314
votes
Accepted
Hacker used picture upload to get PHP code into my site
Client side validation
The validation code you have provided is in JavaScript. That suggests it is code that you use to do the validation on the client.
Rule number one of securing webapps is to never ...
- 65.8k
36
votes
Hacker used picture upload to get PHP code into my site
First off, if someone exploited a file upload function, ensure that you're verifying the file on both the client and server. Bypassing client-side JavaScript protection is trivial.
Second, ensure ...
- 3,414
33
votes
What security risks are there in allowing someone to upload PHP scripts?
It's very dangerous, because you are allowing to someone to upload PHP file with unknown code and unknown intentions, so if you need this functionality as part of your web site, you should harden your ...
- 1,059
28
votes
What security risks are there in allowing someone to upload PHP scripts?
If you allow somebody to upload and execute a PHP script on your server, you effectively give this person the right to do whatever he or she could do, if she had ssh access with username/password for ...
- 7,752
26
votes
Hacker used picture upload to get PHP code into my site
It is super-important to note here that PHP was designed to be embedded in other content. Specifically, it was designed to be embedded within HTML pages, complementing a largely static page with ...
- 73.3k
25
votes
What security risks are there in allowing someone to upload PHP scripts?
To me it sounds like you are about to shoot yourself in the foot. Letting people you don't trust upload and run PHP on your server is extremely dangerous. Here are some things an attacker could try:
...
- 65.8k
23
votes
Hacker used picture upload to get PHP code into my site
You can disable PHP in your upload directory by .htaccess so your server won't execute any PHP code in the directory and in its subdirectories.
Create a .htaccess file inside your upload directory ...
- 331
23
votes
Accepted
How insecure is FTP?
With plain FTP the credentials are passed in plain and thus can be easily sniffed. Also, the files are not only send in plain but they are also not protected against modifications, i.e. an active man ...
- 208k
20
votes
Accepted
How to safely allow upload of executable files
The most common solution for this kind of issue is to make sure the stored file is not accessible by the web server.
One simple way to do this is is to store the file in a database and never save it ...
- 18.7k
17
votes
What security risks are there in allowing someone to upload PHP scripts?
While there are sites that allow you to run PHP code on demand (i.e. 3v4l), they severely limit what you can do and jump through some major hoops to do it safely
I use a setup where scripts are ...
- 3,798
14
votes
Keep encrypted files in sync on a cloud service, without having to upload an entire encrypted volume each time
this would mean, obviously, re-uploading the single volume every time even the smallest file in it changes;
It is clear that this rules out, for different reasons, VeraCrypt or EFS.
That's not true. ...
- 9,159
12
votes
How insecure is FTP?
Credentials are transfered in clear text, but you know that from the other posts. But how easy is it to get those details?
As an example I ran tcpdump and connected to an FTP server. Lets take a ...
- 3,012
11
votes
How to prevent XSS in SVG file upload?
Take a look at this fantastic blog post that was recently published by security researcher Robin (@digininja) about this exact topic:
Direct view with content-disposition: attachment - not vulnerable ...
- 211
11
votes
Hacker used picture upload to get PHP code into my site
You are only checking the extension, this doesn't necessarily correlate to what the actual file type is. Server side you could use something like exif_imagetype to verify the file is an image.
exif ...
- 4,172
10
votes
Securing HTTP File Transfer over local network
For security, you need authentication. If Alice wants to sends a file to Bob's computer, Alice's app needs a way to verify that it's Bob's computer it's talking to, and not an attacker's computer. So ...
- 34.4k
9
votes
Accepted
CSRF attack on file upload functionality
Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded.
So how can this be exploited? If your site ...
- 65.8k
8
votes
Accepted
Is it possible to get XSS through uploading an image via the filename?
Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as ...
- 52.1k
7
votes
Pentesting file upload functionality
If it is an Apache server, you might be able to upload a .htaccess file, enabling you to establish directory listings or specifying file extensions to run like php, jsp, py or whatever the server is ...
- 1,523
7
votes
Accepted
Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?
shell.php.jpg should be treated as a .jpg file
You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, ...
- 1,749
7
votes
CVE-2017-15580: Getting code execution with upload
I don't think that you read the CVE or the PoC properly.
The PoC says that the reverse shell is to get a shell "of the end user". Not the server.
So, you are not doing anything wrong. You ...
- 132k
6
votes
Hacker used picture upload to get PHP code into my site
One possible part of a solution here is to keep the image, but also to make a resized copy with PHP such that you can ensure that you are getting an image, and reduce the size of the original image. ...
- 61
6
votes
Hacker used picture upload to get PHP code into my site
I totally agree with the accepted answer, but I would suggest to do a little bit more than just playing around with the filename. You should re-compress the original/uploaded file with PHP using GD or ...
- 61
6
votes
Accepted
Why does OWASP suggest using POST over PUT for file uploads?
TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface.
@iain is correct in comment that the SO ...
- 5,897
6
votes
MIME Type vs. Magic Numbers
If you are talking about file uploads to a server use various methods to check the filetype. The overhead is tiny. Magic numbers give you a more robust way to verify the filetype but can still be ...
- 2,859
6
votes
Accepted
Is using enctype="multipart/form-data" always a bad idea?
Using enctype="multipart/form-data" creates both a binary and an ascii upload
I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists ...
- 208k
6
votes
Accepted
Malicious PDF file upload
Run them all through a converter into PDF/A format.
It forbids any sort of active content.
If they won't convert, trash them.
IDS/IPS with Anti-Malware license
Scanning is a losing battle. No ...
- 300
5
votes
What security risks are there in allowing someone to upload PHP scripts?
PHP has a lot of functions to disable features and restrict certain actions so it can be used in shared hosting scenarios. So it is much safer to allow people to upload php scripts than i.e. perl ...
- 3,472
5
votes
Accepted
What are the potential vulnerabilities of allowing a large http body size?
I'm going to go for an answer but I'm also not an expert on this particular topic, so I'll be curious to read any other answers that might come in.
I believe that the short answer is this: allowing ...
- 31.7k
5
votes
Accepted
File upload security in webapp - overview of setup
I think the only way to answer this is through a collaborative commenting effort, so here goes a community wiki:
Of course only registered users can upload, but I know that doesn't mean anything.
...
5
votes
How can I inject real php code into this website?
This is... strange. My guess is that you are right in that this is some sort of protection mechanism, but it doesn't look like a very stable one. A better approach would be to block files with .php or ...
- 65.8k
Only top scored, non community-wiki answers of a minimum length are eligible