Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.
Detected risks:
A security-testing playbook in the yaklang hack-skills collection, focused on assessing insecure file-upload functionality in web applications during authorized testing. Per its description it examines upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and how weak upload handling can chain into remote code execution. It is framed as an expert playbook for testers evaluating whether an application's file-upload feature can be abused, a common and high-impact web vulnerability class. In a catalog context it is web-application penetration-testing tooling used to find and demonstrate upload-handling weaknesses so they can be fixed. Because upload-to-RCE chains can fully compromise a server, it should be used only against applications the tester is authorized to assess. Developers can use the same categories as a review checklist: validating file type and content, isolating storage from execution, sanitizing filenames and paths, and hardening any server-side processing of uploaded files.
Testing insecure file uploads — validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.
In authorized web-application penetration tests to find and demonstrate weaknesses in file-upload handling.
Weak upload handling can chain into remote code execution, which can fully compromise a server.
Yes — it should only be used against applications you are authorized to test.
As a review checklist: validate file type/content, isolate storage from execution, sanitize filenames/paths, and harden server-side processing.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills