File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

learn more… | top users | synonyms

-2
votes
0answers
22 views

A paid service, library or piece of code for file upload in PHP? [on hold]

Someone knows a library for check in a secure way the uploaded files? I need to accept image a pdf files. I'm not a security expert and I do not want to deal with escapes, mimetypes check, permission ...
2
votes
1answer
50 views

Where to store uploaded images from perspective of security

It is quite common that uploaded files (images, videos, etc.) are stored on a file server because of performance and database-recovery-time reasons. But is there a benefit of storing such files in ...
0
votes
2answers
76 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
0
votes
2answers
49 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
1
vote
2answers
66 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
1
vote
1answer
45 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
0
votes
2answers
188 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
1
vote
0answers
37 views

Securing server from attacks and linking while allowing users to upload and store personal files?

I have read some questions and answers about uploading images specifically: Have I done enough not be compromised through image uploading Risks of a php image upload form Uploading images safe of ...
0
votes
1answer
41 views

Is it safe to put the output of 'strace' online?

For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report. Is this safe in general? Under what circumstances is this safe or ...
1
vote
2answers
160 views

I can upload any file to an ASP webapp/IIS server but I do not know where (which folder), is this exploitable?

I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded. I have written a Python script that beggining ...
-1
votes
1answer
60 views

BigDump v0.35b vulnerability [closed]

I dont understand what the problem with BigDump v0.35b. This site says that it have problem. But i dont understand it. Problem here? if (!$error && isset($_REQUEST["uploadbutton"])) { if ...
12
votes
5answers
2k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
1
vote
5answers
164 views

How to ensure that files uploaded by users do not contain any Javascript

I'm trying to make a file uploader using PrimeFaces, but it is vulnerable to scripts: If someone tries to upload a file (e.g. a résumé) that includes JavaScript, this could get executed once the file ...
1
vote
1answer
35 views

make specially encoded template available for file uploads

A comment to this blog post at sans.org about secure file uploads suggests making a pre-formatted template available for users when they need to do file uploads. The user would use the template to ...
0
votes
1answer
84 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
2
votes
1answer
189 views

One-Way Data Transfer Cable

Is there a cable that physically only supports data flow in one direction (out)? The idea here is to put this on a system that can only export data so that there is very minimal risk of the ...
4
votes
3answers
2k views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
1
vote
1answer
136 views

A renamed exe automatically running

We are currently developing a web app that allows users to upload files to act as attachments to information they provide. Obviously allowing users to upload any file types is very dangerous, ...
1
vote
1answer
163 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
1
vote
0answers
829 views

blueimp jQuery-File-Upload getting PHP Hacked

I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the ...
1
vote
1answer
641 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
1
vote
1answer
210 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
2
votes
1answer
95 views

Can an inaccessible uploaded PDF harm a server?

Is it possible for an uploaded PDF file to harm an Apache server, if the filepath can't be found? That is, the PDF file can't be viewed from the browser or accessed by a known path once uploaded. I ...
1
vote
1answer
85 views

Uploading Disabled for executable file during change of Extension

As we know, uploading of executable file is not safe. But if we change extension of file exe to txt, then file get uploaded. How to prevent this??
0
votes
3answers
218 views

Secure uploading file

I have file uploaded system in my php project. What I make at uploading: 1) Check file extension and file mime type. 2) If extension and mime type are allowed types, I save file outside of ...
0
votes
3answers
121 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
1
vote
2answers
96 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
2
votes
2answers
508 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
3
votes
2answers
962 views

What does it mean to have a “file name with NULL bytes in serialized instances”?

I was browsing this page, which redirected me to this vulnerability because I'm a Java developer and I'm aware of the affected library. Basically the vulnerability says: It was discovered that ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
0
votes
1answer
77 views

What's recommended for performance & security : Server as PC or Server as HDD [closed]

we are trying to find a file server for us. we look for the best practices of the establishment of an efficient and secure server. Therefore, my question is: What is recommended: server as a PC or ...
4
votes
3answers
2k views

Is it possible for a hacker to bypass upload php file?

I wanna give a filtering system in my script. here it is : <?php $allowedExts = array("gif", "jpeg", "jpg", "png","bmp"); $temp = explode(".", $_FILES["file"]["name"]); $extension = end($temp); ...
0
votes
3answers
199 views

Does validating a mime-type reduce or stop the need for virus scanning?

I am building a small web app in php, that accepts .doc /.docx / .rtf and .txt files. I've validated them against their mime-types. But now I'm thinking about virus scanning. I know there are systems ...
1
vote
1answer
1k views

Uploading images safe of XSS, php code and virus

I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not ...
-1
votes
1answer
408 views

Protect against Tamper Data add-on

When it comes to uploading images on a website. I know you can trick the php to believe that the file is an image by changing the extension to ".jpg" from ".php". Then once the file is uploading you ...
2
votes
3answers
1k views

Uploading files through an HTTPS web application

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load ...
0
votes
2answers
285 views

File shares from a DMZ into an internal network

We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to ...
23
votes
5answers
2k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
7
votes
1answer
582 views

How can I spoof the Mimetype of a file upload?

There are posts that says php mimetype isn't secure, or can be bypassed. How do people spoof the mimetype?
1
vote
2answers
56 views

Per-transfer authorization of file transfers on a per transaction basis

In my organization, users have the rights to transfer files to and from servers using SSH File Transfer protocol for a variety of reasons; e.g. application troubleshooting, BAU, etc. Although our ...
5
votes
1answer
2k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
15
votes
4answers
2k views

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
8
votes
3answers
1k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
1
vote
2answers
219 views

Is there any risk in posting “local info” to the Internet?

Previously when I posted a screenshot online, someone told me to erase out my usernames, computer names, domain names, etc: Is there actually a need to do so? A quick Google search shows that many ...
4
votes
3answers
509 views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
2
votes
1answer
571 views

Methods for uploading shell to a website

I know shells can be uploaded via sql injection, remote file inclusion and exploiting the web app's own upload mechanism. Are there any other ways to upload a shell to a website and be able to execute ...
1
vote
6answers
5k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
4
votes
1answer
167 views

Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?

I am storing files on S3, some of which are very large, and need to be stored encrypted. I had planned on using Galois Counter Mode since it includes the MAC, however this won't work with multipart ...
2
votes
1answer
854 views

File upload vulnerability: rename solution?

I have a module in which the user can upload images. I searched Google for different kinds of upload attacks checking dimension of the image (still vulnerable) checking of file extension ...
2
votes
4answers
2k views

Is it necessary to scan users' file uploads by antivirus?

Web application allows users to upload files. Is it necessary to scan those files by antivirus? I'd want to hear answer in two scenarios: Type of file isn't checked when uploading. They are stored ...