thelightfinder

(In the name of Allah, the most gracious, the most merciful)     بِسْمِ اللَّهِ الرَّحْمَنِ الرَّحِيم This Lab as with the previous labs is quite easy, the difficulty is practitioner-level , so I will make it very brief as most of the concepts are the same. In fact, the only reason I am writing about it is that it has one uncommon feature ( EXIF , at least to most people) otherwise it's pretty straightforward and easy. Task :  This lab contains a vulnerable image upload function. Although it checks the contents of the file to verify that it is a genuine image, it is still possible to upload and execute server-side code. To solve the lab, upload a basic PHP web shell, then use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner. You can log in to your own account using the following credentials: wiener:peter From the task statement, we understand that the content of the file is actually checked to ...

(In the name of Allah, the most gracious, the most merciful)     بِسْمِ اللَّهِ الرَّحْمَنِ الرَّحِيم In this post, we continue with exploiting the labs on file upload vulnerabilities from PortSwigger. Lab 5 is also a practitioner-level difficulty. Task :  This lab contains a vulnerable image upload function. Certain file extensions are blacklisted, but this defense can be bypassed using a classic obfuscation technique. To solve the lab, upload a basic PHP web shell, then use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner. You can log in to your own account using the following credentials: wiener:peter Just like the previous post , we need to upload a web shell and exfiltrate Carlos' secret, but in this case, we are dealing with a filter bypass. Let's play around with the upload request and find out: Above we upload a normal jpeg and we got the following response: The file was uploade...

(In the name of Allah, the most gracious, the most merciful)  بِسْمِ اللَّهِ الرَّحْمَنِ الرَّحِيم   It's been a while I wrote, mostly due to work  and a little bit of laziness. Anyways I recently came across a lab from PortSwigger web security academy that I spent so much time without solving (I was really disappointed with myself when I figured out the solution), so as usual I am writing about it so I don't forget and so it may serve as a reference in the future. The Lab is under the file upload vulnerabilities section, it is tagged as practitioner level difficulty (hence, my disappointment). Task:  This lab contains a vulnerable image upload function. The server is configured to prevent the execution of user-supplied files, but this restriction can be bypassed by exploiting a secondary vulnerability. To solve the lab, upload a basic PHP web shell and use it to exfiltrate the contents of the file /home/Carlos/secret. Submit this secret using the button provided in...