Home Web Exploitation File Upload to Web Shell
medium Live now Web

File Upload to Web Shell

An upload that doesn't validate file type or content is remote code execution waiting to happen. Drill bypassing the filter and landing a web shell.

Probe what the upload accepts — extension, MIME type, magic bytes — and find the gap. A double extension, an allowed-but-executable type, or content-type spoofing often slips a script through.

Once your file lands in a web-accessible path, request it to execute and run commands as the web user. Variants change the filter so you adapt the bypass instead of reusing one trick.

How the attack works

  1. Upload a benign file and note the stored path and any filter messages.
  2. Try a server-executable payload, bypassing the filter with a double extension or MIME spoof. shell.php.jpg (Content-Type: image/jpeg)
  3. Browse to the uploaded file to trigger execution. curl 'http://target/uploads/shell.php?c=id'
  4. Run a command to read the flag.

On PwnKata the binary, account, and paths change every rep — so you drill the recognition, not this exact command.

What you'll practice

file uploadweb shell

Sourced from

drill workspace · session live
medium

File Upload to Web Shell

An upload that doesn't validate file type or content is remote code execution waiting to happen. Drill bypassing the filter and landing a web shell.

Objective

Recover the flag at /root/flag.txt and submit it.

Drill this now

Spin up a live isolated target and start practicing in seconds — free.

Start drilling