file-upload-endpoint

[mchklt]

Detects endpoints with forms that contain file upload functionality by identifying form tags with relevant attributes such as method, input, and button elements. This can potentially expose the application to risks like remote code execution, XSS attacks, or abuse of the server for hosting malicious files.

[mchklt]

id: file-upload-endpoint
info:
  name: File Upload Endpoint Detection
  author: mchklt
  severity: info
  description: Detects endpoints with forms containing file upload fields by checking for form tags with method, input, and button elements.

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "<form[^>]*method=[\"']?(post|POST)[\"']?[^>]*>"
          - "<input[^>]*type=[\"']?file[\"']?[^>]*>"
          - "<button[^>]*type=[\"']?submit[\"']?[^>]*>"
        condition: or
      - type: regex
        part: body
        regex:
          - "type=[\"'](file)[\"']"
          - "<button[^>]*type=[\"']?submit[\"']?[^>]*>"
        condition: or

[mchklt]

This helped me identify endpoints containing file upload forms, leading to XSS via filename manipulation combined with CSRF .

For more details, you can read my article: Self-XSS via Filename + CSRF on Contact Us 'multipart/data' Form.