Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

All Questions

Tagged with
Filter by
Sorted by
Tagged with
3
votes
2answers
83 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
1
vote
1answer
99 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
0
votes
2answers
110 views

Unable to execute PHP, throws 500 error. Able to upload and execute all others

I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I ...
4
votes
2answers
218 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
0
votes
2answers
247 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
0
votes
0answers
42 views

Can you trace the path a file upload path without manually executing it?

In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
2
votes
1answer
99 views

File upload security with PHP - Header to text/plain

I am using PHP to create a small script that uploads images to a server. While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
0
votes
1answer
111 views

Is this scenario a file upload vulnerability?

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png)...
0
votes
1answer
134 views

How to spoof file extension when it is appended to the file name every time?

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (...
1
vote
2answers
992 views

Bypassing file upload restrictions on php server

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for: 1: Filetype 2: ...
2
votes
0answers
150 views

PHP Upload-show images securely [closed]

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image. So i've created a small test project where ...
0
votes
1answer
35 views

What characters that are converted when running PHP on IIS?

I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload I saw this statement: Finding characters that are converted to other useful ...
5
votes
2answers
656 views

Directory transversal in PHP with the $_FILES array?

I'm working on a php application that is handling file upload. I'm trying to inject a path transversal payload in the filename such as /../../../../etc/. The thing is that the vulnerable line of code ...
0
votes
1answer
2k views

How exploiting RCE in jpg file actually works?

I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct. <?php $test = array('image/jpeg', '...
1
vote
2answers
1k views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
1
vote
1answer
130 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
7
votes
2answers
257 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
27
votes
8answers
8k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
-3
votes
1answer
646 views

How to execute PHP file after uploading it? [closed]

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when ...
0
votes
3answers
177 views

force uploading a file to a server with an open port [duplicate]

Recently my web server was hacked. someone uploaded a php file manager called extplorer and changed all of my web pages and i was wondering what possible ways they could of uploaded something to my ...
-1
votes
1answer
99 views

Vulnerabilities in PHP Form Handling Script [closed]

I'm writing a PHP script that takes input from an HTML5 form, including uploads, and emails them to an administrator using Magento's mail client. I think I've covered the basics pretty well, but I'm ...
1
vote
3answers
546 views

PHP file upload: Order of security measures

In a PHP file upload form, the name and extension of the file should be changed in order to prevent directory traversal attacks. I don't fully understand these attacks, therefore I'm uncertain if some ...
1
vote
1answer
313 views

Serving image from outside web server root

Is storing an image outside of the webserver root with a new name and extension (e.g. using move_uploaded_file($_FILES['userfile']['tmp_name'],'../uploads/'.date('U').'png') - not exactly this, ...
1
vote
2answers
978 views

Changing file extensions in PHP file upload to prevent code execution?

I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will ...
0
votes
1answer
95 views

How to prevent malicious movie uploads? [closed]

I am creating a movie upload site, and I am wondering how I would verify that the movie I am uploading is in fact a movie. I know that getimagesize() will test images, so is there an equivalent of ...
116
votes
11answers
46k views

Hacker used picture upload to get PHP code into my site

I'm working on a website — right now it's in early stages of testing, not yet launched and just has test data - thank goodness. First of all, a hacker figured out the password to log onto the ...
1
vote
1answer
161 views

iDevAffiliate vulnerable to a file upload, how can we limit the damage?

iDevAffiliate affiliate software provides affiliate program software to start affiliate tracking. It is protected by ioncube which makes it quite hard to audit the code for vulnerability. It is the ...
8
votes
3answers
2k views

How to safely allow upload of executable files [duplicate]

I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
4
votes
1answer
475 views

Exploitation of missing is_uploaded_file check?

The PHP documentation for is_uploaded_file says: Returns TRUE if the file named by filename was uploaded via HTTP POST. This is useful to help ensure that a malicious user hasn't tried to trick ...
34
votes
5answers
8k views

Does changing an uploaded executable's file extension to .png render it safe?

A colleague of mine has a personal website in which he allows users to upload anything within a certain size, but before the actual upload he checks to see the file extension: if ( $type == 'image/...
6
votes
3answers
860 views

Recreating uploads/linked images with imagecreatefrom* php

As suggested on my StackOverflow question, I am now directing this towards the Information Security group, since no one was able to answer my question despite multiple up-votes. User uploaded images ...
1
vote
2answers
883 views

PHP Image Upload - Security of storing outside root and accessing via readfile()

I recently began storing image uploads outside the webroot and retrieving them via readfile(). I implemented this and it's working fine, but I was curious if there are any further vulnerabilities that ...
1
vote
1answer
3k views

Secure Image Upload, or Bypassing PHP mime-type Check

When securing image uploads there are basically three approaches I know of (of course, ideally, all three are used): check file extension store uploaded files in non-executable directory outside the ...
10
votes
4answers
4k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
14
votes
3answers
60k views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
1
vote
1answer
329 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
3
votes
2answers
1k views

Reflected XSS via $_FILES

Is it possible to perform a reflected XSS attack via the $_FILES variable? The vulnerable code I am imagining might look like this: echo $_FILES["file"]["name"]; I read that it's not possible to ...
2
votes
1answer
2k views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any headers,...
0
votes
2answers
1k views

Getting the uploaded file path without knowing the uploading destination

Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
1
vote
0answers
417 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: $Ssy='XEYP'|~...
7
votes
3answers
2k views

PHP | Security for allowing user uploads

My Situation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I have ...
1
vote
1answer
5k views

Bypassing file upload restrictions

However an exercise I do not manage to resolve, I have to bypass a check of extension of a form in PHP. It turns out that just the extension is verified, but certain special characters are replaced ...
2
votes
2answers
5k views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
1
vote
1answer
457 views

Bypass Text Plain Rule

I want to know if I can allow uploading all types of scripts and add these rules to a virtual host configuration; so please advise and tell me if there will be some exploits that can be used to ...
1
vote
2answers
1k views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
-1
votes
1answer
565 views

BigDump v0.35b vulnerability [closed]

I dont understand what the problem with BigDump v0.35b. This site says that it have problem. But i dont understand it. Problem here? if (!$error && isset($_REQUEST["uploadbutton"])) { if (...
16
votes
6answers
13k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ?
0
votes
1answer
333 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
1
vote
0answers
4k views

blueimp jQuery-File-Upload getting PHP Hacked [closed]

I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the ...
2
votes
1answer
710 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...