The ultimate boss of web hacking! File upload vulnerability attack techniques! Following Part 1, this Part 2 'Chapter 1' training covers more in-depth and advanced techniques.
141 learners
Level Intermediate
Course period Unlimited
Understanding Java File Upload Libraries
Potential security threats to Java file upload libraries
Understanding Web Application Firewalls (WAF)
WAF Bypass Techniques
Understanding diverse environments
Webshell upload attack methods in various environments
Today, there are various ways to learn web hacking. Online lecture platforms like Inflearn, academies where you can take offline classes, and search engines—most of these common paths tend to focus on general content. However, this course is different. I proudly say it contains 'content you won't find anywhere else'!
The source code below is known to be safe from file upload vulnerabilities. But is it really secure?
...
String path = request.getRealPath("/upload");
MultipartRequest multi = new MultipartRequest(request, path, 1024*10*10, "UTF-8");
Enumeration formNames = multi.getFileNames();
while(formNames.hasMoreElements()) {
String param = (String)formNames.nextElement();
String uploadFile = multi.getFilesystemName(param);
int extOffset = uploadFile.lastIndexOf(".");
String fileExt = uploadFile.substring(extOffset+1).toLowerCase();
if (!fileExt.equals("jpg") && !fileExt.equals("png") && !fileExt.equals("gif")) {
File fp = new File(path, uploadFile);
fp.delete();
out.println(“<script>alert(‘Invalid extension’);history.back(-1);</script>");
return;
}
}
...No. This source code is 'vulnerable source code'.
The reason why this code is vulnerable and the attack methods against it are covered in detail in the Part 2-1 lecture.
Understanding Cases by File Upload Library
We analyze each file upload library and cover potential security threats that may arise, as well as various cases.
Methodologies and Practices Based on Security Threats
We will examine potential security threats for various cases and conduct hands-on attack exercises.
Web Application Firewall (WAF) Bypass Technique Case Study
We will explore various web firewall bypass techniques and conduct hands-on practice for those attack methods.
We will cover directory parsing vulnerabilities found in JEUS and WebSphere in detail, examining the attack methodology of why these vulnerabilities are threatening today and how they can be exploited. (IBM WebSphere CVE-2020-4163)
We will take a detailed look at various other environments and cases.
'File Upload Vulnerability Part 2' consists of three lectures designed to help you succeed in file upload vulnerability attacks across various environments. However, this is not a course that simply provides the answers. Taking this course does not guarantee success in file upload vulnerability attacks in every single environment.
The goal of this lecture is not to provide the right answers, but to be a lecture that broadens your perspective. By learning that vulnerabilities can occur in various environments, you will gain the realization of "Ah, I can try it this way too!" Furthermore, you will be able to analyze future assessments while 'knowing' that diverse environments exist. There is a world of difference between analyzing with this knowledge and analyzing without it.
I hope this lecture helps you clearly refine your perspective on web hacking and lay the foundation to elevate your skills to a higher level!
Q. Is there any knowledge I should have before taking the course?
You must have an understanding of 'File Upload Vulnerabilities.' Additionally, you should be familiar with the content covered in Part 1 to smoothly follow Part 2. Of course, if you already have a high level of understanding regarding 'File Upload Vulnerabilities,' you should have no problem taking the course.
Q. Who is the target audience for this course?
I recommend that "practitioners" take this course if possible. Alternatively, those who have sufficiently studied web hacking theory or job seekers can also take the course.
Q. 'File Upload Vulnerability Attack Part 1' Is it mandatory to take this course?
I recommend taking the course. Even if you have an understanding of file upload vulnerabilities, there may be parts of Part 2 that are difficult to follow without a foundation in Part 1. Therefore, even for working professionals, I recommend taking Part 1 first before proceeding to Part 2.
Q. Part 2 is divided into 3 parts; do I need to take all of them?
You do not necessarily have to take all three parts. However, if you want to learn attack methodologies for various practical environments, I "highly" recommend taking all three.
Q. Do I need to take Part 2 in the order of the three volumes?
You don't necessarily have to do that; you can start with the topics you're most interested in. However, since the three parts were produced in order, I believe it would be better for the overall flow to take them sequentially.
It is recommended that you take this course with a prior understanding of web technology and web hacking. Additionally, we suggest taking the "File Download Vulnerability Attack" and "File Upload Vulnerability Attack Part 1" courses from CreHactive's web hacking lecture series first.
Who is this course right for?
Practitioners currently performing penetration testing or vulnerability assessment in the field
Job seeker
Need to know before starting?
Web Technology
Web Hacking Basics
File Download Vulnerability Knowledge
File Upload Vulnerability Knowledge
28,008
Learners
1,602
Reviews
509
Answers
4.9
Rating
18
Courses
Hello, this is CreeHacktive.
Based on my years of experience diagnosing and researching various web services, I have been sharing practical, job-ready knowledge through the Inflearn platform.
I also authored Crehacktive's All-in-One Web Hacking Bible, which systematically covers the basics of web hacking. For those who lack foundational knowledge, I recommend starting your studies with this book.
Email : crehacktive3@naver.com
All
72 lectures ∙ (6hr 10min)
Course Materials:
All
14 reviews
4.9
14 reviews
Reviews 21
∙
Average Rating 4.8
Reviews 5
∙
Average Rating 5.0
Reviews 6
∙
Average Rating 5.0
Reviews 5
∙
Average Rating 5.0
Reviews 8
∙
Average Rating 4.4
Check out other courses by the instructor!
Explore other courses in the same field!
25% off for new members
$64.70
25%
$84.70
![[Eduwill White Hacker] Game HackingCourse Thumbnail](https://cdn.inflearn.com/public/courses/329746/cover/6e390196-7c19-4a64-88db-69745dd95ccd/329746-eng-original.png?w=420)
