File Upload Vulnerabilities: Exploitation & Defense (DVFU)

Unrestricted File Upload is one of the most critical vulnerabilities in modern web applications. If an application permits users to upload files without rigorous validation, attackers can upload executable server-side scripts (such as PHP, ASPX, or JSP web shells) to achieve full Remote Code Execution (RCE) and compromise the entire underlying host.

This course takes you through a complete progressive challenge path using the Damn Vulnerable File Upload (DVFU) lab: starting from zero-validation entry points to defeating blacklists, tampering MIME headers, weaponizing Apache .htaccess overrides, injecting polyglot PHP code into image Magic Bytes, and catching interactive Netcat reverse shells.

What You Will Learn:

• Understanding the file upload attack surface and how server interpreters execute uploaded scripts.
• Setting up the Damn Vulnerable File Upload (DVFU) lab locally on Apache/WAMP/XAMPP.
• Level 1: Exploiting unrestricted file uploads with raw PHP web shells.
• Level 2: Bypassing basic extension blacklists using alternative PHP executable extensions (.phtml, .php5, .php3).
• Level 3: Advanced extension evasion: Case sensitivity manipulation (.PhP), double extensions (.php.jpg), and trailing characters (.php.).
• Level 4: Tampering HTTP request MIME Content-Type headers (e.g. image/jpeg) using Burp Suite proxy intercept.
• Level 5: Weaponizing Apache .htaccess configuration files with AddType application/x-httpd-php to execute benign images as PHP scripts.
• Level 6: Defeating server-side image verification by forging Magic Bytes (GIF89a) and EXIF comment payloads.
• Level 7: Stored Cross-Site Scripting (XSS) and client-side exploitation via malicious SVG and XML uploads.
• Deploying pentest monkey Netcat reverse shells and establishing persistent command-line access.
• Implementing foolproof defensive controls: whitelisting, storage outside web root, re-encoding images, and disabling execute permissions.