hunt-upload

name	hunt-upload
description	File upload attack hunting - extension/content-type/magic-byte bypass to web-shell RCE, path traversal in filename, SVG/XML XSS, zip slip, and pixel-flood DoS. Wiki-first, FIND schema output.

Hunt: File Upload

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "file upload webshell extension content-type magic-byte bypass SVG XXE zip slip path traversal" via wiki-search MCP

Hub: [[web-moc]] (live index). Primary page: [[file-upload]]. Payload arsenal: wiki/payloads/file-upload.md. Anchors: [[path-traversal-lfi]].

Attack surface

Rank the sinks first - not every upload reaches code:

• Avatar / profile / logo / signature fields - most common; frequently re-encoded, so check whether the original bytes are served back.
• Document / CSV / XML import - parser sinks (XXE, formula injection, zip).
• Ticket / message attachments - often served under the original name and type from a reachable path.
• Image-processing (thumbnails -> ImageMagick/Ghostscript), SVG/PDF render, EXIF parsers - the processor is the bug, not the store.
• Firmware / plugin / theme upload - direct code load; highest value when present.

Then attack in layers, cheapest first: extension -> content-type -> magic-byte -> parser/render.

Methodology

1. Baseline: upload a valid file; note stored path, returned URL, filename transformation, and whether it is reachable + executed by the server.
2. Extension bypass:

shell.php  shell.phtml  shell.php5  shell.phar  shell.pHp
shell.php.jpg   shell.jpg.php   shell.php%00.jpg   shell.php;.jpg
shell.php/   shell.php....   (trailing dot/space on Windows)
.htaccess  ->  AddType application/x-httpd-php .jpg   (then upload .jpg shell)
web.config (IIS)   .jsp/.jspx/.war (Java)   .asp/.aspx (IIS)

3. Content-Type / magic-byte bypass: set Content-Type: image/png; prepend real magic bytes (GIF89a;, \xFF\xD8\xFF JPEG, %PDF-) before the payload; polyglot (valid image + PHP).
4. Path traversal in filename: filename="../../../../var/www/html/shell.php" to escape the upload dir / overwrite files.
5. SVG / XML: SVG with <script> -> stored XSS ([[xss]]); SVG/XML with external entity -> [[xxe]] (file read/SSRF).
6. Archive: zip-slip (../ paths inside zip) on extract; symlink in archive -> read host files.
7. Image processing: ImageMagick/Ghostscript (ImageTragick CVE-2016-3714), pixel-flood DoS, EXIF payload executed by a downstream parser.
8. Confirm by execution, through Burp. Request the uploaded shell in Burp Repeater (operator visibility) and run a command (?cmd=id); OOB callback if blind. For traversal, fetch the written/read target back from the path you claimed it hit.
9. Distill (confirmed, generic): per hunt-core, python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/file-upload.md.

Evasion (when a layer rejects)

Double extension (shell.php.jpg / shell.jpg.php), null byte (shell.php%00.jpg), content-type spoof (Content-Type: image/png on a script), magic-byte prefix (GIF89a; + payload), and case variation (.pHp, .PHtml). Combine them - a single-layer allowlist rarely survives extension + content-type + magic-byte applied together.

Chaining

• Upload -> web-shell RCE: once a shell executes, hand off hunt-rce for post-exploitation and CVE-specific escalation.
• SVG/HTML -> stored XSS: hand off hunt-xss (marker discipline, blind-XSS beacon for a stored context).
• SVG/XML/DOCX -> XXE: hand off hunt-injection (OOB-mandatory for blind XXE).

Confirmation gate

NOT confirmation: the upload was accepted; a 200 or a returned file URL; the file shows up in a listing; a stored path you have not fetched back; a script uploaded but never requested; a traversal filename accepted with nothing actually read or written outside the upload dir.

IS confirmation: the uploaded file executed as code - fetch it back and it runs your command (?cmd=id returns output) or fires an OOB callback when blind; or the traversal demonstrably wrote or read outside the upload dir, proven by fetching that target back. SVG/XML: the script fires in a victim context, or the external entity returns file contents / an OOB hit. Reproduce in a clean session.

Severity

CRITICAL if code execution; HIGH if stored XSS / XXE / arbitrary file write to a sensitive path; MEDIUM if upload of a dangerous type with no execution path proven.

Deadends

Append: - [ ] upload <host> <endpoint> -- ext+CT+magic+traversal all blocked; files re-encoded + served from CDN no-exec

Record which layers you cleared and which held, so the next pass does not retry them.