Upload type-confusion canaries
Tiny inert fixtures to see which signal the server trusts: extension, declared type, or magic bytes. Never upload executable or XSS-active content to a shared origin.
Tags: upload, xss, rce
Controlled probes
hello.txt with plain UTF-8 textvalid 1x1 PNG bytes named hello.txtvalid 1x1 PNG named hello.png.jpgAfter upload, inspect Content-Type, Content-Disposition, and whether another account can fetch it
Source: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload