📀Common File Upload Bypasses

Common File Upload Bypasses

Default extensions

PHP Server

.php , .php3 , .php4 , .php5 , .php7

Less known PHP extensions

.pht , .phps , .phar , .phpt , .pgif , .phtml , .phtm , .inc

ASP Server

.asp, .aspx, .cer and .asa (IIS <= 7.5), shell.aspx;1.jpg (IIS < 7.0), shell.soap

JSP

.jsp, .jspx, .jsw, .jsv, .jspf

Perl

.pl, .pm, .cgi, .lib

Different Ways to Bypass the Extensions

• Use double extensions: .jpg.php

• Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): .php.jpg

• Randomly use uppercase and lowercase in the extension: .pHp, .pHP5, .PhAr

• Null byte: The restriction on uploading files can be bypassed by using a Null Byte in the file name, typically with the extension.

.php%00.gif , .php\x00.gif , 

• Nth Extension Bypass: Using multiple levels of extension is one of the most common methods to bypass the file upload restrictions.

example file: test.jpg.html // cobalt.cobalt.jpg.html

• Special characters

• Multiple dots after the extension: file.php......

• Whitespace characters: file.php%20, file.php%0d%0a.jpg

• Right to Left Override (RTLO): name.%E2%80%AEphp.jpg will become name.gpj.php

• Slash: file.php/, file.php.\, file.j\sp, file.j/sp

• Multiple special characters: file.jsp/././././.

Content Type Bypass:

• Mime type, change Content-Type : application/x-php or Content-Type : application/octet-stream to Content-Type : image/gif

• Set the Content-Type twice: once for unallowed type and once for allowed.

Tools & Extensions

• Fuxploider

• Burp > Upload Scanner

• ZAP > FileUpload AddOn