Skip to main content

How to Approach Web Application Vulnerability Assessment using Burp Community | Part - 3 | Audit Guidelines | High Impact Web Vulnerability | RCE

Web application file upload RCE are very common and multiple bypasses for the existing mitigations are available. In this part-3 of blog series of how to check the web application vulnerability with Burp Community Edition, I will cover one of the bypass technique. This blog will be very helpful while performing the web application security assessment( VAPT) manually. In this part of the blog, we will cover a file upload vulnerability with High impact severity. Please refer the audit guidelines below


Audit Guideline

Concept- Linux has a file name restriction of 255 characters/bytes. If you attempt to create a file that has more than 255 characters in its name, then it will truncate the characters after that 255 characters. So now we have to upload a file named like this:

fffffffffff......fffffffffff.php.jpeg


where the length of green highlighted part is exactly 255. Uploading this would bypass the extension restriction at the client and server end, but when storing the file at server, that .jpeg will get removed from file name, leaving behind a .php shell file uploaded successfully.




[Disclaimer - For Education Purpose - Case study, attacks' scenarios and audit guidelines on vulnerabilities]

Security blog of the month

How 13 Bytes Freeze Google Perfetto: An Integer-Overflow DoS Behind Billions of Devices

Here's a fun one. I found a way to make a tiny file - just 13 bytes , smaller than this sentence - completely freeze one of Google's most widely used engineering tools. Not crash it with a bang. Freeze it. Pin a CPU core at 100% and make it spin forever, going nowhere, until you kill it. The tool is called Perfetto , and once you understand where it lives, this stops being a curiosity and starts being a genuinely useful lesson about how software breaks - one that's worth reading whether you write code, run a security team, or sign the budget. Let me walk you through it in plain English. First, what is Perfetto - and why should you care? Most people have never heard of Perfetto, yet it quietly runs near a staggering number of devices. Perfetto is Google's open-source system tracing toolkit. Think of it as a flight recorder for software: it captures a detailed, timestamped record of everything a device is doing - which app woke up, which function ran, where t...
Post a Comment
Read more