File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

learn more… | top users | synonyms

-1
votes
1answer
48 views

Testing File Upload Functionality

I want to test a file upload functionality and I wasn't able to upload exe files, but I could upload file.exe.jpg (adding jpg extension). What threat this file possesses after it uploaded on the ...
3
votes
2answers
77 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
1
vote
1answer
40 views

Blacklisting accepted file extensions: how careful do I need to be

Currently working on a web application which allows users to upload files onto one of our Windows servers. The application is built in ASP.NET MVC with a MySQL backend. The uploaded files are not ...
0
votes
1answer
136 views

Preventing uploads of malware to server by changing all extentions to PNG?

Ok, so I have my own website, and you can use the file upload quite a bit, and it is very important to the site. However, I've been hearing that clients can still bypass a file extension restrictions ...
2
votes
1answer
100 views

Why would someone upload many iptables files during a security breach and are they a cause for concern?

My workplace had multiple unauthorized access security failures over the last month. Since then, most computers have been scrubbed and user accounts purged. Data was recovered from offsite backups and ...
1
vote
2answers
31 views

755 permission of uploaded files

I just want to know, if giving 755 permission to an uploaded file is a security problem. If someone upload a malicious file, will the execute permission be a problem? In this answer, he is giving the ...
1
vote
0answers
55 views

How to remotely upload a file on linux and windows (without netcat or ssh)

With meterpreter from metasploit, there is an option (windows or linux victim) to upload files on the victim device. I searched in the metasploit-framework in order to find the script that does the ...
3
votes
2answers
61 views

Security concerns with uploading an image

We have to implement a user profile image upload feature in our web application. The user can upload his profile image. After uploading the image, it will be saved to a DB2 DB, and it will be ...
0
votes
1answer
30 views

How to safely exchange functionality of a file between two computers?

I have two computers and the goal is to move a functionality of a given file from computer A to computer B. The file is supposed to have a certain known functionality but it potentially could expose ...
1
vote
3answers
74 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
0
votes
0answers
67 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
2answers
47 views

Is image uploading to a database secure if you resize the image first in raw bytes?

Please see the upload code below. the method is called within a try, catch. If the code for the image utilities is needed, just say. Basically, everything is handled in raw bytes and then stored to ...
6
votes
3answers
301 views

Recreating uploads/linked images with imagecreatefrom* php

As suggested on my StackOverflow question, I am now directing this towards the Information Security group, since no one was able to answer my question despite multiple up-votes. User uploaded images ...
-5
votes
1answer
48 views

Can the ip of a SMB file share be traced back to me? [closed]

The question is pretty much self explanitory
0
votes
2answers
69 views

PHP Image Upload - Security of storing outside root and accessing via readfile()

I recently began storing image uploads outside the webroot and retrieving them via readfile(). I implemented this and it's working fine, but I was curious if there are any further vulnerabilities that ...
0
votes
1answer
185 views

Secure Image Upload, or Bypassing PHP mime-type Check

When securing image uploads there are basically three approaches I know of (of course, ideally, all three are used): check file extension store uploaded files in non-executable directory outside the ...
3
votes
2answers
1k views

After I've plugged my phone into a computer to upload photos, can people see the photos I did not upload even after I unplugged my phone?

I plugged my phone into a computer at work to upload photos using a USB, then unplugged it. I only uploaded the photos I needed, however, could they somehow see the photos I didn't upload on the ...
1
vote
0answers
40 views

What can go wrong when allowing file uploads on a web server? [closed]

Some basics that are self-evident: Infected/harmful file can be uploaded for other users to download A bug in the web-site's code allowing code execution, thus allowing execution of the uploaded ...
8
votes
4answers
1k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
3
votes
1answer
37 views

“Public facing” dropbox folder uploads to admins machine. Potential security issues?

We've got a client who uses Wufoo for their website's forms. One of their forms contains a file upload feature, this is set in Wufoo to place the uploaded file into a Dropbox folder. This Dropbox ...
5
votes
2answers
977 views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
0
votes
0answers
27 views

What are good templates for an Image Upload policy?

