Study document parsing and upload security

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R10 — OWASP File Upload Cheat Sheet

   R40 — OWASP WSTG file & input testing

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Harden PDF, Markdown, and HTML ingestion parsers. Add strict MIME/magic-byte checks, file size caps, parser subprocess timeouts, randomized storage filenames, and isolated parsing workers.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Run fixture tests with malformed PDFs, deeply nested HTML, empty files, and path-traversal filenames.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Parser boundary test suite passing all malformed fixture cases safely.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

• R40OWASP WSTG↗ owasp.org

  Web Security Testing Guide: hands-on test cases for authentication, authorization, session, input, and API security.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · testing guide
  Web Security Testing Guide - OWASP Foundation

  Supplies the test-case structure for input validation, file handling and API abuse that you turn into parser hardening acceptance tests.

  R40checked 2026-11-11
• videoRyan John · 20 min
  File Upload Vulnerabilities & Filter Bypass

  Demonstrates extension, MIME and header bypasses against naive upload checks, showing why magic-byte inspection plus stored-file renaming is required rather than a Content-Type test.

  R10R40checked 2026-11-11
• videoPortSwigger Web Security Academy · playlist of labs
  File Upload Vulnerabilities - Portswigger Web Security Academy

  Walks the full upload attack class from webshell execution to filter bypass, giving the adversarial cases your ingestion parser must reject or neutralize.

  R40R10checked 2026-11-11
• articleIntigriti · long-form guide
  File Upload Vulnerabilities: Advanced Exploitation Guide

  Covers polyglot files, magic-byte forgery and content-type confusion in depth, the specific bypasses that make isolated parsing workers and hard size caps necessary.

  R10checked 2026-11-11
• labPortSwigger Web Security Academy · interactive lab
  Lab: Web shell upload via Content-Type restriction bypass

  Hands-on proof that trusting the declared Content-Type is insufficient, the concrete failure mode your MIME/magic-byte check must close.

  R40checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.