Questions tagged [file-upload]

File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

26 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
94 views

How dangerous is it to transmit the last N bytes of a datagram in plaintext?

I'm developing software for a university satellite project, and am currently working on the communications protocols. Here are the restrictions: Radio packets should be assumed to be no larger than ...
3
votes
0answers
203 views

Simple method requiring no installation of special tools to share a file over the internet

I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools. This is a very common use case. For example, I want to ...
2
votes
3answers
98 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
2
votes
0answers
341 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
1
vote
1answer
123 views

PHP execution with special characters in the end

I was trying to reproduce this vulnerability: https://www.exploit-db.com/exploits/49294 According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
1
vote
0answers
140 views

Clickjacking and XSS on file upload input?

I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
1
vote
0answers
44 views

Is it possible to bypass the iOS dialogue for taking pictures to upload existing files?

Scenario: An iOS application that prompts the users to take a picture with their iPhone camera. These pictures (e.g. of documents) will then be uploaded to our server. Is there a possible way for an ...
1
vote
0answers
331 views

Is it possible to upload a Web Shell via Websphere Portal XMLaccess tool?

In a lot of different penetration test I found multiple times the wpsadmin multiple password via directory traversal vulnerabilities (either known one in WebSphere Portal or via custom applications ...
1
vote
0answers
943 views

How to remotely upload a file on linux and windows (without netcat or ssh)

With meterpreter from metasploit, there is an option (windows or linux victim) to upload files on the victim device. I searched in the metasploit-framework in order to find the script that does the "...
1
vote
0answers
141 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
1
vote
0answers
136 views

Securing server from attacks and linking while allowing users to upload and store personal files?

I have read some questions and answers about uploading images specifically: Have I done enough not be compromised through image uploading Risks of a PHP image upload form Uploading images safe of ...
1
vote
1answer
152 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
0
votes
0answers
37 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
0
votes
0answers
43 views

Server Upload to presigned URL

I am writing a ReST service which enables user to get a tar archive of a set of requested documents. When the request succeeds, the service should upload the file to a pre-signed URL that points to an ...
0
votes
2answers
94 views

Path traversal in POST request?

Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request? For example POST [...] ----boundary Content-...
0
votes
0answers
75 views

web shells in IDAT PNG Fragments

I have been doing some research on how a PNG is constructed internally, as well as some articles on a technique to include web shells within the IDAT fragment of a PNG. Researching on the Internet I ...
0
votes
0answers
91 views

Handling file uploads securely in phpmailer/php

I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
0
votes
0answers
58 views

Risk of Performing Mime Type Detection Before Virus Scan

Should one perform a virus scan on a file (using ClamAV) before attempting to determine it's mime /content type (using Apache Tika), or does it not matter?
0
votes
3answers
240 views

Man In The Middle Attack On File Uploads

I am using a web service (call it X) which allows files to be uploaded to AWS S3. The way it works is that an initial call is made to X which then returns a list of file descriptors and also meta ...
0
votes
0answers
278 views

Can a corrupted image/video become a XSS vector?

Let's suppose that I allow users to upload an image or a video. Obviously, I rename it on the server side. Can an attacker use it to conduct an XSS attack? I show images in this way: <img src="...
0
votes
1answer
180 views

Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)

I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file. The XML file will be used to layout text on the PDF based on variables coming from within the ...
0
votes
0answers
68 views

Can you trace the path a file upload path without manually executing it?

In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
0
votes
0answers
145 views

How can JavaScript be uploaded safely to a server through a web app?

Can users who have access to web content management system be allowed to upload JavaScript files to the web server through a web app in a safe way? Or shouldn't uploading JavaScript be allowed by ...
0
votes
0answers
775 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
0
votes
0answers
38 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
0
votes
0answers
38 views

Get data file off critical database host

Re-wording this question to hopefully be more understandable. Thanks for the feedback. We have a data warehouse which sits in our production environment. Our data engineers can get to the host via ...