Scribd Logo
Upload

Welcome to Scribd!

  • 034 File Upload Bypass Content Type

    Uploaded by

    Durhock
    20 views6 pages
    This document discusses beating content-type checks in file uploads. It notes that web applications commonly check the content-type of uploaded files, but an attacker can use a proxy to change the reported content-type to bypass such checks. It then provides details on an intentionally vulnerable online system that can be used to test arbitrary file upload vulnerabilities, including a username and password to log in.

    Original Description:

    Original Title

    034-file-upload-bypass-content-type

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses beating content-type checks in file uploads. It notes that web applications commonly check the content-type of uploaded files, but an attacker can use a proxy to change the reported content-type to bypass such checks. It then provides details on an intentionally vulnerable online system that can be used to test arbitrary file upload vulnerabilities, including a username and password to log in.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    20 views6 pages

    034 File Upload Bypass Content Type

    Uploaded by

    Durhock
    This document discusses beating content-type checks in file uploads. It notes that web applications commonly check the content-type of uploaded files, but an attacker can use a proxy to change the reported content-type to bypass such checks. It then provides details on an intentionally vulnerable online system that can be used to test arbitrary file upload vulnerabilities, including a username and password to log in.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 6

    Web

     Applica+on  Pentes+ng  

    Vivek  Ramachandran  
    SWSE,  SMFE,  SPSE,  SISE,  SLAE,  SGDE  Course  Instructor  

    Cer+fica+ons:                          hGp://www.securitytube-­‐training.com    
     
    Pentester  Academy:    hGp://www.PentesterAcademy.com    

    ©SecurityTube.net  
    Bea+ng  Content-­‐Type  Check  in  File  
    Uploads  

    ©SecurityTube.net  
    Content-­‐Type  Check  

    •  Common  prac+ce  to  check  for  Content-­‐Types    


    –  image/gif    

    •  AGacker  can  use  an  intercep+ng  proxy  and  


    change  the  Content-­‐Type  to  what  is  expected  

    ©SecurityTube.net  
    Arbitrary  File  Upload  Vulnerable  ISO  

    securitytube:123321  

    ©SecurityTube.net  
    Download  

    •  hGps://sourceforge.net/projects/
    arbitraryfileuploados  
    –  user:pass  =  securitytube:123321  

    •  created  by  Ashish  Bhangale  

    •  Bugs  and  Issues:  


    –  ashish@binarysecuritysolu+ons.com    

    ©SecurityTube.net  
    Pentester  Academy  

    ©SecurityTube.net  

    You might also like