[Infosecstd]

Hello All,

Noob here. I have tried my best to exploit file upload vulnerability with high security (in DVWA 1.9), but unable to exploit this one.  

Methods I have tried

1. double extension (ex: shell.php.jpeg)
2. Null byte injection.

Could you please let me know the way to exploit this vulnerability in DVWA1.9 or 1.10.

Thank you in advance!

[compalabee]

Hello All,

Noob here. I have tried my best to exploit file upload vulnerability with high security (in DVWA 1.9), but unable to exploit this one.  

Methods I have tried

1. double extension (ex: shell.php.jpeg)
2. Null byte injection.

Could you please let me know the way to exploit this vulnerability in DVWA1.9 or 1.10.

Thank you in advance!

I'm more the Mutillidae sandbox person, but this might be able to help somehow:
https://portswigger.net/web-security/xxe...ile-upload

You don't use a php shell, instead you stab it with an XML injection straight away, and get results straight from there.