Traffic service & campaign optimization ◆ Spoof Call and Spoof SMS set any caller ◆ ZexoCard: no-KYC virtual crypto cards ◆ Private Crypter - Unique Private Stubs ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › Need help with arbitrary file upload

New Reply 

Need help with arbitrary file upload
crusader.
crusader. Offline
[n00b@HF:]
*
Registered
Posts:
66
Threads:
21
Credibility:
601
Popularity:
2
βytes:
β 0
Game XP:
0
Jan 23, 2020 08:29 PM
So I found this website it has an upload form, its vulnerable as well.

It allows me to Content-type: application/octet-stream and lets me successfully upload my shell.

It doesnt have any filters or anything in place.

Trouble I'm having is, trying to find the upload path.. I viewed the source, used fiddler capture the requests. Anyone please PM me or something and help. Will pay or give something for helping a friendly person out.
Charger
Charger Offline
Not Dead
*****
HF V3ndors
Posts:
13,378
Threads:
716
Credibility:
30700
Popularity:
2,448
βytes:
β 0
Game XP:
1,649
Jan 23, 2020 08:33 PM
You can’t really. Check stuff like /images/ /assets/ etc.

Unless you upload a massive file (or probably 500MB) and cause PHP to throw a move file error
crusader.
crusader. Offline
[n00b@HF:]
*
Registered
Posts:
66
Threads:
21
Credibility:
601
Popularity:
2
βytes:
β 0
Game XP:
0
Jan 23, 2020 08:34 PM
(Jan 23, 2020 08:33 PM)Charger Wrote:  You can’t really. Check stuff like /images/ /assets/ etc.

Unless you upload a massive file (or probably 500MB) and cause PHP to throw a move file _error_

Ahhh I see, I will definitely try stuff like that. Thanks man.
OverLoad
OverLoad Offline
[closed@HF:]
Posts:
110
Threads:
4
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jan 23, 2020 10:09 PM
i agree with " Charger " you can use Dirbuster for this kind of work also it's very helpful
crusader.
crusader. Offline
[n00b@HF:]
*
Registered
Posts:
66
Threads:
21
Credibility:
601
Popularity:
2
βytes:
β 0
Game XP:
0
Jan 23, 2020 10:13 PM
(Jan 23, 2020 10:09 PM)OverLoad Wrote:  i agree with " Charger " you can use Dirbuster for this kind of work also it's very helpful

I tried that, it doesn't pull any dirs
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by OfficeInboxerMar 28, 2021 05:23 AM 3 243 Mar 28, 2021 05:23 AM
Last Post: goratberom
by t3ns4iAug 29, 2020 10:24 AM 1 92 Aug 29, 2020 10:24 AM
Last Post: f1re_w1re
by ｍＯｂｉＩｅDec 19, 2017 03:58 AM 5 429 Dec 19, 2017 03:58 AM
Last Post: t3nd3r