Upload Insecure Files

When you need to test file upload endpoints beyond just "does it accept .php," this is the playbook. It walks through the four trust boundaries of accept, store, process, and serve, which is the right mental model because bugs usually hide in a different stage than where you uploaded. You get validation bypass patterns (double extensions, polyglots, magic byte tricks), processing chain attacks (ImageMagick, FFmpeg, zip slip), and the authorization gaps that live in direct object URLs and cross-tenant paths. It routes you to companion skills for XXE in SVG imports, path traversal in archive extraction, and XSS in filename reflection. Honest take: if you're only checking upload success without testing retrieval and background processing, you're missing the actual impact.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill upload-insecure-files --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Upload Insecure Files — Validation Bypass, Storage Abuse, and Processing Chains

AI LOAD INSTRUCTION: Expert file upload attack playbook. Use when the target accepts files, imports, avatars, media, documents, or archives and you need the full workflow: validation bypass, storage path abuse, post-upload access, parser exploitation, multi-tenant overwrite, and chaining into XSS, XXE, CMDi, traversal, or business logic impact. For web server parsing vulnerabilities, PUT method exploitation, and specific CVEs (WebLogic, Flink, Tomcat), load the companion SCENARIOS.md.