File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

learn more… | top users | synonyms

1
vote
0answers
17 views

File sharing solution with approval workflow [on hold]

Is there any solution out anyone is aware of that does secure file sharing but with the facility of an approval workflow. A case being a person can upload a file to the secure file sharing solution ...
3
votes
2answers
52 views

Server side Excel file security

I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server ...
10
votes
3answers
11k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
3
votes
1answer
82 views

Can email services upload files from your computer without your permission/knowledge?

The company I work for is involved in security clearance work, and thus all company computers are monitored (files, screenshots, etc). I am routinely logged onto my company email service with my ...
0
votes
0answers
61 views

How can JavaScript be uploaded safely to a server through a web app?

Can users who have access to web content management system be allowed to upload JavaScript files to the web server through a web app in a safe way? Or shouldn't uploading JavaScript be allowed by ...
3
votes
2answers
70 views

Security concerns with uploading an image

We have to implement a user profile image upload feature in our web application. The user can upload his profile image. After uploading the image, it will be saved to a DB2 DB, and it will be ...
-1
votes
1answer
57 views

Testing File Upload Functionality

I want to test a file upload functionality and I wasn't able to upload exe files, but I could upload file.exe.jpg (adding jpg extension). What threat this file possesses after it uploaded on the ...
3
votes
2answers
79 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
1
vote
1answer
47 views

Blacklisting accepted file extensions: how careful do I need to be

Currently working on a web application which allows users to upload files onto one of our Windows servers. The application is built in ASP.NET MVC with a MySQL backend. The uploaded files are not ...
0
votes
1answer
143 views

Preventing uploads of malware to server by changing all extentions to PNG?

Ok, so I have my own website, and you can use the file upload quite a bit, and it is very important to the site. However, I've been hearing that clients can still bypass a file extension restrictions (...
2
votes
1answer
102 views

Why would someone upload many iptables files during a security breach and are they a cause for concern?

My workplace had multiple unauthorized access security failures over the last month. Since then, most computers have been scrubbed and user accounts purged. Data was recovered from offsite backups and ...
1
vote
2answers
31 views

755 permission of uploaded files

I just want to know, if giving 755 permission to an uploaded file is a security problem. If someone upload a malicious file, will the execute permission be a problem? In this answer, he is giving the ...
1
vote
0answers
63 views

How to remotely upload a file on linux and windows (without netcat or ssh)

With meterpreter from metasploit, there is an option (windows or linux victim) to upload files on the victim device. I searched in the metasploit-framework in order to find the script that does the "...
0
votes
1answer
31 views

How to safely exchange functionality of a file between two computers?

I have two computers and the goal is to move a functionality of a given file from computer A to computer B. The file is supposed to have a certain known functionality but it potentially could expose ...
1
vote
3answers
79 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
0
votes
0answers
93 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
2answers
47 views

Is image uploading to a database secure if you resize the image first in raw bytes?

Please see the upload code below. the method is called within a try, catch. If the code for the image utilities is needed, just say. Basically, everything is handled in raw bytes and then stored to ...
6
votes
3answers
311 views

Recreating uploads/linked images with imagecreatefrom* php

As suggested on my StackOverflow question, I am now directing this towards the Information Security group, since no one was able to answer my question despite multiple up-votes. User uploaded images ...
-5
votes
1answer
50 views
0
votes
2answers
80 views

PHP Image Upload - Security of storing outside root and accessing via readfile()

I recently began storing image uploads outside the webroot and retrieving them via readfile(). I implemented this and it's working fine, but I was curious if there are any further vulnerabilities that ...
0
votes
1answer
217 views

Secure Image Upload, or Bypassing PHP mime-type Check

When securing image uploads there are basically three approaches I know of (of course, ideally, all three are used): check file extension store uploaded files in non-executable directory outside the ...
3
votes
2answers
1k views

After I've plugged my phone into a computer to upload photos, can people see the photos I did not upload even after I unplugged my phone?

