Upload Scanner
Summary: PortSwigger Research describes a Burp Suite extension, Upload Scanner, built to automate attacks against HTTP file uploads, including XSS, XXE, PHP/JSP/ASP code injection, and SSRF through m3u8 playlists parsed with LibAv. The extension is divided into modules by attack category, and its author is Tobias 'floyd' Ospelt of modzero AG, with version 1.0.8a last updated 21 February 2022.
What's compelling: The research argues file uploads are an underestimated testing area, since any server that parses files carries a much larger attack surface - and a REST XML service safe from XXE can still have an XXE issue in the image parser reading JPEG XMP metadata.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026