error messages related to file types
93
94	3. Testing Prerequisites:
95	- Collection of test files (various formats)
96	- Proxy for intercepting requests (Burp Suite, ZAP)
97	- Web shells for testing execution
98	- MIME-type tools for manipulation
99	- Containerized/sandboxed converters ready for validation (e.g., bwrap/seccomp profiles)
100
101	#### Testing Methodologies
102
103	1. Basic File Upload Testing:
104	- Test uploading standard expected files (baseline)
105	- Attempt uploading executable file types (PHP, ASP, JSP, etc.)
106	- Modify content-type headers during upload
107	- Change file extensions after client-side validation
108
109	2. Extension-Based Testing:
110	- Test alternate extensions for web shells:
111	```
112	.php, .php3, .php4, .php5, .phtml, .phar, .phpt, .pht, .phps, .php2, .php6, .php7, .inc, .shtml, .pgif
113	.asp, .aspx, .ashx, .asmx, .cer, .asa
114	.jsp, .jspx, .jsw, .jsv, .jspf
115	.cfm, .cfml, .cfc, .dbm (Coldfusion)
116	.pl, .py, .rb, .cgi
117	```
118	- Test double extensions:
119	```
120	file.jpg.php
121	file.php.jpg
122	file.php.jpeg
123	file.php%00.jpg # Null byte (older versions)
124	file.php%20.jpg # URL encoded space
125	file.php%0d%0a.jpg # C

People who liked this also viewed

6 picks

Type