Lab: Web Shell upload via Content-Type Restriction By-Pass

This lab demonstrates the website's lack of proper checks on the file type of the upload and the flaws that arise from implicitly trusting the MIME Type / Content-Type header.

I start the lab by loading up the website and logging in with provided credentials 'wiener:peter' and found a similar set to the previous lab I did for File Upload Vulnerabilities:

 

I tried uploading my basic web shell script for php which I made previously:

I found that there was a restriction on the content type:

So I try again while intercepting the requests and replace the 'Content-Type' header from 'application/x-php' with 'image/png':

And that lets the upload of my web shell go through easily:

Then I reload the account page and capture the request for avatar from the page to server:

I send the request to Repeater for playing around and navigated to the root directory:

From there I replaced my command to `cat` and navigated to the target file in `/home/carlos/`:

And that led me to the requested secret which I submitted to complete the challenge.