Cyber Security Blog

1. Objective Find the password for natas level 13. 2. Introduction The first thing we see is a form that gives us the ability to upload 'JPEG' images.    Unlike the previous level, we get a message informing us that they will only be accepting image files. This hints to the fact that measures have been put in place to prevent us from uploading php files. Let's  see if this measures are sufficient 3. Exploration Let's use the 'View source code' button to check what clues we can find there. The process that takes place on the server. A file name is generated before the page is served to the user The filename is stored in a hidden field called filename When a user uploads a file, the server checks if the filename field is present It prepares for the file to be saved in the upload folder Check if the size of the file is greater than 1000 bytes Reject the fil...

  1. Objective Find the password for natas level 13. 2. Introduction The first thing we see is a form that gives us the ability to upload 'JPEG' images.    If proper checks have not been put in place to validate the uploaded file, it is highly likely that we may have a File Upload Vulnerability.  A File Upload Vulnerability is a security issue that arises when proper checks are not implemented to validate uploaded files. In this level, we explore the possibility of exploiting such a vulnerability. 3. Exploration Let's use the 'View source code' button to check what clues we can find there. The process that takes place on the server. A file name is generated before the page is served to the user The filename is stored in a hidden field called filename When a user uploads a file, the server checks if the filename field is present It prepares for the file to be saved in the ...