What is a File Upload Vulnerability?
Checklist
- [ ] { Try various file extensions } : Try different versions of the file extensions, for example php3, .php4, .php5, phtml for PHP scripts, asp,aspx and ashx for IIS
Extension Links ➖ https://github.com/danielmiessler/SecLists
- [ ] { Append an extra file extension }: If The application is not properly validating for the file extension, this can be exploited by appending another extension, for example from script.php to script.php.gif or script.gif.php
- [ ] { Improper Implementation of Regex } : Check if regex only satisfying by including only extension name in filename anywhere like hellopng.php | Check if regex satisfying by including that extension in last like hello.php.asdfpng
- [ ] { Change the casing of the extension } : ExtensionTry different combinations of lower and upper case, for example pHp, PhP, phP, Php etc
- [ ] { Application allows to upload .svg file ? } : SVG images are just XML data. Using XML you can achieve lots of vulnerabilities, for instance a Stored XSS as below
- [ ] { Change content type } : When intercepting the request using Burp Suite, the content type can be changed, for example from “Content-type: application/x-php” to “Content-type: image/gif”
- [ ] { Add a magic byte to the file } : Magic bytes function as signatures used by the web server to identify the type of file that is being uploaded. For example, when adding “GIF87a” to the beginning of the script, the server will think of it as a GIF file.
Like : Change Filename=’1.php’ and filetype : image/gif And start the file content with GIF29a
- [ ] { Try reducing the file size } : If a file size restriction is being used, a smaller script can be uploaded to gain remote code execution, such as :
<aside>
💡 <?php echo system($_REQUEST[‘cmd’]); ?> ,
</aside>
- [ ] { Try using executable extensions } : Certain executable extensions may still be allowed, for example .phtml, .shtml, .asa, .cer”, “.asax”, “.swf”, or “.xap”.
- [ ] { Add a null byte to the file name } : If the site is using file extension whitelists, this can often be bypassed by adding %00 (HTML encoding) or \x00 (hex encoding) to the end of the file name. For example:
php-reverse-shell.php%00.gif
- [ ] { Add special characters before file extension } : In order webservers, adding special characters such as ;%$& just after the file name, for example shell;.php can help bypass file extension whitelists
- [ ] { Insert EXIF data } : An executable script can be inserted into an image in the form of a metadata comment, which will then be executed when the web server uses the image in a page
- [ ] { Try using Windows 8.3 notation for the file name } : The Windows 8.3 short name version can be used in the file name. For example shell.aspx will become SHELL~1.ASP
- [ ] { Try finding characters that are converted to other useful characters during the file upload process. } : For instance, when running PHP on IIS, the “>”, “<”, and double quote “ characters respectively convert to “?”, “*”, and “.” characters that can be used to replace existing files (e.g. “web<<” can replace the “web.config” file). In order to include the double quote character in the filename in a normal file upload request, the filename in the “Content-Disposition” header should use single quotes (e.g. filename=’web”config’ to replace the “web.config” file).
- [ ] { Try adding neutral characters after the filename } : Special characters like spaces or dots in Windows or dots and slashes in a Linux at the end of a filename will be removed automatically (e.g. “shell.aspx … … . . .. ..”, “script.asp “, or “file.asp.”). Although slash or backslash characters are unlikely to succeed as they are normally used to separate directories, they are worth a try (e.g. “shell.php/” or “scri[t.php.\”).
- [ ] { Directory Traversal } : Try ../../filename.pngor ../../filename.php if it’s also vulnerable to Path Traversal