I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload
I saw this statement:
Finding characters that are converted to other useful characters during the file upload process. For instance, when running PHP on IIS, the ">", "<", and double quote " characters respectively convert to "?", "*", and "." characters that can be used to replace existing files (e.g. "web<<" can replace the "web.config" file). In order to include the double quote character in the filename in a normal file upload request, the filename in the "Content-Disposition" header should use single quotes (e.g. filename='web"config' to replace the "web.config" file).
- Can anyone explain it to me with an example? how "web<<" will replace "web.config" and other files?
- and the second part about "Content-Disposition"?