Summary
Member-only story In this post, I will try to guide you through an example of the type of vulnerabilities you may encounter when performing a pentest. In this case, I managed to compromise a web application through a file upload and then execute remote code. Analyzing the application As part of the process I was provided with credentials for the application as a normal user. Upon logging in, I started by browsing through all the pages and examining the functionality of the app. After clicking on several pages of the site, I looked at a page that allowed me to upload a document. Nowhere does the application indicate what type of files can be uploaded, the first thing that came to mind was uploading an svg image with an xss payload. When I go to the image I see that it executes the xss. Validation Now I knew that the upload file worked, but I still wanted to see what Burp Suite showed me. When reviewing the request in Burp Suite, notice that the…