File Upload, SSRF & Deserialization (FIND/EXPLOIT — server input handling)

Overview

Three high-impact classes that often reach RCE or full cloud compromise and were previously homeless across the references: untrusted files, untrusted URLs, and untrusted serialized objects. All three are "the server processes attacker-supplied data."

Core principle: Anywhere the server fetches, stores+serves, or reconstructs attacker data, ask what else it can be pointed at or made into.

Applies when / Skip when

• Applies when: the app accepts file uploads, fetches user-supplied URLs, or deserializes input — test each of the three independently.
• Skip when: a given feature is absent → that part is N/A (e.g. no uploads → skip the upload section but still test SSRF/deserialization if present).
• If N/A: report which of the three are absent and test only what exists.