---
title: "Discussion on \"One Click, No File: Upload XSS Without the Upload\" | Hashnode"
description: "Discussion on \"One Click, No File: Upload XSS Without the Upload\". How multipart/form-data turns \"the victim has to pick a file\" into a single link"
url: "https://hashnode.com/posts/one-click-no-file-upload-xss-without-the-upload/6a75a5b1bea5e9f028fd66e3"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [One Click, No File: Upload XSS Without the Upload](https://blog.cain.tech/one-click-no-file-upload-xss-without-the-upload?utm_source=hashnode&utm_medium=feed)

How multipart/form-data turns "the victim has to pick a file" into a single link

Aug 7 · 13 min read · blog.cain.tech  
Read the article

-   [#xss-attacks](https://hashnode.com/tag/xss-attacks)
-   [#xss](https://hashnode.com/tag/xss)

## Written by

[Alejandro Baño](https://hashnode.com/@alexb616)

@alexb616 · Murcia, Spain - Prague, Czech Republic

  
[View profile](https://hashnode.com/@alexb616)

Offensive Security Engineer

Offensive security engineer with experience in external penetration testing, web applications, APIs, and Active Directory infrastructure. My research led me to discover new attack techniques and several assigned CVEs. I also have experience from the defensive side (Blue and Purple team operations), incident response, and adversary TTP simulation across SIEM and EDR platforms to improve detection coverage. I hold the OSEP, OSCP, BSCP, OSWP and CCFA certifications.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.