Apprentice
← all rooms
File Upload Medium

File Upload

Bypass weak upload validators. Files stay inert — prove the bypass.

Mission briefing

CloudSnap provides avatar and document uploads for a social network. The service tries to accept only images, using checks on filenames and headers. See if you can upload something the server would reject if validation were sound.

0 / 2 tasks 0 / 20 pts

Objectives

  • Bypass the extension-in-name check
  • Bypass the Content-Type check
Task 1 Extension Filter Bypass Medium 10 pts

Scenario

CloudSnap rejects uploads unless the filename contains an image extension somewhere. The check scans the whole name string, not the final suffix. Upload a disallowed file type that still passes the naive rule.

Your approach

  1. Read the upload page rules about permitted extensions.
  2. Prepare a non-image file whose name embeds an allowed extension.
  3. Upload through the form and confirm the server accepts it.
  4. Copy the success flag from the response page.
  5. Submit that flag.

The name only needs to contain an image extension somewhere.

Open lab →
Hint

shell.php.jpg is enough for the flawed check.

Task 2 Content-Type Bypass Medium 10 pts

Scenario

A second upload endpoint trusts the Content-Type header sent by the browser. The server never inspects magic bytes. Upload arbitrary content while advertising it as an image.

Your approach

  1. Select any small file for upload in the lab form.
  2. Intercept the multipart request and set Content-Type to image/jpeg.
  3. Forward the modified request and check for acceptance.
  4. Retrieve the flag from the success banner.
  5. Submit the flag as your answer.

Validation trusts the client Content-Type header.

Open lab →
Hint

Use Burp to set Content-Type: image/jpeg on any file.