I plugged my phone into a computer at work to upload photos using a USB, then unplugged it. I only uploaded the photos I needed, however, could they somehow see the photos I didn't upload on the ...
1
vote
0answers
41 views

What can go wrong when allowing file uploads on a web server? [closed]

Some basics that are self-evident: Infected/harmful file can be uploaded for other users to download A bug in the web-site's code allowing code execution, thus allowing execution of the uploaded ...
5
votes
2answers
1k views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
9
votes
4answers
1k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
3
votes
1answer
38 views

“Public facing” dropbox folder uploads to admins machine. Potential security issues?

We've got a client who uses Wufoo for their website's forms. One of their forms contains a file upload feature, this is set in Wufoo to place the uploaded file into a Dropbox folder. This Dropbox ...
1
vote
1answer
64 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
0
votes
0answers
38 views

What are good templates for an Image Upload policy?

I'm building a collaborative directory for events, where users and events will have their public profiles, each one with at least a main picture. For users, that picture may come from their social ...
1
vote
2answers
115 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files (...
1
vote
1answer
75 views

Usablity vs security malicious file upload

We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows: There is a panel where one can ...
2
votes
2answers
66 views

Removing vulnerabilities from uploaded files

Our website has a form which allows users to upload image files (png,gif,jpeg and pdf). Once uploaded, the website sends the file (server to server) to the back office api, which then saves the ...
1
vote
1answer
2k views

Bypassing file upload restrictions

However an exercise I do not manage to resolve, I have to bypass a check of extension of a form in PHP. It turns out that just the extension is verified, but certain special characters are replaced ...
0
votes
0answers
79 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
2
votes
1answer
3k views

Uploading images safe of XSS, php code and virus

I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not ...
0
votes
2answers
305 views

Getting the uploaded file path without knowing the uploading destination

Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
0
votes
0answers
28 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
4answers
317 views

Secure File Sharing with China

I am looking for a convenient, and particularly a secure way to share files with business contacts in China. My priorities, in this order, are Secure, non-hackable. Accessible. I know many sites (...
1
vote
1answer
68 views

Is it safe to keep a virus' binary code on your local machine?

Is it safe to keep a file containing the virus (binary?) code on your local machine without executing it? I am testing my application against malicious file uploads and and wondering if it's safe to ...
0
votes
2answers
192 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
2
votes
2answers
2k views

How did the hacker get access to my WordPress upload folder? [closed]

Yesterday I found out there is this http://pastebin.com/MRRny4Ht PHP file in my friends server. I want to know how was the hacker able to upload it there? I read the similar questions but couldn't ...
2
votes
1answer
169 views

Reflected XSS via $_FILES

Is it possible to perform a reflected XSS attack via the $_FILES variable? The vulnerable code I am imagining might look like this: echo $_FILES["file"]["name"]; I read that it's not possible to ...
2
votes
0answers
158 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
10
votes
1answer
5k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
3
votes
2answers
40 views

Standard (or solution) for securing files in a point-to-point integration

I'm looking for a relatively light weight way to secure both integrity and confidentiality for files being uploaded in a point-to-point integration. The use case is uploading batch files for ...
1
vote
1answer
220 views

Does a solution exist for transferring large files across a network that is faster, yet just as secure as scp? [closed]

I'm posting this here rather than unix/linux, because the primary deal breaker here would be a deteriorated security layer. I'm wondering if there are (noticeably) faster solutions available for ...
1
vote
0answers
69 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
3
votes
0answers
136 views

Is there a way my organization can collect clients' sensitive documents without being liable for them? [closed]

I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the ...
2
votes
1answer
399 views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any headers,...
2
votes
2answers
436 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
7
votes
2answers
3k views

Antivirus for scanning anonymous file uploads

Since I have no experience with AV solutions on Unix-like environments, I would need help with suggestions on something that can be suitable for scanning files that are uploaded by anonymous users ...