Common web Vulnerabilities

Common Web vulnerabilities-File Upload vulnerability

First, file Upload vulnerability overview
File Upload vulnerability refers to the user uploading an executable script file, and through this script file to obtain the ability to execute server-side commands. This type of attack is most straightforward and effective, sometimes with little technical barriers.

< Span style= "FONT-SIZE:18PX;" >    "File upload" itself is not a problem, the problem is the file upload, the server How to process, explain the file. If the server's processing logic is not secure enough, it can lead to serious consequences.
1) The upload file is the Web scripting language, and the server's Web container interprets and executes the user-uploaded script. Causes code execution.
2) The upload file is Flash's policy file crossdomain.xml, which is used by hackers to control the behavior of Flash under the domain (other similar control of the policy file);
3) Upload files are viruses, trojan files, hackers used to trick users or administrators to download the execution.
4) The upload file is a phishing image or an image containing a script that is executed as a script in some versions of the browser and used for phishing and fraud.

In addition, there are some unusual use methods, such as uploading files as a portal, overflow server background processing program, slice parsing module, or upload a legitimate text file containing PHP script, and then through the "Local file contains the vulnerability" Execute this script, and so on. This type of problem is no longer detailed.
In most cases, file upload vulnerabilities generally refer to the issue of "uploading web scripts to be parsed by the server," which is often said to be webshell. To complete this attack, the following conditions are met:
First, the uploaded file can be interpreted and executed by the Web container. So the directory where the file is uploaded is the path that the Web container overwrites.
Second, the user is able to access the file from the Web. If the file is uploaded, but the user cannot access it through the web, or cannot get the Web container to interpret the script, it is not a vulnerability.
Finally, the user uploads the file if the security checks, formatting, image compression and other functions to change the content, it may also lead to unsuccessful attacks.

Common web Vulnerabilities