Skills for Real Engineers. Straight from my .agents directory.
39 skills
hunt-file-upload
Agent skill from
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php\0.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.
How to install hunt-file-upload
install hunt-file-upload
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/hunt-file-upload/
# into
~/.claude/skills/hunt-file-upload/ (all projects)
.claude/skills/hunt-file-upload/ (one project)
1## 9. FILE UPLOAD23### Content-Type Bypass4```5filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type6filename=shell.phtml, shell.pHp, shell.php5 → extension variants7```89### File Upload Bypass Techniques (10 techniques)1011| Attack | How | Prevention |12|---|---|---|13| Extension bypass | `shell.php.jpg`, `shell.pHp`, `shell.php5` | Allowlist + extract final extension |14| Null byte | `shell.php%00.jpg` | Sanitize null bytes |15| Double extension | `shell.jpg.php` | Only allow single extension |16| MIME spoof | Content-Type: image/jpeg with .php body | Validate magic bytes, not MIME header |17| Magic bytes prefix | Prepend `GIF89a;` to PHP code | Parse whole file, not just header |18| Polyglot | Valid as JPEG and PHP | Process as image lib, reject if invalid |19| SVG JavaScript | `<svg onload="...">` | Sanitize SVG or disallow entirely |20| XXE in DOCX | Malicious XML in Office ZIP | Disable external entities |21| ZIP slip | `../../../etc/passwd` in archive | Validate extracted paths |22| Filename injection | `; rm -rf /` in filename | Sanitize + use UUID names |2324### Magic Bytes Reference2526| Type | Hex |27|---|---|28| JPEG | `FF D8 FF` |29| PNG | `89 50 4E 47 0D 0A 1A 0A` |30| GIF | `47 49 46 38` |31| PDF | `25 50 44 46` |32| ZIP/DOCX/XLSX | `50 4B 03 04` |3334### Stored XSS via SVG35```xml36<?xml version="1.0"?>37<svg xmlns="http://www.w3.org/2000/svg">38 <script>alert(document.domain)</script>39</svg>40```4142---4344## ImageMagick / FFmpeg Exploitation45…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.
CC1 skill
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
An AI skill that provides design intelligence for building professional UI/UX across multiple platforms.
CCCXCUGH6 skills