Questions tagged [file-upload]

File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

2
votes
1answer
80 views

File upload security with PHP - Header to text/plain

I am using PHP to create a small script that uploads images to a server. While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
1
vote
1answer
51 views

What is the point of hashes when downloading over the same channel? [duplicate]

What is the point of providing shaXXX hashes for downloads of software over say TLS when any attacker that could change the download could have easily changed the hash? Isn't there enough information ...
2
votes
1answer
62 views

Blind XSS Payload for xml file?

I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my ...
0
votes
1answer
56 views

Is this CORS exploitable?

So i was able to upload a html file on a server i'm allowed to test. The file is uploaded on a subdomain of the main server. Knowing that they allow CORS for anything.domain.com, is it possible to ...
0
votes
1answer
99 views

Is this scenario a file upload vulnerability?

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png)...
0
votes
1answer
70 views

How to spoof file extension when it is appended to the file name every time?

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (...
2
votes
0answers
158 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
1
vote
2answers
280 views

jsp malicious file upload is possible, but no exploit scenario, should I report it?

I was pen testing a java web application, I could upload a malicious JSP file which was generated using METASPLOIT, however, I could not put the JSP file in the server directory so that it can be ...
1
vote
2answers
62 views

File upload attack vectors when file is not saved to disk

I'm curious to know if there are any significant threats presented by files which are uploaded and read but are never saved to disk? I've read countless articles about file uploads regarding storage ...
2
votes
2answers
245 views

Can a website see the file location of a document I upload?

While applying to a job, I uploaded a resume to a recruiting website: C:\myname\an\embarrassing\path\to\my\resume.pdf Can the website see the file path of my uploaded document?
1
vote
1answer
74 views

What to take into account when validating file upload

One of the key security mechanisms for application software is input validation, which can protect the integrity of the system and thwart common injection and denial of service attacks. Most of the ...
1
vote
2answers
791 views

Bypassing file upload restrictions on php server

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for: 1: Filetype 2: ...
3
votes
1answer
46 views

When I upload a file on browser, will the server know my file path or disk info?

I believe server can know my file name. What other info will browser tell the server? File path? Disk info?
2
votes
0answers
131 views

PHP Upload-show images securely [closed]

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image. So i've created a small test project where ...
3
votes
2answers
1k views

Malicious PDF file upload

I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from ...
2
votes
1answer
459 views

Can my network admin examine files I upload on a HTTPS site? [duplicate]

I have been working in a big company for the past 4 months. I have two machines that i work on, my personal laptop and my desktop workstation (company property). Occasionally, as all my colleagues do, ...
0
votes
1answer
31 views

What characters that are converted when running PHP on IIS?

I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload I saw this statement: Finding characters that are converted to other useful ...
0
votes
1answer
45 views

How to securely load data to a database in vendor server such that vendor does not see raw data at all?

Scenario: client will be uploading files with sensitive information to a vendor server for loading into a database. Due to the confidential nature of the files, the client does not want any archiving ...
7
votes
5answers
3k views

How insecure is FTP?

Okay, we know the drill: don't use FTP, use SFTP or FTPS. But what exactly is the risk being posed? The files themselves are sent unencrypted, and this may be fine, or disastrous, depending on what ...
5
votes
2answers
501 views

Directory transversal in PHP with the $_FILES array?

I'm working on a php application that is handling file upload. I'm trying to inject a path transversal payload in the filename such as /../../../../etc/. The thing is that the vulnerable line of code ...
-1
votes
3answers
127 views

Is it Unrestricted file upload vulnerability?

I am using a messenger app that's similar to WhatsApp. This app allows me to send any type of files, like Html, Php, SWF etc. via text messages. Is this a vulnerability?
0
votes
1answer
933 views

How exploiting RCE in jpg file actually works?

