Testing playbook · intermediate
File Upload to RCE
Turn a file upload into code execution by defeating type/extension checks.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Map the upload + retrieval
Find where the file lands and whether it's web-accessible. No exec path? Look for secondary sinks (image processing, archive extraction).
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Bypass extension filters
Try double extensions (.php.jpg), alternate handlers (.phtml, .php5), case tricks, null bytes on legacy stacks, and .htaccess overrides.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Bypass content checks
Spoof Content-Type, prepend valid magic bytes (GIF89a;), or embed code in EXIF/polyglots to pass MIME/image validation.
exiftool -Comment='<?php system($_GET[c]); ?>' shell.jpgexiftool · unmapped
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Chain the exotic
SVG → stored XSS/XXE, ZIP → path traversal (zip-slip), image libs → ImageMagick/Ghostscript RCE.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- If uploads aren't executable, pivot: SVG/HTML for XSS, or overwrite files via traversal in the filename.
- Test what the CDN/origin does with unknown extensions - behavior often differs.
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.