50 lines
1.6 KiB
Bash
Executable File
50 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 15: File Upload Vulnerabilities
|
|
# Desc: Unrestricted file upload, path traversal in upload
|
|
# Detect: Upload forms, multipart endpoints
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_fileup() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing File Upload vectors..."
|
|
|
|
# Find upload endpoints
|
|
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
local upload_urls=$(echo "$page" | grep -oiP 'action="[^"]*upload[^"]*"\|enctype="multipart/form-data"' | head -5)
|
|
|
|
if [ -n "$upload_urls" ]; then
|
|
print_info "Upload form detected, testing restrictions..."
|
|
|
|
# Try uploading a PHP shell (harmless test)
|
|
local test_content='<?php echo "UPLOAD_TEST"; ?>'
|
|
local tmpfile=$(mktemp)
|
|
echo "$test_content" > "$tmpfile"
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 \
|
|
-F "file=@${tmpfile};filename=test.php" \
|
|
-F "file=@${tmpfile};filename=test.php.jpg" \
|
|
-F "file=@${tmpfile};filename=test.png;type=image/png" \
|
|
"$target" 2>/dev/null)
|
|
|
|
rm -f "$tmpfile"
|
|
|
|
if echo "$response" | grep -qi "uploaded\|success\|200\|stored"; then
|
|
print_find "File Upload Vulnerability!" "PHP file accepted as upload"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Unrestricted File Upload
|
|
DETAIL: Server accepted PHP file upload on $target
|
|
EVIDENCE: Upload response indicates success
|
|
EXPLOIT: Upload PHP web shell for RCE" > "$REPORTS_DIR/.finding_$(date +%s)_fileup.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
else
|
|
print_skip "No upload forms detected"
|
|
fi
|
|
|
|
return $findings
|
|
}
|