Collaborate Disseminate
PHP 7 uses the default system folder (/tmp) to store uploaded files.
PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to another one, since the /tmp permission is … Continue reading Should I change the default folder for uploads?
Can multiple files uploaded from my pc network shared drives at work to my personal google drive on my employer’s internet/network be tracked and seen by employer? If so, are they able to see exactly what files I have uploaded and so on? A… Continue reading What specifically management in IT Department able to see when files are uploaded from company network drives to Google internet drive? [closed]
My code is that
if (in_array($file_ext, $extensions)) {
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $file_tmp);
if ($mime == ‘application/msword’ || $mime == ‘image/gif’ … Continue reading why the internal server error occured when using finfo_file function? [closed]
$_FILES[‘userfile’][‘type’] == "image/gif"
There is a problem to choose not only image.gif but whatever name is, such as *.gif . And, if it is possible, can you share some regex expressions for all names and especially image ext… Continue reading How to choose specific file names in php code? [migrated]
I am writing a ReST service which enables user to get a tar archive of a set of requested documents. When the request succeeds, the service should upload the file to a pre-signed URL that points to an s3 bucket or azure blob storage or a p… Continue reading Server Upload to presigned URL
Let’s say I have two kind of files on my Windows desktop – first are files that can be published and shared with other people, second kind is confidential and should remain private.
To share files I compress them with Peazip. I am a bit pa… Continue reading Is checking zip content on another PC enough to prevent data leak?
Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request?
For example
POST
[…]
—-boundary
Content-Disposition: form-data; name="hello.pdf… Continue reading Path traversal in POST request?
I have been doing some research on how a PNG is constructed internally, as well as some articles on a technique to include web shells within the IDAT fragment of a PNG.
Researching on the Internet I came across a publication, which listed … Continue reading web shells in IDAT PNG Fragments
I’m not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed.
I’m wetting my feet in PHP, and I’ve put together a very simple program that (using JavaScrip… Continue reading Are there risks in user-uploaded .txt files sent as a string to PHP
There is PHP website and IIS web server. The website has unrestricted file upload vulnerability. When I upload a reverse shell to connect back to netcat listener or meterpreter it connects with username iis_met, but when I upload a PHP she… Continue reading IIS Different user with reverse shell