8.4 Lab: Web shell upload via extension blacklist bypass - Karthikeyan Nagaraj | 2024
A Simple writeup is Posted on Medium - / cyberw1ng
This lab contains a vulnerable image upload function. Certain file extensions are blacklisted, but this defense can be bypassed due to a fundamental flaw in the configuration of this blacklist.
To solve the lab, upload a basic PHP web shell, then use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner.
You can log in to your own account using the following credentials: wiener:peter
#cybersecurity #walkthrough #career search for: cyber wing, cyberwing, cyberw1ng, karthikeyan nagaraj