HTB Academy - File Upload attacks(Whitelist Filters)

HTB Content Academy
1

Im Stuck on this exercise -

  • The above exercise employs a blacklist and a whitelist test to block unwanted extensions and only allow image extensions. Try to bypass both to upload a PHP script and execute code to read “/flag.txt”

I was able to bypass and upload file

test.php..jpeg , test.php/.jpeg

to /uploads but when accessing it via profile-images/test.jpeg its throwing 404 error , but im able to access this with below URL profile-images/.jpeg not sure why and im not able to execute it

image
image1073×582 136 KB

Any help will be appreciated

2

try running the script that was shown at the end of the section and add more php formats like ‘.phpt’ ‘.pgif’ ‘.phtml’ ‘.phtm’ from the given resources. Use the generated wordlist in burp … and that should give you everything you’d need.

hope it helps!

3

When using Seclist to brute force extensions it is important to test multiple extensions with the php script
Most of them don’t work but .phar could work with specific scripts