Tip1: Php injection – use “Knull shell”

It’s a php script, you can get it here https://code.google.com/p/knull-shell or you can unzip it from here. The idea is to try to upload this script and check if you can execute it once it’s on the web app to hack.

Tip2: Upload large amount of content

If there is no validation to the file size or to the number of files to be uploaded and there is not captcha, you can fill the server that handles the web app much more easily. This can be problematic to a hack with continuous upload or just when dealing with a large amount or users.

Tip3: What happens after the upload

Once uploaded a file, you can see the new location of its storage. You can use that URL to guide you to find other stored files that normally you should not be authorized to see.

Tip4: Different type of injection using the filename

Use file names that can cause a malfunction. Even if the upload it’s ok with it, maybe after another processing action (renaming of the file) it can show problems. Example: “ ' or '1'='1' — ';.jpg “

Tip5: Upload files with long names

Tip6: Upload files with special chars

Tip7: Upload files to test the boundaries of size limits

Tip8: Test the format validation

In some cases there is no validation for the file format validation. In other there is only a validation based on file extension. In other the uploaded files are analyzed.

Tip9: Upload the same file multiple times

What happens then? What happens to new file? What happens to old files?

Tip10: Test upload performance

Check the speed of the upload

Tip11: Upload files like “index.php" or “.htaccess”

Tip12: Try to upload if you are logged out or upload for a different user/role