2

I'm pentesting this web application developed in ASP.NET.

I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this:

<img src="../attachments/open.aspx?Key=10350&ute=20069" />

So I have the possibility to upload any kind of file and they will be requested as images, but I don't have any control on the image path.

Also I know that the image is uploaded as binary in the database, so is not phisically in the webserver.

Is there a way to exploit this? I haven't found anything yet.

EDIT: since my question has been put on hold and I don't know how to narrow down my question, can someone suggest me what kind of vulnerability should I look for? What course of action would an expert take?

closed as too broad by Eric G, Xander, schroeder, Iszi, TildalWave Jul 23 '15 at 17:37

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Whoops, reading comprehension fail with the answer I had. I missed the fact that "open.aspx" is probably a script meant to open image files, and somehow thought that it was a filename you'd supplied. Bedtime for me, I think. – Ethan Kaminski Jul 23 '15 at 13:12
  • 1
    You might try with SVG. See blackhat.com/docs/us-14/materials/… – Steffen Ullrich Jul 23 '15 at 14:53
  • 1
    You might give this a watch: youtube.com/watch?v=NPqVVhxhqmY "The Little JPEG That Could (Hack Your Organization)" Even it's not susceptible you'll learn something really cool. :) – k1DBLITZ Jul 23 '15 at 17:48
  • 1
    Are you sure it is uploaded to a file system? Could it be that the images are uploaded in a database? What happens if you try nullbyte injection? Meaning, upload a shell.aspx%00.png or something similar. – Jeroen - IT Nerdbox Jul 24 '15 at 8:01
  • I'm quite sure they are uploaded in a database. I'm looking into nullbyte injection and I'm pursuing the SVG way too. I'll post the results. – misleadingTitle Jul 24 '15 at 8:03