File Upload Security Testing Checklists

 

Security Checklist

  1. Are filenames reflected back on the page? If so, are they HTML Entity encoded (XSS via file names)?

  2. Does it accept .zip files? Try a ZipSlip

  3. If it processes an image, check for Image Tragick (CVE-2016-3714)

  4. Can you bypass file type restrictions by changing the content-type value?

  5. Can you bypass file type restrictions by forging valid magic bytes?

  6. Can you upload a file with a less-common extension (such as .phtml)?

  7. Try playing with the filename in the request, a potential vector for traversal or SQL injection.

  8. Check for the acceptance of double extensions on uploaded files.

  9. Test for null-byte injection.

  10. Is the server windows? Try adding a trailing . to bypass extension blacklists, this dot will be removed automatically by the OS.

  11. Can you upload an SVG for XSS?

  12. If supported by the webserver, can you upload .htaccess files?

  13. Does the backend process the image with the PHP GD library?

  14. Is the app vulnerable to the infamous ffmpeg exploit?

  15. Can custom polyglots be developed to bypass specific filters?

  16. Does the app pass the file name to some sort of system function? If so, can you achieve RCE via code injection within the file name?

  17. Does the application run the uploaded file through exiftool? If so, can you get RCE via the djvu exploit?

  18. Can you bypass extension filters by using varied capitalization?

Comments

Post a Comment

Popular posts from this blog

SAML Security Test Cases

Signature Exclusion Attack -Test whether or not the SP accepts an Assertion without a Signature  Signature Spoofing attack -Test whether SP accepts fake signature or using previously generated/invalid signature Signature Wrapping Attack (8 Different Ways)-Test whether or not the SP is susceptible to Signature Wrapping XML Injection -Test if can inject malicious code into the SAML response from IDP, allowing them to execute arbitrary code on the SP server. XML Entity Expansion (XEE)/XXE -Test whether or not the SP is vulnerable to XML External Entities Replay attacks -Test if previously generated SAML response from IDP can be accepted by SP Certificate Faking/Self signed certificate -Test whether or not the SP verifies that the Assertion came from a trusted IDP/Test if SP accepts self-signed certificate XSLT Injection -Test whether or not the SP is vulnerable to XSLT Predictable signature -Test whether IDP generating guessable signature SAML message expiration -Test whether SP accepts
Read more

Drozer - A Framework for Android Application Security Assessment.

Image
1.             Introduction 1.1   This document explains how to get started with Drozer, and how to use it to perform a security assessment of an android application. 1.1.      Drozer Drozer is a python based comprehensive security audit and attack framework for Android. It is an open-source framework, used for android pen-testing. It works like a client-server model and makes use of Android’s Inter-Process Communication (IPC) mechanism to interact with the underlying operating system of the device. IPC is a mechanism by which different components of android like intents and data binders communicate with each other so that the communication is established between the apps present in the android device. Drozer helps to remotely exploit android devices with predefined and custom modules that exploit known vulnerabilities. 1.2.      Conventions used Throughout this document, command-line examples will use one of two prefixes: dz> indicates that the command shou
Read more