I've just started in penetration testing with metasploitable and currently trying to learn file upload vulnerability present in DVWA module. I know that somehow upload is preventing files other than images to be uploaded but I don't understand how. I tried to look page source of 'upload file' webpage but I don't see any javascripts working there. Webpage only refers to a script which also doesn't seem to have any filters for file being uploaded. Can someone please explain what exactly in the html or JavaScript of webpage is working as a filter?

  • Why should the filter be in html/javascript? Why can't the filter be in the backend(php)? – nobody Jul 5 at 8:09
  • @nobody Because intercepting the post request and modifying it using the burp suite is allowing any extension to be uploaded. Had filter been at server, modifying request using burp suite shouldn't have worked – Ryuzaki Jul 5 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.