+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: DVWA File upload vulnerability (high) (/showthread.php?tid=6050014)
DVWA File upload vulnerability (high) - Infosecstd - Feb 16, 2020
Hello All,
Noob here. I have tried my best to exploit file upload vulnerability with high security (in DVWA 1.9), but unable to exploit this one.
Methods I have tried
1. double extension (ex: shell.php.jpeg)
2. Null byte injection.
Could you please let me know the way to exploit this vulnerability in DVWA1.9 or 1.10.
Thank you in advance!
RE: DVWA File upload vulnerability (high) - compalabee - Feb 16, 2020
(Feb 16, 2020 08:49 AM)Infosecstd Wrote: Hello All,
Noob here. I have tried my best to exploit file upload vulnerability with high security (in DVWA 1.9), but unable to exploit this one.
Methods I have tried
1. double extension (ex: shell.php.jpeg)
2. Null byte injection.
Could you please let me know the way to exploit this vulnerability in DVWA1.9 or 1.10.
Thank you in advance!
I'm more the Mutillidae sandbox person, but this might be able to help somehow:
https://portswigger.net/web-security/xxe/lab-xxe-via-file-upload
You don't use a php shell, instead you stab it with an XML injection straight away, and get results straight from there.