How To Bypass Website File Upload Restrictions

00:00 NahamConCTF Byepass
01:46 NahamConCTF 2022
02:53 Challenge Begin
08:10 Source Code
12:34 Alh4zr3d's Tweet
12:44 Byepassing the deny list
19:16 Final Thoughts

Help the channel grow with a Like, Comment, & Subscribe!
Check out the affiliates below for more free or discounted learning!

📧Contact me! (I may be very slow to respond or completely unable to)

[duckydev]

The actual flaw in the source is that the developer missed the upload going to a seperate folder, placing the uploads in the root allowing for the .htaccess overwrite. If the developer made the uploads go to the correct folder, this vulnerability would not work. Great video!!

[smbsid]

Wow, this is crazy, I missed this tip from Alh4zr3d. Thanks John for bringing this live with the CTF challenge.

[AJ-ZR]

I solved this using a null byte (evil.php%00.jpg)

[PBromide]

And here I thought you were going to sneak something into an image file! But the trick with the .htaccess was unexpected and interesting anyway. Thank you for uploading!

[jaromir_hodan]

Well, thanks! You just saved me. I checked my apps and in one of them I forgot to make allow list for uploads. Luckily frontend saved me and no one tried to upload some disallowed stuff :D

[this_is_elvis]

This is very good, thanks.
Learning every day with your channel. Keep up with the good work ✌️

[TechnologyInterpretersInc]

Dude your content and production quality just get better and better! Excited for the video.

[BenjaminEggerstedt]

Nice learning, thank you for sharing and putting this together!

[nathanbolen]

awesome video, love this type of content as i am aspiring to be a Web App PenTester and it was cool seeing this and beign able to understand what ws going on

[ermilburn]

As soon as you mentioned changing the configuration, I thought of htaccess. A project I worked on was using it to redirect certain requests to a cdn, to avoid changing the JavaScript code

[fer.barrios]

I've seen this on a Ippsec video a few months ago too. Great content as always! 🙌

[P-G-]

When I watch these very interesting videos, I am "ecstatic" to see how logic, interpretation, deduction is so accessible for solving these problems... and I noticed that some problems are brilliant, very well but, but in the end all problems solved.

[CyberAbyss]

Thank you! Appreciate everything you share!

[rodriquh]

That was pretty slick, nice job John!

[supernenechi]

Thanks for that! I'll keep that in mind!

[TechViking]

John I just wanted to take a moment to tell you how much I admire your technical skills and intelligence. You are truly a standout in your field and have a natural talent for understanding complex systems and finding innovative solutions.

[jamesrobertson]

Nice trick ! Incredible video and explanation, thanks for yet another very useful upload.

[vincentsvlog]

One of my favorite YouTube channels all time!

[TheIvalen]

That was an impressive presentation. I like that gimmick, appreciate the walkthrough.

[redjhone]

Thank you for the great content. your the best ever jhon