> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-attacks/file-upload-vulns.md).

# File Upload Vulns

**File upload vulnerabilities** are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution.

In some cases, the act of uploading the file is in itself enough to cause damage. Other attacks may involve a follow-up HTTP request for the file, typically to trigger its execution by the server.

## General Advice

### Upload twice

When testing a file upload form, we should always determine what happens when a file is uploaded twice. If the web application indicates that the file already exists, we can use this method to brute force the contents of a web server. 

Alternatively, if the web application displays an error message, this may provide valuable information such as the programming language or web technologies in use.

### Upload outside the web root

Check if it's possible to upload files outside the web root.

On Linux, you can try to write an **authorized\_keys** file to gain SSH-access:

```
file="../../../../../../../home/<user_name>/.ssh/authorized_key"
```

## Bypassing Restrictions

Ways to bypass file upload restrictions, mainly on file extension and/or file type:

### Include legitimate extension

Try to include a legitimate extension in the file extension, such as:

* `.jpeg.php`
* .`jpg.php`
* `.png.php`

### Use a non-standard file extension

Try to use a non-standard file extension, i.e. instead of `.php` try to use:

* `.php7`
* `.phtml`
* `.phps`
* `.pht`
* `.inc`

### Case sensitivity in extension

Try to change the case of the file extension, for example:

* `.pHp`
* `.pHtmL`
* `.pHp5`
* `.pHp7`

### Add NULL or Space char to extension

Try to add a NULL or space characters to the end of the file extension:

* `.php%00`
* `.php\x00`
* `.php%00.gif`
* `.php\x00.gif`

### Add Magic Bytes to the file

Try to add [magic bytes](https://en.wikipedia.org/wiki/List_of_file_signatures) to the beginning of the file:

```bash
echo 'GIF89a' > rev_shell_fixed.php
cat rev_shell.php >> rev_shell_fixed.php
```

## Resources

### General Resources

CWE-434 - Unrestricted Upload of File with Dangerous Type: <https://cwe.mitre.org/data/definitions/434.html>

File upload vulnerabilities - PortSwigger: <https://portswigger.net/web-security/file-upload>

Unrestricted File Upload - OWASP: <https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload>

### PHP Resources

Alt extensions PHP - FuzzDB-project: <https://github.com/fuzzdb-project/fuzzdb/blob/master/attack/file-upload/alt-extensions-php.txt>

PHP extension list - PayloadsAllTheThings: <https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Extension%20PHP/extensions.lst>