Upload abuse starts from any feature that writes attacker-supplied bytes to disk: avatars, document attachments, import wizards, profile backgrounds.
The prize is control over three properties of the stored file: its name and extension (so the server executes it), its declared and real content (so it passes type checks yet still runs), and its destination path (so it lands where it is served or where it overwrites something important). Unrestricted upload chains those first two to drop a web shell into a web-served directory and then requests it. Archive extraction (Zip Slip) attacks the third: entry names inside a crafted archive escape the unpack directory to write wherever the process can, overwriting assets, binaries, or configuration. Both routes commonly end in remote code execution.
Pages#
- Unrestricted upload: Defeating extension, Content-Type, and magic-byte checks to store an executable script in a web-served path, then requesting it for remote code execution.
- Zip Slip: Archive entries with traversal sequences or absolute paths write outside the unpack directory during extraction, overwriting web assets or binaries and plant...
Tools#
- Burp Suite: Intruder for fuzzing extensions, Content-Type, and magic bytes.
- exiftool: embed payloads in image metadata to build polyglots.