Collaborate Disseminate
I am writing a simple server for file uploading. I want to be able to rename uploaded files (including the file extension) and download files.
For validating the file to upload my plan was to check if the mime type, the file extension and … Continue reading How to handle mime types, file extension and magic number on file upload, renaming and file download?
I’m trying out for a CTF team and I’ve gotten enough points to join, but I’ve decided to complete the harder challenges. For this challenge I have use wireshark to analyze a .pcap file to find the md5 hash of the file that was downloaded.
… Continue reading How would I reconstruct partial hex from a tcp stream
I was sent an email with attachments from an attorney in a contentious litigation matter despite him embedding the actual attachments at bottom of his email. The links didn’t open until I downloaded Outlook. I submitted exhibits for court … Continue reading If my system had been infected prior to submitting important files, could this cause a double and triple file extension and files to show up blank?k [closed]
Does anyone understand what the author means which this (please see the screenshot below).
This is a link to the paper, it’s on page 19 (page 28 if you count all pages):
https://pure.tue.nl/ws/portalfiles/portal/72275825/738228_Mulders_D.A… Continue reading Rename file by Ransomware- Does anyone know what is ment by this? [closed]
They are blocked by our email gateway, but are also needed for some workflows. Can these files even contain malicious content and possibly execute code?
Continue reading Can .ai files (Adobe Illustrator) be malicious?
I am trying to implement secure file uploads. I need to support various file types, including PDF, XLS, and XSL. I have implemented some basic controls, such as:
Store files outside the web root
Check file extension against whitelist
Gene… Continue reading Should I validate file types on server upload, and how?
For example, can an .exe file be spoofed in .txt or .mp3 in Windows and still be executed as an executable?
I know some basic methods like:
using right-to-left override character (U+202E)
winrar 4 zip file exploit (no longer working)
Is … Continue reading Can a file extension be spoofed in windows?
I would like to allow users of my app to upload images in different formats that other users can view (including webm videos).
But I would also like to make sure that the images are actual images and not harmful to display.
So heres my 3 c… Continue reading How can I make sure an image uploaded to my server is not harmful?
I have received a file called memory.dump (1GB) which is a dump file format that I’ve never come across.
I usually use volatility and for most cases. It worked just fine for FDA but in this case, it just doesn’t do anything and just this ‘… Continue reading Memory dump analysis [closed]
My code is that
if (in_array($file_ext, $extensions)) {
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $file_tmp);
if ($mime == ‘application/msword’ || $mime == ‘image/gif’ … Continue reading why the internal server error occured when using finfo_file function? [closed]