Skip to main content
Share Your Experience: Take the 2024 Developer Survey
314 votes
Accepted

Hacker used picture upload to get PHP code into my site

Client side validation The validation code you have provided is in JavaScript. That suggests it is code that you use to do the validation on the client. Rule number one of securing webapps is to never ...
Anders's user avatar
  • 65.6k
50 votes
Accepted

Does changing an uploaded executable's file extension to .png render it safe?

There are basically two main ways an uploaded file can be harmful: by being executed (as a script or binary) or by being run/used in an application and abusing an exploit in it (e.g. an uploaded MP3 ...
Draugr's user avatar
  • 670
36 votes

Hacker used picture upload to get PHP code into my site

First off, if someone exploited a file upload function, ensure that you're verifying the file on both the client and server. Bypassing client-side JavaScript protection is trivial. Second, ensure ...
thel3l's user avatar
  • 3,404
33 votes

What security risks are there in allowing someone to upload PHP scripts?

It's very dangerous, because you are allowing to someone to upload PHP file with unknown code and unknown intentions, so if you need this functionality as part of your web site, you should harden your ...
hmrojas.p's user avatar
  • 1,059
28 votes

What security risks are there in allowing someone to upload PHP scripts?

If you allow somebody to upload and execute a PHP script on your server, you effectively give this person the right to do whatever he or she could do, if she had ssh access with username/password for ...
Jacco's user avatar
  • 7,702
26 votes

Hacker used picture upload to get PHP code into my site

It is super-important to note here that PHP was designed to be embedded in other content. Specifically, it was designed to be embedded within HTML pages, complementing a largely static page with ...
gowenfawr's user avatar
  • 72.8k
25 votes

What security risks are there in allowing someone to upload PHP scripts?

To me it sounds like you are about to shoot yourself in the foot. Letting people you don't trust upload and run PHP on your server is extremely dangerous. Here are some things an attacker could try: ...
Anders's user avatar
  • 65.6k
23 votes

Hacker used picture upload to get PHP code into my site

You can disable PHP in your upload directory by .htaccess so your server won't execute any PHP code in the directory and in its subdirectories. Create a .htaccess file inside your upload directory ...
medskill's user avatar
  • 331
22 votes
Accepted

How insecure is FTP?

With plain FTP the credentials are passed in plain and thus can be easily sniffed. Also, the files are not only send in plain but they are also not protected against modifications, i.e. an active man ...
Steffen Ullrich's user avatar
20 votes
Accepted

How to safely allow upload of executable files

The most common solution for this kind of issue is to make sure the stored file is not accessible by the web server. One simple way to do this is is to store the file in a database and never save it ...
Stephane's user avatar
  • 18.7k
17 votes

What security risks are there in allowing someone to upload PHP scripts?

While there are sites that allow you to run PHP code on demand (i.e. 3v4l), they severely limit what you can do and jump through some major hoops to do it safely I use a setup where scripts are ...
Machavity's user avatar
  • 3,798
14 votes

Keep encrypted files in sync on a cloud service, without having to upload an entire encrypted volume each time

this would mean, obviously, re-uploading the single volume every time even the smallest file in it changes; It is clear that this rules out, for different reasons, VeraCrypt or EFS. That's not true. ...
techraf's user avatar
  • 9,139
13 votes

Does changing an uploaded executable's file extension to .png render it safe?

No. Renaming a file doesn't increase security. He says to me, that by making all files images no harm can be done to the server. for example evilscript.evil would become evilscript.png When you ...
enkryptor's user avatar
  • 323
12 votes

How insecure is FTP?

Credentials are transfered in clear text, but you know that from the other posts. But how easy is it to get those details? As an example I ran tcpdump and connected to an FTP server. Lets take a ...
Joe M's user avatar
  • 3,002
11 votes

Hacker used picture upload to get PHP code into my site

You are only checking the extension, this doesn't necessarily correlate to what the actual file type is. Server side you could use something like exif_imagetype to verify the file is an image. exif ...
iainpb's user avatar
  • 4,162
11 votes

How to prevent XSS in SVG file upload?

Take a look at this fantastic blog post that was recently published by security researcher Robin (@digininja) about this exact topic: Direct view with content-disposition: attachment - not vulnerable ...
ThorTL67's user avatar
  • 211
9 votes
Accepted

CSRF attack on file upload functionality

Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded. So how can this be exploited? If your site ...
Anders's user avatar
  • 65.6k
8 votes
Accepted

Is it possible to get XSS through uploading an image via the filename?

Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as ...
CBHacking's user avatar
  • 49k
7 votes

Pentesting file upload functionality

If it is an Apache server, you might be able to upload a .htaccess file, enabling you to establish directory listings or specifying file extensions to run like php, jsp, py or whatever the server is ...
DarkLighting's user avatar
  • 1,523
7 votes
Accepted

Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?

shell.php.jpg should be treated as a .jpg file You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, ...
Andrew Morozko's user avatar
7 votes

CVE-2017-15580: Getting code execution with upload

I don't think that you read the CVE or the PoC properly. The PoC says that the reverse shell is to get a shell "of the end user". Not the server. So, you are not doing anything wrong. You ...
schroeder's user avatar
  • 131k
6 votes

Hacker used picture upload to get PHP code into my site

One possible part of a solution here is to keep the image, but also to make a resized copy with PHP such that you can ensure that you are getting an image, and reduce the size of the original image. ...
LostBoy's user avatar
  • 61
6 votes

Hacker used picture upload to get PHP code into my site

I totally agree with the accepted answer, but I would suggest to do a little bit more than just playing around with the filename. You should re-compress the original/uploaded file with PHP using GD or ...
akman's user avatar
  • 61
6 votes
Accepted

Why does OWASP suggest using POST over PUT for file uploads?

TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface. @iain is correct in comment that the SO ...
grochmal's user avatar
  • 5,877
6 votes
Accepted

Is using enctype="multipart/form-data" always a bad idea?

Using enctype="multipart/form-data" creates both a binary and an ascii upload I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists ...
Steffen Ullrich's user avatar
6 votes
Accepted

Malicious PDF file upload

Run them all through a converter into PDF/A format. It forbids any sort of active content. If they won't convert, trash them. IDS/IPS with Anti-Malware license Scanning is a losing battle. No ...
PushfPopf's user avatar
  • 300
5 votes

Security concerns with uploading an image

As schroeder mentioned, you may have neglected some detail here, which makes your security group nervous. There are a number of classes of attack the security group may be concerned with. Just a few ...
JesseM's user avatar
  • 1,952
5 votes

MIME Type vs. Magic Numbers

If you are talking about file uploads to a server use various methods to check the filetype. The overhead is tiny. Magic numbers give you a more robust way to verify the filetype but can still be ...
TrickyDupes's user avatar
  • 2,849
5 votes

What security risks are there in allowing someone to upload PHP scripts?

PHP has a lot of functions to disable features and restrict certain actions so it can be used in shared hosting scenarios. So it is much safer to allow people to upload php scripts than i.e. perl ...
allo's user avatar
  • 3,361
5 votes
Accepted

What are the potential vulnerabilities of allowing a large http body size?

I'm going to go for an answer but I'm also not an expert on this particular topic, so I'll be curious to read any other answers that might come in. I believe that the short answer is this: allowing ...
Conor Mancone's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible