Remember: It is illegal perform any attacks without permission
File Upload Vulnerabilities
Remember: Do not attack any live websites without explicit permission from the server owners.
File Upload Vulnerabilities
This tutorial covers:
DVWA and Security Levels
File Upload Vulnerabilities
Creating Payloads with Weevely
Connecting to Payloads Weevely
Intercepting Requests with Burp Suite
Modifying Requests with Burp Suite
File Upload High Security Challenge
Damn Vulnerable Web App (DVWA)
Damn Vulnerable Web App (DVWA) is a PHP/MySQL
web application that has been built with
vulnerabilities in it
The goal of DVWA is to:
Be an aid for security professionals to test their skills and
tools in a legal environment
Help web developers better understand the processes of
securing web applications
Aid teachers/students to teach/learn web application
security in a class room environment
DVWA Security Levels
The level of security on the DVWA can be
adjusted within the application
When the DVWA Security Level is set, it
changes the PHP code used by the
website
You can see the source code for the
section we will attack on the SQL Injection,
by clicking the “View Source” button
1. Confirm Metasploitable VM IP
Note: You can also do this by
running an nmap scan on
the subnet from the Kali VM
2. Confirm DVWA Security Level is Low
Navigate to
[Link]
Log into the DVWA (admin/password)
Ensure the Security Level is set to “low”
and click Submit
3. Navigate to File Upload
DVWA has sections for us to attack in
different ways
In this tutorial, we will be
concentrating on the “Upload”
section
Navigate to the “Upload” section
4. Reviewing the File Upload Process
Before we begin our attack, it is
important that we review the website
functionality to try and get an idea of
how things are working
To do this, we will upload an image file
by selecting “Browse…” to choose an
image
And then we will click the “Upload”
button to submit the form
Note: The file upload has size
limitations. A suitably sized image has
been provided for you to use on
Canvas, download this image to the
Host PC and copy it to the Kali VM
4. Reviewing the File Upload Process
Upon successful upload of an
image, we get a confirmation
message
This message shows us the file path
of where the uploaded image is
stored on the server (Metasploitable
VM)
You will see that we have “../../”
prefixed to our location, this means
that it is 2 directories back from our
current location
4. Reviewing the File Upload Process
We can now navigate to where the image
is stored, to ensure that it has been
uploaded successfully
To do this, we will open a new tab and
navigate to the appropriate address (2
directories back +
hackable/uploads/[Link])
Remember, your Metasploitable VM IP will
not match that of the image shown, but
should appear something like the URL
below:
[Link]
5. Creating a Payload
Next, we are going to attempt to
upload a Payload to the website – but
first we need to create one.
To do that, we will use a tool called
Weevely
Weevely is a web shell designed for
post-exploitation access, and it allows
us access to a remote shell on the
target web server
While it is mainly geared toward post-
exploitation, we can also use it when
exploiting file upload vulnerabilities
5. Creating a Payload
Creating a payload with weevely is
simple via the terminal
We’re going to create a payload
with the following details:
Filename: [Link]
Password: Password12
Location: /home/kali/Desktop/
To generate the file, we will use the
command shown below:
sudo weevely generate Password12 /home/kali/Desktop/[Link]
5. Creating a Payload
Upon successful creation of the
payload, weevely will provide us
details of what has been generated
It will tell us the location where the
file has been saved, the password,
and the file size
We’re now ready to try uploading it
to the DVWA!
6. Uploading the [Link] file
Switch back to the DVWA File
Upload section
Browse to the [Link] file (which
should be saved on your Kali
desktop), and upload it to the
website
You should receive a message
saying that the [Link] file has
been uploaded to the same
directory as the image we previously
uploaded
7. Verifying the Upload
Next, we will verify that the [Link]
file has been successfully uploaded
to the server (Metasploitable VM)
We will do this by navigating to the
file location as we did previously
The URL this time should look
something similar to the one shown
below:
[Link]
7. Verifying the Upload
You’ll notice that nothing is
displayed (which is good!)
If the file didn’t exist, we would get a
404 HTTP Status Code
Now that we have verified it has
been uploaded, we will now
connect to it using weevely
[Link]
8. Connecting to the Shell with Weevely
Connecting to payloads with Weevely is
simple, as it does all of the heavy lifting for us
We just need to pass in the:
Payload URL
Password set on creation
The connection command should look
something like this:
sudo weevely [Link] Password12
9. Verifying the Connection
After connection, we should get some
output from weevely that verifies we are
connected to the target machine ([+]
Target:)
However, we can also run commands to
verify this:
pwd (print working directory)
id (print user and groups)
uname –a (print system information)
Note: It is common to receive some
notifications related to execution errors
500 being very common as it is a generic
response error stating that the server
encountered an unexpected condition
that prevented it from fulfilling the request
10. Weevely Help – Other Commands
Weevely also has a range of built-in
commands
These allow us to perform a variety of actions
on the target machine, including things like
uploading and downloading files
Use the “help” command to see a full listing
of commands!
11. Intercepting Requests – Burp Suite
To exploit web vulnerabilities, we will usually
have to intercept and manipulate HTTP requests
We're going to use Burp Suite's proxy to intercept
requests before they are sent to the DVWA
Website (on the Metasploitable VM)
We need to do this to modify the request after
the client-side actions have taken place from
the Upload page
Open Burp Suite by clicking: Kali > 03 - Web
Application Analysis > burpsuite (or search for
burpsuite)
Note: Accept any license agreement message
that pops up
11. Intercepting Requests – Burp Suite
Select "Temporary project in
memory" and click "Next"
11. Intercepting Requests – Burp Suite
Select "Use Burp defaults" and click
"Start Burp"
11. Intercepting Requests – Burp Suite
This is the default Burp Suite
page
Select the “Proxy” tab on the
top bar
Note: If at any point when
running Burp Suite you receive
an error where the password for
the Kali Ethical Hacking VM is
not accepted, attempt using
the default Kali password of
"kali"
11. Intercepting Requests – Burp Suite
Before we begin intercepting
requests, we will click the
"Open Browser" button to open
the Burp Suite integrated
browser
This should take you to a Port
Swigger page
Navigate to the the DVWA
app, login and navigate to the
"Upload" section
11. Intercepting Requests – Burp Suite
After navigating to the "Upload" section of
the DVWA, switch back to Burp Suite and turn
on request intercepting by clicking the
"Intercept is off" button
Note: When the button is named "Intercept is
on" and is highlighted (blue by default), then
request interception is active
Burp Suit is now configured so that all requests
from the Burp Browser will be intercepted via
Burp for us to modify
11. Intercepting Requests – Burp Suite
Switch back to the DVWA and upload
the [Link] image file again
After clicking "Upload" the website will
hang, as the request has been
intercepted and held by Burp Suite
Switch back to Burp Suite and you
should see the captured POST request
that submits the "Upload" form
11. Intercepting Requests – Burp Suite
Activate the "Inspector" pane by clicking the
"Inspector" button, located on the right-hand side
of the Burp Suite window
We can use the Inspector pane to see all areas of
the request organised by category, making it
easier for us to modify
In the main body, we can see information such as:
Request type
File information
We can also use the top buttons to:
Forward the request (send it on)
Drop the request (don’t send it on)
12. Setting DVWA Security to Medium
Next, we'll turn Intercepting off on
Burp Suite, as we're going to
navigate to the "DVWA Security"
section of the website, and change
the security level to "medium"
13. Attempting to upload [Link]
We're going to attempt to upload the
[Link] payload file we created
earlier
As the security settings of DVWA are
now higher, we should receive an error
Next, we will switch to Burp Suite and
turn intercept back on
14. Modifying the Request
Then, we will rename the payload file from
[Link] to [Link] and attempt the
upload again
We should now see the intercepted
request in Burp Suite
We will now modify the extension of the
uploaded file within Burp Suite
To do this, find the line that shows the HTML
form-data, and adjust the "filename" value
to "[Link]"
15. Connecting to Shell2 with Weevely
After modifying the extension of the
file, we can click "Forward" to send
the request to the server
We should now see in the Browser a
message telling us that the file has
been successfully uploaded
Attempt to connect to the
uploaded [Link] file in the same
way that we did previously in the
tutorial
sudo weevely [Link] Password12
16. High Security Attempt
We will now set the DVWA Security
settings to high and attempt the
process again
Before you proceed: Adjust the
security level of DVWA to high
Firstly, we will attempt to upload
the [Link] file in the same way
as we have previously, by
adjusting the filename and file
extension intercepted request,
setting it to "[Link]"
This should fail, as the security
settings are higher
17. A Note on Error Messages
You should also note that the error
message displayed to the user
reveals a lot less information than
the error we encountered with the
"medium" security settings
An important thing to remember
when building/securing a system, is
to always consider how much
information we will provide in error
messages to our users - achieving a
balance between security and
usability is always important!
18. High Security Challenge
Challenge: Experiment with
Burp Suite and attempt to
upload and connect to the
payload with the DVWA
security settings set to high
Hint: File extensions are still
important and not as secure
as you think!