Hide Malicious Shell in Image File

links Web Application Security Web Security Academy Labs File Upload Vulnerabilities Malicious Metadata Exiftool

08 May 2022

¹

There are many ways to bypass flawed validation of file uploads to upload web shells on web applications, this link explains some ways like creating a polyglot image file containing malicious code in its metadata using tools like exiftool, this method is interesting, check it out.

Also you can practice this vulnerability in Web Security Academy, check the link below.

External Links

---

• Hide malicious shell in image file

• Lab: Remote code execution via polyglot web shell upload

References

---

1. Icon made by Freepik from www.flaticon.com ↩