Tutorial File Upload Filter Bypass - Printable Version +- Sinisterly (https://sinister.ly) +-- Forum: Hacking (https://sinister.ly/Forum-Hacking) +--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials) +--- Thread: Tutorial File Upload Filter Bypass (/Thread-Tutorial-File-Upload-Filter-Bypass)

File Upload Filter Bypass - DoXeD - 06-01-2024 Scenario you have a place to upload files that you can access, but there is a filter making sure that the file type matches the ones expected (e.g. only image file types) PNG Image Header 89 50 4E 47 Open a hex editor and create a new file, copy those bytes over to the beginning of the new file. Into the TEXT area (on the right, not the bytes area where you just pasted the header above) paste your shell <?php system($_GET['c']);?> It should look like this Take note of the length Next start burp and navigate to the upload directory. Then do the following 1. Turn on interceptor 2. Send an upload request with any file 3. Modify the request Original Modified Then forward the request and disable interceptor.