I'm building a collaborative directory for events, where users and events will have their public profiles, each one with at least a main picture. For users, that picture may come from their social ...
1
vote
1answer
61 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
1
vote
2answers
108 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files ...
1
vote
1answer
74 views

Usablity vs security malicious file upload

We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows: There is a panel where one can ...
2
votes
2answers
65 views

Removing vulnerabilities from uploaded files

Our website has a form which allows users to upload image files (png,gif,jpeg and pdf). Once uploaded, the website sends the file (server to server) to the back office api, which then saves the ...
0
votes
0answers
78 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
0
votes
0answers
27 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
4answers
295 views

Secure File Sharing with China

I am looking for a convenient, and particularly a secure way to share files with business contacts in China. My priorities, in this order, are Secure, non-hackable. Accessible. I know many sites ...
1
vote
1answer
68 views

Is it safe to keep a virus' binary code on your local machine?

Is it safe to keep a file containing the virus (binary?) code on your local machine without executing it? I am testing my application against malicious file uploads and and wondering if it's safe to ...
0
votes
2answers
180 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
2
votes
2answers
1k views

How did the hacker get access to my WordPress upload folder? [closed]

Yesterday I found out there is this http://pastebin.com/MRRny4Ht PHP file in my friends server. I want to know how was the hacker able to upload it there? I read the similar questions but couldn't ...
2
votes
1answer
163 views

Reflected XSS via $_FILES

Is it possible to perform a reflected XSS attack via the $_FILES variable? The vulnerable code I am imagining might look like this: echo $_FILES["file"]["name"]; I read that it's not possible to ...
2
votes
0answers
148 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
3
votes
2answers
39 views

Standard (or solution) for securing files in a point-to-point integration

I'm looking for a relatively light weight way to secure both integrity and confidentiality for files being uploaded in a point-to-point integration. The use case is uploading batch files for ...
1
vote
1answer
195 views

Does a solution exist for transferring large files across a network that is faster, yet just as secure as scp? [closed]

I'm posting this here rather than unix/linux, because the primary deal breaker here would be a deteriorated security layer. I'm wondering if there are (noticeably) faster solutions available for ...
1
vote
0answers
66 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
3
votes
0answers
134 views

Is there a way my organization can collect clients' sensitive documents without being liable for them? [closed]

I am the head of IT for a microlending organization. We make small loans to new businesses, and as such we have to collect these clients' tax returns and other financial data as part of the ...
2
votes
1answer
378 views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any ...
0
votes
0answers
138 views

Bypassing Change Name Uploader

I have read all of the questions available on SE about bypassing the change name uploader. Consider an uploader which changes the file name each time you try to upload a file. The only allowed formats ...
0
votes
2answers
295 views

Getting the uploaded file path without knowing the uploading destination

Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
2
votes
0answers
82 views

Simple method requiring no installation of special tools to share a file over the internet

I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools. This is a very common use case. For example, I want to ...
2
votes
1answer
286 views

Prevent shell script inside image file

Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server. I have put server side validation to check file extension + mime type of the image. However, they are ...
1
vote
2answers
161 views

So I need to unzip and process user submitted zip files - how to do so securely?

I am writing a system that accepts zipfiles from end users. The title says it all - what precautions should I take to ensure my processing server does not get compromised when I need to unzip a ...
2
votes
2answers
419 views

Will a crossdomain.xml file reduce a potential security risk?

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks ...
1
vote
0answers
266 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: ...
2
votes
1answer
310 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
5
votes
3answers
586 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
4
votes
5answers
596 views

Is it dangerous to serve user-uploaded Flash (SWF) files?

I'm working on a site that has CMS functionality. I'm considering allowing users to upload Flash (.swf) files and then displaying them on my site. Is this a bad idea? Is there a way to do this ...
1
vote
1answer
152 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...