File Upload Vulnerabilities

File upload vulnerability is a type of vulnerability that allows an attacker to upload malicious files to a website, which can then be executed on the server or used to compromise the website. This type of vulnerability can be found in web applications that allow users to upload files, such as file upload forms or forums that allow users to upload images or attachments. 

An attacker can exploit this vulnerability by uploading a malicious file, such as a script or executable, which can then be executed on the server or used to gain unauthorized access to the website.

In this chapter, we will delve into the critical aspect of web application security concerning file uploads. Chances are, most of you have come across web applications that offer the convenient functionality of file upload, often in the form of images, videos, documents, and more.

However, if a web application has poor (or no) security mechanisms to prevent certain kinds of files, such as server-side scripting, then that can result in arbitrary code execution on the server. Even with limited file upload capability, we can execute arbitrary JS (XSS), and CSRF, and run client-side exploits.

Table of Contents

File Upload Vulnerability and how to Prevent from it?

Setting Up the Lab
Level 1: Introducing file upload vulnerability
Level 2: Blacklist extension check bypass
Level 3:Advanced Blacklist extension check bypass
Level 4:MIME content type verification bypass
Level 5: Apache's htaccess trick to execute benign files as PHP
Level 6: Bypassing image content verification
Level 7: Play with XSS

Netcat accessible reverse shell

How to prevent file upload vulnerabilities? 

To prevent file upload vulnerabilities, it is important to properly validate the file type, size, and content of any file that is uploaded to the server. This can help to ensure that only safe files are allowed to be uploaded and executed on the server.