+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Bypassing cloudflares image upload? (/showthread.php?tid=5592062)
Bypassing cloudflares image upload? - Skidy - Apr 4, 2017
So, on this website I can upload an image, change the file type to a PHP but if I change the images data at all I get this:
Code
HTTP/1.1 500 Internal Server Error
Date: Tue, 04 Apr 2017 16:44:58 GMT
Content-Type: application/json
Content-Length: 0
Connection: close
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Content-Type-Options: nosniff
Server: cloudflare-nginx
CF-RAY: 34a5bc3a905934e8-LHRIs this a cloudflare issue, WAP or just because it recognises it as a non-valid image file.
* - andmuchmore - Apr 5, 2017
I would try and get the server's real IP and patch your config file to bypass cloudflare.. Alot of peoples cloudflare configs are busted and getting the server's really IP is trivial
* - Skidy - Apr 5, 2017
(Apr 5, 2017 02:42 AM)andmuchmore Wrote: I would try and get the server's real IP and patch your config file to bypass cloudflare.. Alot of peoples cloudflare configs are busted and getting the server's really IP is trivial
I am pentesting a website. This is the last step in my vulnerability to get an RCE.
* - striker111 - Apr 5, 2017
(Apr 5, 2017 03:08 AM)Ripple. Wrote: I am pentesting a website. This is the last step in my vulnerability to get an RCE.
This depends on whether the website has CF's WAF protection or not.
Secondly, either WAF is Enabled or not.
If the security level for website is set to High or UnderAttackMode, You cannot bypass this.