hunt-file-upload

Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.

请帮我安装这个 Agent Skill：https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-file-upload

1. 先读取该目录下的 SKILL.md 和其他文件，检查是否有可疑内容（执行未知脚本、读取密钥、向外发送数据等），用中文告诉我它会做什么、需要哪些权限；
2. 等我确认后，再把整个目录安装到 ~/.claude/skills/hunt-file-upload/（如果你不是 Claude Code，安装到你自己约定的 skills 目录）；
3. 安装后告诉我怎么触发它。

git clone --depth 1 --filter=blob:none --sparse https://github.com/elementalsouls/Claude-BugHunter.git /tmp/hunt-file-upload-src
cd /tmp/hunt-file-upload-src && git sparse-checkout set "skills/hunt-file-upload"
mkdir -p ~/.claude/skills && cp -r "skills/hunt-file-upload" ~/.claude/skills/hunt-file-upload

Skill 可以让智能体执行脚本。安装第三方 Skill 前务必看一遍内容，详见「安全」一课。