I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.

When I open my shell with a web browser, it doesn't execute (confirmed with a packet capture) but when I open it with curl, it returns my php web shell source code!

Where is the problem?

  • Just a guess, but the double extension may be causing the server to treat it as non-executable file. Server cause of the non-php extension does not execute the file, serves it without executing it. Now the weird thing, looks like it is serving it as text file instead binary file (jpg is a binary type) and cURL is showing you the content of the shell (similar as a .txt file)
    – bradbury9
    Aug 19, 2020 at 7:21
  • so what is your solution? i guess .htaccess restricted it but why cURL show the source code?
    – arsenic
    Aug 19, 2020 at 7:51

2 Answers 2


You get the file contents in curl because you are accessing the file directly without the server executing the contents.

You are not getting the shell in the browser because the PHP server is trying to show you a jpeg file that isn't a jpeg file.

It's not working because the server is not vulnerable to this problem...

Just because you can upload a file does not mean that the server will do what you want with it. It will handle the file based on its own rules.


Any reasonably configured server will not execute .jpg files as PHP when accessed directly*.

This includes default configurations for common servers like Apache or nginx. A server would need to be specifically configured to parse non-PHP file extensions as PHP. From your description, this isn't the case here (the file is correctly handled as image file).

I'm not saying that the application isn't vulnerable, but allowing .php.jpg files to be uploaded is a valid practice. To bypass a file upload restriction, you'd want your file to for example end in .php (or related extensions which will be executed as PHP).

* they will be executed regardless of extension if they are for example included via include, but in that case it doesn't matter if the file ends in .php.jpg or just .jpg - or if the content (type) is validated for that matter.

  • i used some way to byapss it like /?cmd=uname -a;.jpg but server couldnt uplaod it and answered this: Warning: move_uploaded_file(temp/202008190921130.?cmd=uname -a;.jpg): failed to open stream: No error in C:\xampp\htdocs\htdocs\aduanawam\Classes.php on line 1840
    – arsenic
    Aug 19, 2020 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .