vulns.co
/
mcp by GKData.io

File upload hunting

See which signal the server trusts: extension, declared type, or magic bytes. Then see how the file is served. Inert fixtures only.

Playbooks

  • File Upload to RCE - Turn a file upload into code execution by defeating type/extension checks.
  • LFI to RCE - File read is P3-P4. Wrappers, log poison, session files, and upload + include are how it becomes RCE.
  • Back-office Renderer Sinks - Find attacker-controlled records that are rendered later in support, moderation, reporting, export, or admin workflows, then prove the smallest safe execution or sensitive-action path.

Gadgets

  • File upload gadget - XSS if it is served as HTML/SVG from a cookie domain. RCE if the server parses it (ImageMagick, LibreOffice, FFMpeg, unzip). ATO if it overwrites an avatar consumed as HTML.
  • XML external entity / DTD fetch - A parser that loads a DTD from a URL you control is at least SSRF. File read and billion-laughs are extra, not the first proof.

Payloads

  • XML External Entity - Classic file read via inline entity; blind exfiltration via an external DTD you host. Also works through SVG and Office (docx/xlsx) uploads. Avoid billion-laughs on prod - it's a DoS.
  • SVG / XML XSS - Uploads and image viewers that serve SVG as image/svg+xml from a cookied origin. Also markup inside PDF/XML.
  • Upload type-confusion canaries - Tiny inert fixtures to see which signal the server trusts: extension, declared type, or magic bytes. Never upload executable or XSS-active content to a shared origin.

Bypasses

  • LFI / path-traversal bypass - Read files when naive traversal is filtered, then escalate. PHP filter chains are the modern, upload-free path to RCE; null-byte truncation is legacy (flagged below).
  • Upload validation boundaries - Assess whether uploads are constrained by extension, content signature, storage location, retrieval headers, and authorization. Use tiny inert fixtures and an account you control; never upload executable or active content.

Related disclosures

Questions

Is a polyglot XSS in an upload a P1?

If it executes in the victim origin, it is XSS. If it downloads as attachment with a safe content-type, it is usually nothing.

What fixtures are OK?

Tiny text and a valid 1x1 PNG. Never upload malware or steal other users' files.

This page is the public form of hunt_brief("upload") on the MCP connector. Authorized testing only.