> For the complete documentation index, see [llms.txt](https://yasmeen-rezk.gitbook.io/my-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yasmeen-rezk.gitbook.io/my-notes/bug-bounty-playbook-v2/basic-hacking/owasp/file-upload.md).
# File Upload
Web applications sometimes let users upload file files to their site in the form of a profile picture, PDF upload functionality, etc.
* If done improperly attackers can upload malicious files potentially gaining RCE.
* If an application does not have any restrictions to which file type can be uploaded, an attacker could upload a PHP script and if it's in the web directory we can navigate to it and it will execute.
### Simple cmd backdoor
PHP
```php
";
$cmd = ($_REQUEST['cmd']);
system($cmd);
echo "";
die;
}
?>
```
ASPX
```csharp
<%@ Page Language="C#" Debug="true" Trace="false" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
awen asp.net webshell
```
#### EX: Vulnerable upload function leads to upload of PHP web shell successfully:
* Once uploaded, navigate to the backdoor and execute any shell command (whoami):
Successfully uploaded gaining RCE.
### Content Type Bypass
The server validates the content of the file by checking the **MIME type** of the file, which can be found in the HTTP request.
If the server trusts the content-type in the HTTP request an attacker could change its value to pass the validation.
EX: Content-Type: application/x-php:
* bypass --> Content-Type: image/jpeg
### File Name Bypass
When the server checks the file name to see if it is **blacklisted** or **whitelisted**.
* developers use a regex to check the file extension:
Regex for balcklisteed extensions
Here, bypass the regex validation by changing the extension to “phpt” and “phtml”.
