📤 Unrestricted File Upload

Two main bypass classes:

• Input bypass — tamper with filename / Content-Type in Burp.
• Payload bypass — embed code in a valid image (file header / metadata, e.g. php-in-jpg).

Workflow

1. Upload a benign file first to learn what’s allowed.
2. Modify the filename / Content-Type in Burp.
3. Try alternate extensions: .php7, .phps.

Windows + PHP cmd reverse shell

powershell -e BASE64... — check how the input is base64-encoded. Build payloads in payloads-shells.

References: php-in-jpg. Related: WordPress plugin upload shell in wordpress; webshell via SQLi in sqli.