Additionally, more specific attacks on server side parsers are used as an attack vector, for example Server Side Request Forgery (SSRF) through m3u8 playlist file formats being parsed with LibAv.įile uploads on websites are an underestimated area for security testing. The attack techniques include generic attacks such as Cross Site Scripting (XSS), External Entity Injection (XXE) and PHP/JSP/ASP code injection, but the goal is to execute these attacks customised for the use case of HTTP based file uploads. One of the goals of this research was to generalise and automate these attacks. In other cases, the techniques only apply to very specific use cases. While a lot of techniques used for file upload testing are documented throughout the web, the code necessary to automate such attacks is often missing.
However, most automated web application security scanners are not adapting their attacks when encountering file uploads and are therefore likely to miss vulnerabilities related to file upload functionalities. HTTP based file uploads are one specialised use case.
Various automated and semi-automated security testing tools exist to simplify the task. Testing web applications is a standard task for every security analyst.
FlexiInjector - Detecting requests with uploads.I broke the website, omg, what did I do?.A Burp Suite Pro extension to do security tests for HTTP file uploads.
0 kommentar(er)
