webPromedium

Lab 165 — ReplyStream — File Upload Bypass via Content-Type Validation

hackadvisor

Task: Customer support platform with file upload functionality that validates files based on Content-Type header only. Solution: Bypass validation by spoofing MIME type in multipart/form-data request to upload PHP webshell and achieve RCE.

$ ls tags/ techniques/
rcephpfile_uploadwebshellnginxmime_typecontent_type_bypass
php_webshell_uploadcontent_type_header_manipulationmime_type_spoofing
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups