File Upload labs
Malicious File Upload
What is File Upload?
File Upload vulnerabilities appear when an app allows uploading files without validating type, content or destination. Depending on how the file is served, they lead to RCE (webshell), stored XSS (SVG/HTML), path traversal in the filename or XXE/SSRF when processing the content.
Why practice File Upload?
Almost every app has avatar, document or attachment upload, and validating well is surprisingly hard. An upload that ends in a webshell is direct RCE (P1, $5,000-$30,000); even without RCE, a stored-XSS SVG or a filename path traversal are already solid findings.
What will you learn with the File Upload labs?
You'll learn to map the upload flow and where the file is served, bypass extension validations (double extension, uppercase, null byte), spoof Content-Type and magic bytes, upload webshells and polyglots, abuse SVG for XSS and filenames for traversal.
Types of File Upload we cover
- Webshell / RCE
Upload an executable .php/.jsp to a directory served by the engine. Reaching the URL runs your code.
- Extension bypass
shell.php.jpg, shell.pHp, shell.php%00.jpg, .phtml/.php5 — skipping blacklists or badly-built whitelists.
- SVG / HTML XSS
SVG and HTML are executable in the browser. An SVG avatar with <script> gives stored XSS when viewed.
- Path traversal in filename
A name like ../../var/www/shell.php to write outside the uploads directory.
How do you find and exploit File Upload?
A practical playbook — from recon to proof of concept.
- 1
Map the flow and the destination
Upload a valid file and watch the response: the URL where it lands, whether they rename it, which directory serves it and with what Content-Type it's returned.
POST /upload → https://target/uploads/2024/avatar_123.png - 2
Try a direct executable
Try uploading a webshell with the engine's extension. If the directory runs it, you have RCE.
shell.php → <?php system($_GET['c']); ?> → /uploads/shell.php?c=id - 3
Bypass the extension validation
If they filter .php, try double extensions, uppercase variants, alternate extensions and the null byte on legacy engines.
shell.php.jpg · shell.pHp · shell.phtml · shell.php%00.jpg - 4
Spoof type and magic bytes
Change the Content-Type to image/png and prepend an image magic header to smuggle a polyglot past signature checks.
GIF89a;<?php system($_GET['c']); ?> with Content-Type: image/gif - 5
If no RCE, go for XSS/traversal
Upload an SVG with a script for stored XSS, or manipulate the filename to write outside the intended directory.
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/> · filename="../../app/public/x.html"
Learn the theory
Academy: File Upload Vulnerabilities
Loading labs...
View in full catalog →Frequently asked questions
What is a File Upload vulnerability?
It's a flaw where the app accepts files without properly validating their type, content or destination. Depending on how they're served, they allow code execution (webshell), stored XSS (SVG/HTML), path traversal in the name or XXE/SSRF when processing them.
How is an insecure file upload exploited?
You upload an executable file (e.g. a PHP webshell) to a directory served by the engine and reach its URL for RCE. If there are validations, you bypass them with double extensions, fake magic bytes or polyglots; without RCE, an SVG with a script gives stored XSS.
How do you find File Upload in bug bounty?
Locate every upload (avatar, documents, import) and analyze where it's stored and how it's served. Try executable extensions and their bypasses, spoof Content-Type and signature, and experiment with malicious filenames and SVG for XSS.
How do you prevent a malicious File Upload?
Validate by allowlist of extensions and real type (magic bytes), rename files with random names, serve them from a sandbox domain without code execution and with Content-Disposition: attachment, and store uploads outside the webroot.
Difference between File Upload and Path Traversal?
Path Traversal READS existing files outside the directory; File Upload WRITES files (which may run). Sometimes they combine: a filename with ../ during upload writes the webshell to a served path, chaining both.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice File Upload in real labs
Every File Upload lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime