testing arbitary file upload or stored xss