Analysis of File Upload Vulnerability Attack Techniques and Practical Cases by a Simulated Hacking Practitioner: PART 1

3. Install Tomcat and change the Burp Suite service port

5. [Added] How to intercept only the desired requests and responses in Buffsuite and save the settings

6. What is a File Upload Vulnerability?

8. Best Partner! File Download Vulnerability

9. Attack Principle Analysis

10. Current status of file upload vulnerability attacks in the field

12. File upload function and file download function

13. File upload function structure

14. [Practice 2-1] Understanding PHP-based file upload functions through direct production

15. [Practice 2-2] Understanding JSP-based file upload functions through direct production

16. [Practice 2-3] Understanding the multi-part format through practice

18. Web shell, a key tool in file upload attacks

19. Types of web shells

20. Five things to keep in mind when using web shells during practical diagnosis

21. Web shell detection solution to block web shells

22. Language-specific system functions

23. [Practice 3-1] PHP-based web shell creation Step 1: Creating a simple web shell

24. [Practice 3-2] PHP-based web shell creation step 2: Adding authentication function

25. [Practice 3-3] JSP-based web shell creation step 1: Creating a simple web shell

26. [Practice 3-4] JSP-based web shell creation step 2: Adding authentication function

27. Analysis of the Web Shell Operation Principle

28. Bypass technique when web shell command request is blocked by section security solution

29. [Practice 3-5] PHP-based web shell creation step 3: Adding functions to bypass section security solutions

30. [Practice 3-6] JSP-based web shell creation step 3: Adding functions to bypass section security solutions

31. Skill up! Congratulations!

32. Attack Process

33. Attack Target Detection

34. Attack Target Exploration CASE(1)

35. Attack Target Exploration CASE (2)

36. [Practice 4-1] Practice deploying WAR through Tomcat Manager

37. Environmental Analysis

38. Basic logic analysis

39. Deep logic analysis

40. Bypassing validation logic - Types of validation logic

41. Extension Verification (1)

42. [Practice 4-2] Extension Verification Method Analysis Method

43. Extension Verification (2)

44. [Practice 4-3] Practice of bypassing extension verification logic by using unverified extensions

45. [Practice 4-4] Understanding server-side scripts in the JSPX extension

46. Extension Verification (3)

47. [Practice 4-5] Practice of exploiting security flaws due to extension verification logic design errors

48. Extension Verification (4)

49. [Practice 4-6] Practice of verification logic bypass technique in various environments using Null Byte characters

50. [Practice 4-7] Correct understanding of Null Byte character insertion attack

51. [Practice 4-8] Applying secure coding to prevent null byte character insertion attacks

52. Extension Verification (5)

53. Extension Verification (6)

54. [Practice 4-9] Practice of exploiting WAS vulnerabilities (1) and applying secure coding

55. Extension Verification (7)

56. [Practice 4-10] Practice of exploiting WAS vulnerabilities (2) and applying secure coding

57. Extension Verification (8)

58. [Practice 4-11] Practice of exploiting WAS vulnerabilities (3) and applying security settings

59. Image Verification (1)

60. [Practice 4-12] Building an image upload environment

61. Image Verification (2)

62. [Practice 4-13] Image Verification Bypass Practice (1)

63. Image Verification (3)

64. [Practice 4-14] Image Verification Bypass Practice (2)

65. Image Verification (3)

66. [Practice 4-15] Image Verification Bypass Practice (3)

67. Image Verification Response Measures

68. File size verification

69. [Practice 4-16] Bypassing file size verification and practicing the eval function

70. Finish bypassing the verification logic

71. Secrets of File Upload Vulnerability Attack Techniques

72. Advanced Logic Analysis (1-1)

73. Advanced Logic Analysis (1-2)

74. Advanced Logic Analysis (1-3)

75. Advanced Logic Analysis (1-4)

76. Advanced Logic Analysis (1-5)

77. Advanced Logic Analysis (1-6)

78. Advanced Logic Analysis (2-1)

79. Advanced Logic Analysis (2-2)

80. Advanced Logic Analysis (2-3)

81. Advanced Logic Analysis (2-4)

82. Advanced Logic Analysis (2-5)

83. [Practice 4-17] Building a practice environment

84. [Practice 4-18] File upload vulnerability attack practice-1

85. [Practice 4-19] File upload vulnerability attack practice-2

86. [Practice 4-20] File upload vulnerability attack practice-3

87. [Practice 4-21] File upload vulnerability attack practice-4

88. [Practice 4-22] File upload vulnerability attack practice-5

89. [Practice 4-23] File upload vulnerability attack practice-6

90. Webshell upload success and the start of another journey

91. Real-world attack scenario using file upload attack

92. File upload attack finished

93. Case study analysis and environment construction

94. [Practice 5-1] Practical Case Analysis-1

95. [Practice 5-2] Practical Case Analysis-2

96. [Practice 5-3] Practical Case Analysis-3

97. [Practice 5-4] Practical Case Analysis-4

98. [Practice 5-5] Practical Case Analysis-5

99. [Practice 5-6] Practical Case Analysis-6

100. [Practice 5-7] Practical Case Analysis-7

101. [Practice 5-8] Practical Case Analysis-8

102. [Practice 5-9] Practical Case Analysis-9

103. [Practice 5-10] Practical Case Analysis-10

104. [Practice 5-11] Practical Case Analysis-11

105. [Practice 5-12] Practical Case Analysis-12

106. Causes of vulnerability occurrence and responses

107. Detailed response plan-1

108. Detailed response plan-2

109. [Practice 5-1] Secure coding application for PHP-based file upload function

110. [Practice 5-2] Application of secure coding to JSP-based file upload function

111. Finishing my education...