File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

learn more… | top users | synonyms

1
vote
0answers
58 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
2answers
27 views

Standard (or solution) for securing files in a point-to-point integration

I'm looking for a relatively light weight way to secure both integrity and confidentiality for files being uploaded in a point-to-point integration. The use case is uploading batch files for ...
1
vote
1answer
57 views

Does a solution exist for transferring large files across a network that is faster, yet just as secure as scp? [closed]

I'm posting this here rather than unix/linux, because the primary deal breaker here would be a deteriorated security layer. I'm wondering if there are (noticeably) faster solutions available for ...
0
votes
0answers
39 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
3
votes
0answers
99 views

Is there a way my organization can collect clients' sensitive documents without being liable for them? [closed]

I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the ...
2
votes
1answer
85 views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any ...
0
votes
0answers
58 views

Bypassing Change Name Uploader

I have read all of the questions available on SE about bypassing the change name uploader. Consider an uploader which changes the file name each time you try to upload a file. The only allowed formats ...
0
votes
2answers
139 views

Getting the uploaded file path without knowing the uploading destination

Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
2
votes
0answers
47 views

Simple method requiring no installation of special tools to share a file over the internet

I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools. This is a very common use case. For example, I want to ...
2
votes
1answer
121 views

Prevent shell script inside image file

Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server. I have put server side validation to check file extension + mime type of the image. However, they are ...
1
vote
2answers
54 views

So I need to unzip and process user submitted zip files - how to do so securely?

I am writing a system that accepts zipfiles from end users. The title says it all - what precautions should I take to ensure my processing server does not get compromised when I need to unzip a ...
1
vote
2answers
140 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
1
vote
0answers
152 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: ...
2
votes
1answer
130 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
1
vote
0answers
34 views

Unrestricted file upload on a cloud based platform [closed]

We have an unsecured file upload for the user to upload any file they want, our application is Azure based so they are stored as blobs not as a traditional "file on disk". Could malicious code still ...
5
votes
3answers
253 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
4
votes
5answers
255 views

Is it dangerous to serve user-uploaded Flash (SWF) files?

I'm working on a site that has CMS functionality. I'm considering allowing users to upload Flash (.swf) files and then displaying them on my site. Is this a bad idea? Is there a way to do this ...
1
vote
1answer
84 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
1
vote
0answers
184 views

Run a uploaded file with a double extension? [closed]

I tested some pieces of code from an old project. I found something that looks like it could be an exploit, but I do not manage to exploit it completely. Here is the code: $target = "folder/"; ...
1
vote
1answer
609 views

Bypassing file upload restrictions

However an exercise I do not manage to resolve, I have to bypass a check of extension of a form in PHP. It turns out that just the extension is verified, but certain special characters are replaced ...
9
votes
1answer
121 views

Security measures and anti-virus on server to mitigate acting as a propagation vector

We have a web application for which I've been asked to add the ability to let users upload documents that will then be visible and downloadable by other users. Those documents will typically be images ...
2
votes
2answers
743 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
0
votes
1answer
72 views

How to protect user privacy when sharing photos?

I have a web site that lets users upload a profile picture that is then visible to other users of the site. What steps should the site take to protect user privacy? For example, some Jpeg files may ...
2
votes
1answer
145 views

Bypass Text Plain Rule

I want to know if I can allow uploading all types of scripts and add these rules to a virtual host configuration; so please advise and tell me if there will be some exploits that can be used to ...
2
votes
1answer
152 views

Where to store uploaded images from perspective of security

It is quite common that uploaded files (images, videos, etc.) are stored on a file server because of performance and database-recovery-time reasons. But is there a benefit of storing such files in ...
0
votes
2answers
141 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
0
votes
2answers
187 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
1
vote
2answers
213 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
1
vote
1answer
148 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
0
votes
2answers
464 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
1
vote
0answers
74 views

Securing server from attacks and linking while allowing users to upload and store personal files?

I have read some questions and answers about uploading images specifically: Have I done enough not be compromised through image uploading Risks of a php image upload form Uploading images safe of ...
1
vote
1answer
77 views

Is it safe to put the output of 'strace' online?

For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report. Is this safe in general? Under what circumstances is this safe or ...
1
vote
2answers
437 views

I can upload any file to an ASP webapp/IIS server but I do not know where (which folder), is this exploitable?

I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded. I have written a Python script that beggining ...
-1
votes
1answer
261 views

BigDump v0.35b vulnerability [closed]

I dont understand what the problem with BigDump v0.35b. This site says that it have problem. But i dont understand it. Problem here? if (!$error && isset($_REQUEST["uploadbutton"])) { if ...
12
votes
5answers
4k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
1
vote
5answers
446 views

How to ensure that files uploaded by users do not contain any Javascript

I'm trying to make a file uploader using PrimeFaces, but it is vulnerable to scripts: If someone tries to upload a file (e.g. a résumé) that includes JavaScript, this could get executed once the file ...
1
vote
1answer
39 views

make specially encoded template available for file uploads

A comment to this blog post at sans.org about secure file uploads suggests making a pre-formatted template available for users when they need to do file uploads. The user would use the template to ...
0
votes
1answer
156 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
2
votes
1answer
697 views

One-Way Data Transfer Cable

Is there a cable that physically only supports data flow in one direction (out)? The idea here is to put this on a system that can only export data so that there is very minimal risk of the ...
4
votes
3answers
9k views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
1
vote
1answer
223 views

A renamed exe automatically running

We are currently developing a web app that allows users to upload files to act as attachments to information they provide. Obviously allowing users to upload any file types is very dangerous, ...
2
votes
1answer
299 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
1
vote
0answers
2k views

blueimp jQuery-File-Upload getting PHP Hacked [closed]

I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the ...
1
vote
1answer
1k views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
1
vote
1answer
359 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
2
votes
1answer
155 views

Can an inaccessible uploaded PDF harm a server?

Is it possible for an uploaded PDF file to harm an Apache server, if the filepath can't be found? That is, the PDF file can't be viewed from the browser or accessed by a known path once uploaded. I ...
1
vote
1answer
203 views

Uploading Disabled for executable file during change of Extension

As we know, uploading of executable file is not safe. But if we change extension of file exe to txt, then file get uploaded. How to prevent this??
0
votes
3answers
434 views

Secure uploading file

I have file uploaded system in my php project. What I make at uploading: 1) Check file extension and file mime type. 2) If extension and mime type are allowed types, I save file outside of ...
0
votes
3answers
168 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
1
vote
2answers
137 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...