Collaborate Disseminate
I have found an endpoint on a website that allow me to upload files. This endpoint didn’t have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when I visit the uploaded fil… Continue reading How to execute PHP file after uploading it? [on hold]
Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames?
For example, naming a file “../test.txt” (if it’s possible at all)… Continue reading Path traversal via filename
I’ve found a way to upload files in a web application running on top of Lotus Domino, and can access the uploaded files from my browser.
Now I’d like to run a script of course, to show I can execute code on the server. Anyon… Continue reading File upload on Lotus Domino server
Happy New Year to all of you.
I have write the code in php for upload files, any type of files. But now I want to give some security over there?
here is the code?
<?php
$original_path=”uploadedfiles/”;
//New … Continue reading How to check the content-type header in the server?
While testing file upload functionality in web application, which allows only .cer files, I found out that it is possible to upload a .cer file where at the end of the file, after „—–END CERTIFICATE—–„ it is possible to… Continue reading File upload functionality – cer format verification
While testing file upload functionality in web application, which allows only .cer files, I found out that it is possible to upload a .cer file where at the end of the file, after „—–END CERTIFICATE—–„ it is possible to… Continue reading File upload functionality – cer format verification
This question already has an answer here:
Server compromised for 2nd time, cannot locate source of attack
7 answers
Recen… Continue reading force uploading a file to a server with an open port [duplicate]
This question already has an answer here:
Server compromised for 2nd time, cannot locate source of attack
7 answers
Recen… Continue reading force uploading a file to a server with an open port [duplicate]
So, I have an upload functionality where extension of the filetype is checked correctly (and not currently bypassable). But the mime type is not checked. Does this leave me with some residual risk or possible “attacks”. Where I mean attack… Continue reading File upload not checking on mime type
When creating or testing a file upload functionality how do you deal with Office documents assuming that the client wants to be able to upload .doc/.docx/.xls/.xlsx?
I have found quite some reading material about the possibi… Continue reading How to deal with Office documents in file upload?