316
votes
Accepted
Hacker used picture upload to get PHP code into my site
Client side validation
The validation code you have provided is in JavaScript. That suggests it is code that you use to do the validation on the client.
Rule number one of securing webapps is to never ...
- 65.4k
50
votes
Accepted
Does changing an uploaded executable's file extension to .png render it safe?
There are basically two main ways an uploaded file can be harmful: by being executed (as a script or binary) or by being run/used in an application and abusing an exploit in it (e.g. an uploaded MP3 ...
- 670
36
votes
Hacker used picture upload to get PHP code into my site
First off, if someone exploited a file upload function, ensure that you're verifying the file on both the client and server. Bypassing client-side JavaScript protection is trivial.
Second, ensure ...
- 3,394
34
votes
What security risks are there in allowing someone to upload PHP scripts?
It's very dangerous, because you are allowing to someone to upload PHP file with unknown code and unknown intentions, so if you need this functionality as part of your web site, you should harden your ...
- 1,069
29
votes
What security risks are there in allowing someone to upload PHP scripts?
If you allow somebody to upload and execute a PHP script on your server, you effectively give this person the right to do whatever he or she could do, if she had ssh access with username/password for ...
- 7,622
26
votes
Hacker used picture upload to get PHP code into my site
It is super-important to note here that PHP was designed to be embedded in other content. Specifically, it was designed to be embedded within HTML pages, complementing a largely static page with ...
- 72.7k
25
votes
What security risks are there in allowing someone to upload PHP scripts?
To me it sounds like you are about to shoot yourself in the foot. Letting people you don't trust upload and run PHP on your server is extremely dangerous. Here are some things an attacker could try:
...
- 65.4k
23
votes
Hacker used picture upload to get PHP code into my site
You can disable PHP in your upload directory by .htaccess so your server won't execute any PHP code in the directory and in its subdirectories.
Create a .htaccess file inside your upload directory ...
- 331
22
votes
Accepted
Making a Blacklist of filetypes to protect PHP application
It is not clear from your description why you want block these files exactly. I see the following possibilities:
You want to block files that might infect the server itself. Unfortunately this can be ...
- 198k
22
votes
Accepted
How insecure is FTP?
With plain FTP the credentials are passed in plain and thus can be easily sniffed. Also, the files are not only send in plain but they are also not protected against modifications, i.e. an active man ...
- 198k
20
votes
Accepted
How to safely allow upload of executable files
The most common solution for this kind of issue is to make sure the stored file is not accessible by the web server.
One simple way to do this is is to store the file in a database and never save it ...
- 18.7k
17
votes
What security risks are there in allowing someone to upload PHP scripts?
While there are sites that allow you to run PHP code on demand (i.e. 3v4l), they severely limit what you can do and jump through some major hoops to do it safely
I use a setup where scripts are ...
- 3,808
14
votes
Making a Blacklist of filetypes to protect PHP application
Don't block any specific MIME types. Block any kind of execution of the uploaded files. A simple way is to store uploaded files outside of the web root and serve them via scripting. If that's not ...
- 141
14
votes
Exploiting a PHP server with a .jpg file upload
Regardless of the placement of the PHP code [...], the website just shows the image file when I open it after uploading
Yes, that is how it should be. The server would be seriously vulnerable if it ...
- 29.5k
14
votes
Keep encrypted files in sync on a cloud service, without having to upload an entire encrypted volume each time
this would mean, obviously, re-uploading the single volume every time even the smallest file in it changes;
It is clear that this rules out, for different reasons, VeraCrypt or EFS.
That's not true. ...
- 9,149
12
votes
Does changing an uploaded executable's file extension to .png render it safe?
No. Renaming a file doesn't increase security.
He says to me, that by making all files images no harm can be done to the server.
for example evilscript.evil would become evilscript.png
When you ...
- 313
12
votes
How insecure is FTP?
Credentials are transfered in clear text, but you know that from the other posts. But how easy is it to get those details?
As an example I ran tcpdump and connected to an FTP server. Lets take a ...
- 3,002
11
votes
Hacker used picture upload to get PHP code into my site
You are only checking the extension, this doesn't necessarily correlate to what the actual file type is. Server side you could use something like exif_imagetype to verify the file is an image.
exif ...
- 4,172
11
votes
How to prevent XSS in SVG file upload?
Take a look at this fantastic blog post that was recently published by security researcher Robin (@digininja) about this exact topic:
Direct view with content-disposition: attachment - not vulnerable ...
- 211
9
votes
Accepted
CSRF attack on file upload functionality
Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded.
So how can this be exploited? If your site ...
- 65.4k
8
votes
Secure File Sharing with China
How paranoid are you?
Level 1:
Use WinRAR or 7-Zip to create encrypted archives and share them over any file-sharing mechanisms. SHare the password over completely different means of communication.
...
- 731
8
votes
Accepted
Is it possible to get XSS through uploading an image via the filename?
Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as ...
- 46.2k
7
votes
Pentesting file upload functionality
If it is an Apache server, you might be able to upload a .htaccess file, enabling you to establish directory listings or specifying file extensions to run like php, jsp, py or whatever the server is ...
- 1,513
7
votes
Accepted
Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?
shell.php.jpg should be treated as a .jpg file
You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, ...
- 1,759
7
votes
CVE-2017-15580: Getting code execution with upload
I don't think that you read the CVE or the PoC properly.
The PoC says that the reverse shell is to get a shell "of the end user". Not the server.
So, you are not doing anything wrong. You ...
- 128k
6
votes
Making a Blacklist of filetypes to protect PHP application
Are there any other filetype that I also should block?
It doesn't matter, as finfo_file can be bypassed, see for example here: Encoding Web Shells in PNG IDAT chunks. mime_content_type doesn't seem ...
- 29.5k
6
votes
Hacker used picture upload to get PHP code into my site
One possible part of a solution here is to keep the image, but also to make a resized copy with PHP such that you can ensure that you are getting an image, and reduce the size of the original image. ...
- 61
6
votes
Hacker used picture upload to get PHP code into my site
I totally agree with the accepted answer, but I would suggest to do a little bit more than just playing around with the filename. You should re-compress the original/uploaded file with PHP using GD or ...
- 61
6
votes
Accepted
Why does OWASP suggest using POST over PUT for file uploads?
TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface.
@iain is correct in comment that the SO ...
- 5,857
6
votes
Accepted
Is using enctype="multipart/form-data" always a bad idea?
Using enctype="multipart/form-data" creates both a binary and an ascii upload
I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists ...
- 198k
Only top scored, non community-wiki answers of a minimum length are eligible