Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know shells can be uploaded via sql injection, remote file inclusion and exploiting the web app's own upload mechanism. Are there any other ways to upload a shell to a website and be able to execute commands?

share|improve this question
up vote 2 down vote accepted

You don't just have to be concerned by the ability for the user to upload a shell, but also by what exploitation of your code could achieve the same thing. There are many, many websites out there which use PHP commands such as exec() on user submitted data (from $_POST or $_GET) without doing any kind of validation on them. These issues can be combated by properly escaping untrusted information before using it on the command line, or refactoring to avoid having to use the system shell at all (perhaps such that you can enable Safe Mode and disable dangerous functions such as these in production).

Another method in addition to those you mentioned in terms of actual malicious filed upload is the HTTP PUT request.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.