Hi,
I'm currently doing a pentest on a website (I have the authorizations). I've already find a vulnerability, it's a malicious image upload. I can simply upload a script file by changing the extension (ex: script.js => script.JS.png).
However, I'm stuck to the exploitation step.
I don't know how to execute my JavaScript code embed in the malicious image. My goal is to execute a python script thanks to the JS code or to get a shell.
Can you help me with this, please ?
Technical stack :
- React 16.8 on front-end
- .NET 6 on back-end
- Ubuntu 18.04
- NGINX 1.20
I'm currently doing a pentest on a website (I have the authorizations). I've already find a vulnerability, it's a malicious image upload. I can simply upload a script file by changing the extension (ex: script.js => script.JS.png).
However, I'm stuck to the exploitation step.
I don't know how to execute my JavaScript code embed in the malicious image. My goal is to execute a python script thanks to the JS code or to get a shell.
Can you help me with this, please ?
Technical stack :
- React 16.8 on front-end
- .NET 6 on back-end
- Ubuntu 18.04
- NGINX 1.20