甲方说上传功能很安全，我甩了20个绕过成功的HTML报告

2026-05-31 04:05:13 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： UploadForge是一款专业级文件上传漏洞扫描工具，支持异步高性能扫描和多种绕过技术检测（如扩展名绕过、MagicByte欺骗等），提供GUI/CLI双模式和HTML/JSON报告生成功能。工具适用于渗透测试和安全审计场景，包含自动验证漏洞可利用性，但文末存在证书销售等非技术内容。 综合评分： 80 文章分类： 渗透测试,WEB安全,安全工具,漏洞分析,安全运营

🖥️ 现代化界面

GUI模式：PySide6构建的暗黑主题图形界面，支持实时监
CLI模式：功能丰富的命令行界面，含进度条、表格、详细日志

📊 专业报告

HTML报告：可视化展示漏洞详情
JSON报告：结构化数据便于二次处理
自动验证：尝试访问并执行上传文件，确认漏洞可利用

安装步骤

# 1. 克隆仓库
git&nbsp;clone&nbsp;https://github.com/errorfiathck/upload_forge.git
cd&nbsp;upload-forge

# 2. 安装依赖
pip install -r requirements.txt

图形界面模式（GUI）

python upload-forge.py gui

命令行模式（CLI）

python upload-forge.py scan \
&nbsp; --url http://target.com/upload \
&nbsp; --param file \
&nbsp; --upload-dir http://target.com/uploads/

参数说明

| 参数 | 说明 | 默认值 | | — | — | — | | --url | 目标上传URL | 必填 | | --param | 文件输入参数名 | file | | --upload-dir | 上传文件存储URL（用于验证） | – | | --proxies | 代理设置，如http://127.0.0.1:8080 | – |

使用代理示例

python upload-forge.py scan \
&nbsp; --url http://target.com/upload \
&nbsp; --upload-dir http://target.com/uploads/ \
&nbsp; --proxies http://127.0.0.1:8080

运行扫描测试

python upload-forge.py scan \
&nbsp; --url http://127.0.0.1:5000/upload \
&nbsp; --upload-dir http://127.0.0.1:5000/uploads/

工作流程图

┌─────────────────┐ &nbsp; &nbsp; ┌─────────────────┐ &nbsp; &nbsp; ┌─────────────────┐
│ &nbsp; 目标上传点 &nbsp; &nbsp; │────→│ &nbsp;生成测试Payload │────→│ &nbsp;异步批量上传 &nbsp; &nbsp;│
│ &nbsp; (URL/参数) &nbsp; &nbsp;│ &nbsp; &nbsp; │ (多种绕过技术) &nbsp; │ &nbsp; &nbsp; │ &nbsp;(httpx/async) &nbsp;│
└─────────────────┘ &nbsp; &nbsp; └─────────────────┘ &nbsp; &nbsp; └────────┬────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ┌──────────────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ┌─────────────────┐
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; 响应分析 &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ (状态码/路径/内容) │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; └────────┬────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ┌──────────────┼──────────────┐
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;↓ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;↓
&nbsp; &nbsp; &nbsp; &nbsp; [上传成功] &nbsp; &nbsp; &nbsp;[被拦截] &nbsp; &nbsp; &nbsp; &nbsp;[异常响应]
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ↓ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;↓ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;↓
&nbsp; &nbsp; &nbsp; &nbsp; ┌─────────┐ &nbsp; &nbsp;[记录绕过失败] &nbsp; [调整策略重试]
&nbsp; &nbsp; &nbsp; &nbsp; │ 自动验证 &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; │访问上传文件│
&nbsp; &nbsp; &nbsp; &nbsp; └────┬────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; ┌────┴────┐
&nbsp; &nbsp; &nbsp; &nbsp; ↓ &nbsp; &nbsp; &nbsp; &nbsp; ↓
&nbsp; &nbsp; [执行成功] &nbsp;[无法访问]
&nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; ↓ &nbsp; &nbsp; &nbsp; &nbsp; ↓
&nbsp; &nbsp; [确认漏洞] &nbsp;[记录可疑点]
&nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; ↓
&nbsp; &nbsp;生成HTML/JSON报告

适用场景

项目地址

https://github.com/errorfiathck/upload_forge

低价出售安全证书不限于cisp、pte等请Vme～建了一个项目群，想进群的请回复进群即可

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：只会看监控的实习生菜狗菜狗《甲方说上传功能很安全，我甩了20个绕过成功的HTML报告》