← back to room
File Upload
Extension Filter Bypass
Scenario
CloudSnap rejects uploads unless the filename contains an image extension somewhere. The check scans the whole name string, not the final suffix. Upload a disallowed file type that still passes the naive rule.
Your approach
- Read the upload page rules about permitted extensions.
- Prepare a non-image file whose name embeds an allowed extension.
- Upload through the form and confirm the server accepts it.
- Copy the success flag from the response page.
- Submit that flag.
The validator accepts a file if its name contains an image extension anywhere. Upload something like shell.php.jpg to slip past it.
Sandbox note: uploads are stored in memory and always served back as inert text/plain attachments — nothing is ever executed.
Upload a file
Uploaded files
No files uploaded yet.