File upload with security filters that can be bypassed
This lab demonstrates file upload vulnerabilities where basic security filters are implemented but can be bypassed using various techniques. The application filters file types and MIME types but doesn't prevent all attack vectors.
Objective: Bypass security filters to upload malicious files and achieve server compromise.
// Vulnerable: Basic filters that can be bypassed
function process_file_upload_with_filters($file) {
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'txt', 'pdf'];
$allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif', 'text/plain'];
$max_file_size = 5 * 1024 * 1024; // 5MB
// Check file size
if ($file['size'] > $max_file_size) {
return false;
}
// Check extension
$file_extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
return false;
}
// Check MIME type
if (!in_array($file['type'], $allowed_mime_types)) {
return false;
}
// Still vulnerable to bypass techniques
return move_uploaded_file($file['tmp_name'], $file_path);
}
The following are filtered:
Try these bypass methods:
webshell.php.jpg - Double extensionwebshell.php%00.jpg - Null byte injectionwebshell.php;.jpg - Semicolon bypasswebshell.php.jpg - Case variationNo files uploaded yet.
Use these techniques to bypass security filters: