File Upload

Content-Type Bypass

Scenario

A second upload endpoint trusts the Content-Type header sent by the browser. The server never inspects magic bytes. Upload arbitrary content while advertising it as an image.

Your approach

Select any small file for upload in the lab form.
Intercept the multipart request and set Content-Type to image/jpeg.
Forward the modified request and check for acceptance.
Retrieve the flag from the success banner.
Submit the flag as your answer.

The validator trusts the request's Content-Type header. Upload any file but set its Content-Type to image/jpeg (e.g. via Burp) to bypass the check.

Sandbox note: uploads are stored in memory and always served back as inert text/plain attachments — nothing is ever executed.

Upload a file

Uploaded files

No files uploaded yet.