payload

Documentation

Index

• type GraphQLFields
• type GraphQLMap
• type GraphQLOperation
• type Payload
  • func AllPayloads(techStack, graphqlMutation, graphqlVariable, modulePath string, ...) []*Payload
• type TestType

Types

type GraphQLFields

type GraphQLFields struct {
	Operations string // JSON-encoded GraphQL mutation query
	Map        string // JSON-encoded file-to-variable mapping
	FileIndex  string // The form field name for the file (e.g., "0", "1")
}

GraphQLFields holds GraphQL-specific multipart form data Implements the GraphQL multipart request specification: https://github.com/jaydenseric/graphql-multipart-request-spec

type GraphQLMap

type GraphQLMap map[string][]string

GraphQLMap maps file indices to variable paths Example: {"0": ["variables.file"]}

type GraphQLOperation

type GraphQLOperation struct {
	Query         string                 `json:"query"`
	Variables     map[string]interface{} `json:"variables"`
	OperationName string                 `json:"operationName,omitempty"`
}

GraphQLOperation represents a single GraphQL file upload mutation

type Payload

type Payload struct {
	TestType    TestType
	Technique   string
	Filename    string
	Extension   string
	Body        []byte
	ContentType string
	Tags        []string
	GraphQL     *GraphQLFields
}

func AllPayloads

func AllPayloads(techStack, graphqlMutation, graphqlVariable, modulePath string, moduleOverwrite bool) []*Payload

AllPayloads generates the complete test matrix filtered by tech stack.

type TestType

type TestType string

TestType categorizes the kind of upload test being performed.

const (
	TestTypeExtensionEvasion    TestType = "Extension Evasion"
	TestTypeContentTypeSpoof    TestType = "Content-Type Spoof"
	TestTypeMagicByteSpoof      TestType = "Magic Byte Spoof"
	TestTypeFilenameObfuscation TestType = "Filename Obfuscation"
	TestTypePathTraversal       TestType = "Path Traversal"
	TestTypeSizeBoundary        TestType = "Size Boundary"
	TestTypePolyglotArchive     TestType = "Polyglot & Archive"
	TestTypeUnicodeEncoding     TestType = "Unicode Encoding"
	TestTypeServerConfig        TestType = "Server Configuration"
)