+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Uploading a shell on sites error (/showthread.php?tid=6073970)
Uploading a shell on sites error - aNeek - May 2, 2020
So, my friend has tried to upload shells on sites he has permission to upload shells on.
What happens is the image will have embedded PHP code, but when he uploads, the image passes on and is uploaded fine.
But the image is uploaded, he doesn't know what to do as there's no code being executed.
The question is,
is this because the server detected the code? (very bad website, likely wouldnt detect the coode)
Or is something being done wrong
RE: Uploading a shell on sites _error_ - нα¢кєя - May 3, 2020
(May 2, 2020 01:37 PM)aNeek Wrote: So, my friend has tried to upload shells on sites he has permission to upload shells on.
What happens is the image will have embedded PHP code, but when he uploads, the image passes on and is uploaded fine.
But the image is uploaded, he doesn't know what to do as there's no code being executed.
The question is,
is this because the server detected the code? (very bad website, likely wouldnt detect the coode)
Or is something being done wrong
You can't just embed the code in an image without breaking the image.
Servers usually check the extension/mime-type before uploading. Anyway, if the extension is .jpg/png and you have an embedded PHP code it will never execute unless there is a specific backend code on the server that reads the image and you somehow end up breaking into that function.
If after uploading the shell, it shows a 404/500 error that usually means its being picked up by an antivirus/firewall or IDS running on the server.
RE: Uploading a shell on sites _error_ - aNeek - May 3, 2020
(May 3, 2020 09:29 AM)нα¢кєя Wrote: You can't just embed the code in an image without breaking the image.
Servers usually check the extension/mime-type before uploading. Anyway, if the extension is .jpg/png and you have an embedded PHP code it will never execute unless there is a specific backend code on the server that reads the image and you somehow end up breaking into that function.
If after uploading the shell, it shows a 404/500error that usually means its being picked up by an antivirus/firewall or IDS running on the server.
Appreciate the help.