git clone https://github.com/sAjibuu/Upload_Bypass.git

pip install -r requirements.txt

sudo docker pull sajibuu/upload_bypass 

sudo docker build -t sajibuu/upload_bypass .

sudo docker run -v $(pwd)/request:/Upload_Bypass/{your_request_file} -it sajibuu/upload_bypass -r request -s 'file was uploaded successfully' -E php -e

sudo docker run -v $(pwd)/request:/Upload_Bypass/{your_request_file} -it sajibuu/upload_bypass -r request -s 'file was uploaded successfully' -E php -e -p http://{docker_interface_IP}:8080

Usage: Upload Bypass [OPTIONS]

Options:
  -h, --help     Print help (see more with '--help')
  -U, --usage   Print the how to save the request file instructions.
  -v, --version  Print version

Required Arguments: 
  -r, --request_file <REQUEST_FILE>    Provide a request file to be proccessed
  -E, --extension    <EXTENSION>       Forbidden extension to check (ex: php)
  -A, --allowed      <EXTENSION>       Allowed extension (ex: jpeg) - Optional - if not set the program will auto-detect the extension

  Choose only one from the options below:
  -s, --success      <MESSAGE>         Provide a success message when a file is uploaded (ex: File was uploaded successfully)
  -f, --failure      <MESSAGE>         Provide a failure message when a file is uploaded (ex: File is not allowed!)
  -S, --status_code  <STATUS_CODE>     Provide a status code for a success upload (ex: 200)

Mode Settings: 
  -d, --detect          Upload harmless sample files (Suitable for a real penetration test)
  -e, --exploit         Upload Web-Shells files when testing
  -a, --anti_malware    Upload Anti-Malware Test file (Eicar) when testing
      I.  If set with -E flag the program will test with the Eicar string along with the choosen extension
      II. If set without the -E flag the program will test with Eicar string and a com extension

Modules Settings:     
  -l, --list            List all modules  
  -i, --include_only <MODULES>   Include only modules to test from (ex: extension_shuffle, double_extension)
  -x, --exclude      <MODULES>   Exclude modules (ex: svg_xxe, svg_xss)

Request Settings: 
  --base64              Encode the file data with Base64 algorithm
  --allow_redirects     Follow redirects
  -P, --put             Use the HTTP PUT method for the requests (Default is POST)
  -Pa, --patch          Use the HTTP Patch method for the requests (Default is POST)
  -R, --response        Print the response to the screen
  -c, --continue        Continue testing all files, even if a few uploads encountered success
  -t, --time_out <NUM>  Set the request timeout (Default is 8)
  -rl, --rate_limit <NUMBER>  Set a rate-limit with a delay in milliseconds between each request

Proxy Settings: 
  -p, --proxy <PROXY>   Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port)
  -k, --insecure        Do not verify SSL certificates
  --burp_http           Set --proxy to 127.0.0.1:8080 and set --insecure to true (For HTTP requests)
  --burp_https          Set --proxy to 127.0.0.1:8080 and set --insecure to false (For HTTPs requests)

Optional Settings: 
  -D, --upload_dir <UPLOAD_DIR>  Provide a remote path where the Web-Shell should be uploaded (ex: /uploads)
  -o, --output  <OUTPUT_PATH>    Output file to write the results into - Default current directory (ex: ~/Desktop/results.txt)
  --debug  <NUM>                 Debug mode - Print the stack trace error to the screen and save it to a file (ex: --debug 1)
      I.  Level 1 - Saves only the stack trace error (default).
      II. Level 2 - Saves the stack trace error and user's arguments along with the request file.
  
Resume settings:
  --resume  <STATE_FILE>  State file from which to resume a partially complete scan

Update settings:
  -u, --update  Update the program to the latest version

 python upload_bypass.py -r test -s 'File uploaded successfully' -E php -D /uploads --burp --detect

 python upload_bypass.py -r test -s 'File uploaded successfully' -E php -D /uploads --burp --exploit

 python upload_bypass.py -r test -s 'File uploaded successfully' -E php -D /uploads --burp --anti_malware