File upload hunting
See which signal the server trusts: extension, declared type, or magic bytes. Then see how the file is served. Inert fixtures only.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
- Stored script execution through an upload surface - Stored cross-site scripting through file upload
Playbooks
- File Upload to RCE - Turn a file upload into code execution by defeating type/extension checks.
Payloads
- Upload type-confusion canaries - Tiny inert fixtures to see which signal the server trusts: extension, declared type, or magic bytes. Never upload executable or XSS-active content to a shared origin.
Questions
Is a polyglot XSS in an upload a P1?
If it executes in the victim origin, it is XSS. If it downloads as attachment with a safe content-type, it is usually nothing.
What fixtures are OK?
Tiny text and a valid 1x1 PNG. Never upload malware or steal other users' files.
This page is the linked pack hunt_brief("upload") returns on the MCP connector. Authorized testing only.