https://hack.com.cy/notes/web/file-uploads/Recent content on Hacking BlogHugoenhttps://hack.com.cy/notes/web/file-uploads/file-uploads/Fri, 15 Aug 2025 00:00:00 +0000https://hack.com.cy/notes/web/file-uploads/file-uploads/<p>Checklist: What framework are we traying to attack. Check where the validation happens (front-end or back-end). Can we bypass blacklist extension filters via capitalization or is there any other extension we can uplaod. Check for the acceptance of double extensions on uploaded files. Can we inject special characters (e.i, %00) null byte inejection on filename. Can we bypass file type restrictions by forging valid magic bytes. If supported by the webserver, can you upload .htaccess files</p>