hunt-file-upload
列出多种绕过技巧，实战可直接复用。
含攻击与漏洞利用内容，禁止未授权使用
检测文件上传绕过与利用技巧以触发 XSS/SSRF 或 RCE。
把各种文件上传绕过和利用手法都搬出来：双扩展、magic bytes、null byte、.htaccess、SVG/HTML XSS、DOCX XXE、ZIP slip 等，最终验证能否触发 XSS、SSRF 或真正的 RCE。有上传接口（/upload、avatar、attachment 等）就该跑这套测试，先试能不能绕过类型/扩展检查再验证执行。特点是技巧多样且容易被忽视，单个可执行文件就能直接拿到 shell 或泄露凭证。
▸ 展开 SKILL.md 英文原文
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php .jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-file-upload/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-file-upload/SKILL.md"## 9. FILE UPLOAD ### Content-Type Bypass ``` filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type filename=shell.phtml, shell.pHp, shell.php5 → extension variants ``` ### File Upload Bypass Techniques (10 techniques) | Attack | How | Prevention | |---|---|---| | Extension bypass | `shell.php.jpg`, `shell.pHp`, `shell.php5` | Allowlist + extract final extension | | Null byte | `shell.php%00.jpg` | Sanitize null bytes | | Double extension | `shell.jpg.php` | Only allow single extension | | MIME spoof | Content-Type: image/jpeg with .php body | Validate magic bytes, not MIME header | | Magic bytes prefix | Prepend `GIF89a;` to PHP code | Parse whole file, not just he