Arbitrary File Upload
Introduction
An arbitrary file upload vulnerability is a type of security flaw that allows an attacker to upload malicious files onto a server.
Where to find
In upload file feature, for example upload photo profile feature
How to exploit
Change the
Content-Type
value
Change the Content-Type
Try to change the extension when send the request, for example in here you cant upload file with ext php but you can upload jpg file
Change the request to this
Upload the payload, but start with GIF89a; and
And dont forget to change the content-type to image/gif
Bypass content length validation, it can be bypassed using small payload
Using null byte in filename
Using double extensions for the uploaded file
Uploading an unpopular php extensions (php4,php5,php6,phtml)
Try to randomly capitalizes the file extension
Mix the tips!
Last updated