wildhunter logo
The arsenal

Payloads.

Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.

SQL InjectionXSSSSRFCommand InjectionSSTIFile Inclusion (LFI)Path TraversalInsecure DeserializationNoSQL InjectionGraphQLJWTCORSRequest SmugglingOpen RedirectFile UploadIDOROAuthAccount TakeoverRace ConditionCRLF InjectionCSRFLDAP InjectionXXEWeb Cache Deception

File Upload

Uploaded files execute when the server trusts filename, content-type, or location — from harmless overwrite to webshell RCE. Every upload feature has three attack surfaces: the name, the content, and where it lands.

Severity guide

Critical when code execution is proven; high for stored-XSS-via-SVG and file-overwrite primitives; medium for unlimited-size/type DoS.

Where to look

entry points to test first

01

Avatar/profile images

The most common upload — test extension/Content-Type handling and where the file is served from.

02

Document/CSV importers

Business features parsing user files (Excel, CSV, PDF) — deserialization and parser bugs live here.

03

Attachment endpoints

Support tickets, messages — files served back with original names/types.

04

ZIP/archive uploads

Extraction features — Zip Slip and resource exhaustion both apply.

05

SVG/HTML uploads

Anything serving SVG inline — that's stored XSS on a platter.

How to hunt it

in order, start to finish

  1. Upload a benign file first

    A text file named test.txt. Find WHERE it lands (response URL, guessing) — you need retrieval to prove anything.

  2. Map the validation

    Try .php (blocked?), Content-Type mismatches, magic bytes — each failure tells you which layer is checking.

  3. Attack extensions

    Lesser-known executables: .config, .cer, .asa on IIS; shell.aspx;1.jpg semicolon tricks on old IIS; double extensions everywhere.

  4. Attack metadata

    Match the magic bytes (GIF89a) with PHP inside, or abuse SVG which browsers execute as script.

  5. Attack content parsers

    Malformed images/PDFs against the processing library — ImageTragick-class bugs and PDF parsers crash and execute.

  6. Prove execution — then stop

    phpinfo()-level proof is enough for the report; a persistent webshell crosses into damage.

Filter & validation bypasses

when your first tries get blocked
  • 01Extension blocked? Double extensions (shell.php.jpg), trailing dots/spaces (Windows), semicolons (IIS<7), or null bytes (old PHP).
  • 02Content-Type checked? Send image/gif with PHP inside — MIME is client-controlled, validators that trust it fail.
  • 03Magic bytes checked? GIF89a header prepended to PHP passes getimagesize() while still executing.
  • 04Everything renamed? The rename is safe — but the SERVED content-type matters; SVG/image/svg+xml executes script regardless of extension.

Impact ladder

what makes it payable
  1. 01Webshell/RCE — executing uploads are game over.
  2. 02Stored XSS via SVG/HTML — script runs on the site's origin.
  3. 03File overwrite/interference — replacing other users' or system files.
  4. 04DoS — decompression bombs and unlimited-size uploads.

Payloads

5 · from PayloadsAllTheThings
shell.aspx;1.jpg

IIS < 7.0 semicolon parsing — executes as ASPX despite the .jpg tail.

.cer

IIS <= 7.5 executes .cer as ASP — passes image-focused extension filters.

.config

IIS web.config upload = webshell via handler injection.

Content-Type: text/php

MIME-variant abuse — servers trusting Content-Type over extension miss non-standard types.

Content-Type: image/gif

The spoofed header paired with magic bytes — GIF89a prefix plus PHP payload.

ToolsBurp Repeater/
Full File Upload section ↗

Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.

Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.

Payloads — wildhunter