File upload: null byte¶

root-me challenge: File upload - Null byte: Hack this photo galery by uploading PHP code.

Resources¶

• Secure file upload in PHP web applications

Techniques¶

• File uploads

• File upload runbook

Counter moves¶

File upload: null byte is the variant in play. Server-side validation and least privilege are what these reduce to. Defenders’ notes on this are under the application layer as a target.