I am pentesting my institute website.
Website is using ASP.Net
Website lets you upload a profile picture for your account. Profile picture is sent to
http://domain/api/fileManagement/FileExistchecks if file exist or not
If file exist,
http://domain/api/fileManagement/FileDownloadreturns a picture in base64, which is then used by img tag of HTML
During testing I found that I can upload any kind of file. So, I uploaded a webshell from
http://domain/api/fileManagement/FileExistconfirms that file exist.
http://domain/api/fileManagement/FileDownloadreturn webshell file in base64 encoding.
My problem is that I can't figure out where this uploaded file is stored (the URL). I want to check if I can execute this webshell. I can upload webshell but to execute it I need its URL.
Is there any way to execute webshell?
- During testing I also found this error
Name.Server.Controllers.fileManegmentController.PictureUploaded() in D:\Projects\VUE_PROJECTS\Name\Name\src\server\Controllers\FileManegment\fileManegmentController.cs:line 75