File upload vulnerability: An attacker uploads an executable file to the server through a normal website and executes it. The files uploaded here may be Trojans, viruses, malicious scripts or webshalls, etc. It is the most direct and effective way to attack.
File upload vulnerabilities are:
Upload bypassing JS validation.
The Type in the packet bypasses the upload.
File extensions bypass uploads.
Etc., etc. . . . . . . .
The cause of the file upload vulnerability: the main reason is that the front-end and server filtering is not strict, and the black and white list settings are not perfect. This leads to a file upload vulnerability.
Common file upload vulnerabilities:
Front-end: JS judgment, use burpsuite to modify the filename in the data package, in special cases, JS can be disabled to bypass.
Server side: Use PHP's case obfuscation, PHP.Php, etc. to bypass.
Type: one of the servers, uploading PHP files, the type prompt is application/octet-stream and modify it to image/jpeg