Analysis and Utilization of 23 medium level upload vulnerabilities in DVWA Series

Let's analyze the code at the medium level:

Here, the MIME type and file size of the uploaded file are obtained through "$_ FILES ['uploaded'] [' type']" and "$_ FILES ['uploaded'] [' size']", respectively.

The MIME type is used to set how a file with an extension is opened. When a file with that extension is accessed, the browser will automatically open it using the specified application, such as the MIME of a jpg image is p_w_picpath/jpeg.

Therefore, the main difference between medium and low is to judge the MIME type and file size of the file, so that only picture files in jpg format are allowed to be uploaded.

But this limitation can be easily bypassed through Burpsuite. First select the php*** file to be uploaded

Then start Burpsuite, click the upload button at this time, and the uploaded file will be intercepted by Burpsuite. Right-click in the Proxy and select "Send to Repeater" to send the intercepted packet to the Repeater module.

Change "Content-Type" to "p_w_picpath/jpeg" in the left window of Repeater, then click Go to send the modified packet, and you will see a prompt for successful upload in the return packet in the right window.