Demonstration

 

Demonstration Based on an Existing Video (PortSwigger / File Upload)

Introduction

To demonstrate how file upload vulnerabilities can be exploited in real-world scenarios, I analyzed an educational demonstration from YouTube titled “File Upload Vulnerabilities – Unrestricted File Upload | Web Security” uploaded by HMCyberAcademy. The video clearly shows how attackers use a simple upload form to execute malicious code on a server.

This demonstration aligns with the concept of unrestricted file uploads, where a server accepts dangerous file types such as PHP scripts without proper validation.

src: gen AI

1. Overview of the Demonstration

The video walks through a practical exploitation scenario using a vulnerable web application. It focuses on how an attacker can upload a malicious file (such as a .php shell script) and gain remote access to the server.

The demonstration environment resembles PortSwigger's Web Security Academy labs, which simulate real-world vulnerabilities in a safe, controlled manner.

2. Steps Shown in the Video

The video demonstration covers the following steps:

Step 1 — Finding the File Upload Form

The attacker identifies a feedback form or profile page containing an upload field labeled “Upload Avatar” or similar.

Step 2 — Preparing a Malicious PHP Payload

The attacker creates a .php file containing code such as:

<?php echo "Shell executed"; system($_GET['cmd']); ?>

This type of file allows the attacker to run operating system commands remotely.

Step 3 — Uploading the Malicious File

Since the server does not validate file types or sanitize names, the .php file is accepted without restriction.

Step 4 — Locating the Uploaded File

The attacker checks the upload directory, commonly something like:

/files/uploads/

or

/images/avatars/

Step 5 — Executing the Malicious Script

Once the attacker accesses the uploaded file through a browser, the server executes it — resulting in:

✔ Command execution
✔ Server user information reveal
✔ Potential full compromise

This demonstrates the severity of insecure file handling.

3. Why the Attack Works

The video emphasizes these weaknesses:

• No file type validation

• No MIME type verification

• Uploads stored inside web-accessible directory

• Executable file extensions allowed (.php, .jsp, .asp)

• No rewriting or renaming of uploaded files

Because the server executes the file directly, the attacker obtains remote code execution (RCE).

4. Security Lessons from the Video

The demonstration highlights the importance of:

✔ Enforcing strict file type whitelists

✔ Verifying file content server-side

✔ Storing uploads outside the web root

✔ Disabling script execution in upload folders

✔ Renaming files to remove dangerous extensions

✔ Applying malware scanning and content filtering

These best practices significantly reduce the risk of exploitation.

5. Video Used in This Demonstration

src: https://youtu.be/Hf9KlCGeJNE

6. Conclusion

This demonstration clearly shows how a simple file upload form can lead to full server compromise if not secured properly. The video provides a practical, easy-to-understand example of unrestricted file upload exploitation and reinforces the need for strong validation, safe storage, and proper security controls.