I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct. <?php $test = array('image/jpeg', '...
-5
votes
3answers
237 views

Difference between phpp, php, and phP? [closed]

I came across a ctf challenge where php file upload was restricted but phpp and phP were not. What other formats can php be uploaded in and what is the difference?
1
vote
2answers
799 views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
2
votes
1answer
583 views

File upload security in webapp - overview of setup

For a webapp based around user uploaded pics, I want to check that I'm doing things sufficiently securely. Below is an outline of the current setup. Of course only registered users can upload, but I ...
0
votes
1answer
66 views

Security risks posed by user generated filenames on a webserver [closed]

Do filenames themselves pose a security risk? We have a webserver, users can upload files to the server. The files are temporarily stored on the server, then moved to S3. The filenames are recorded ...
1
vote
0answers
80 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
0
votes
1answer
490 views

Meterpreter file upload - segmentation fault

I'm doing some experiments on two VMs, one running Kali and the other running Ubuntu. I have a problem with the "upload" command of Meterpreter. In particular, I already open a reverse tcp session ...
2
votes
3answers
703 views

Exploiting XSS in filename without using /

I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-...
7
votes
2answers
231 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
27
votes
8answers
8k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
5
votes
1answer
135 views

Can Emule MD4 hashes and file sizes be faked?

Please excuse me if I don't use proper terminology, I'm a lawyer and trying to get more information about something my son has pointed out to me. In Germany, law enforcement agencies use enhanced ...
-2
votes
1answer
885 views

Can an XXE attack be carried out from within an docx file? [closed]

Is XXE possible in a file upload with .docx files?
2
votes
3answers
1k views

Susceptibility of 7z encrypted archive files to man in the middle attacks

Given: A file (assume 1 GB in size) is encrypted along with filenames using 7zip into a 7z archive using AES-256 The file is uploaded to a cloud storage service such as those offered by Google, ...
3
votes
1answer
1k views

Unrestricted File upload [closed]

I am working on a file upload feature in our app. Users can also download uploaded files from the app. To prevent malicious file upload, I am checking magic bytes of the file to find the file type ...
2
votes
2answers
83 views

Does opening an arbitrary file in a language (such as Python) pose a security risk?

For example, if a client submits a file to a server, and the server opens the file in read-mode with Python: with open(uploaded_file, "r") as f: # Do something Could the act of opening a file be ...
0
votes
1answer
2k views

Is using enctype=“multipart/form-data” always a bad idea?

If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view? Here someone says, in 2007 Uusing enctype="...
-3
votes
1answer
490 views

How to execute PHP file after uploading it? [closed]

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when ...
1
vote
1answer
977 views

Path traversal via filename

Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames? For example, naming a file "...
3
votes
3answers
270 views

Is it safe to accept a file upload without any file extension?

Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and ...
3
votes
1answer
1k views

CSRF attack on file upload functionality

Is it possible to perform CSRF attacks on file upload functionality? My application uploads files by sending multipart/form-data POST requests without any random token. Is it possible to prepare a ...
0
votes
1answer
55 views

File upload functionality - cer format verification

While testing file upload functionality in web application, which allows only .cer files, I found out that it is possible to upload a .cer file where at the end of the file, after „-----END ...
0
votes
3answers
123 views

force uploading a file to a server with an open port [duplicate]

Recently my web server was hacked. someone uploaded a php file manager called extplorer and changed all of my web pages and i was wondering what possible ways they could of uploaded something to my ...
1
vote
2answers
2k views

File upload not checking on mime type

So, I have an upload functionality where extension of the filetype is checked correctly (and not currently bypassable). But the mime type is not checked. Does this leave me with some residual risk or ...
1
vote
2answers
95 views

How to deal with Office documents in file upload?

When creating or testing a file upload functionality how do you deal with Office documents assuming that the client wants to be able to upload .doc/.docx/.xls/.xlsx? I have found quite some reading ...
1
vote
1answer
395 views

Unrestricted file upload - shared file signature

A java application I'm working on has a file upload component, and I want to validate that only certain file types are allowed. I realize checking file extension alone is not sufficiently reliable, so ...
0
votes
2answers
91 views

Should I change format and/or add data to image files in a file upload?

I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list. Those security ...
2
votes
1answer
110 views

Security of assets/media on s3

I got my application written in Flask (Python 3.6) and running on EB. I need to implement content editor which will allow to upload files on server and I would like to store them on s3. Most of ...
1
vote
2answers
96 views

About security of web application - user attached files [closed]

I have a web application (forum software) where I am working on a feature about user attaching files to the forum posts. The application is written in assembly language and the database is SQLite. ...
4
votes
3answers
2k views

Pentesting file upload functionality

I am testing web application which allows to upload files in every format without any restrictions. There is also a function to download uploaded files but when I download file it is returned with ...