Hands-On Application Penetration Testing with Burp Suite

Bypassing type restrictions

When an application allows you to upload files, usually the developer knows what types of files are allowed, so it is important to validate that a malicious user cannot upload other kinds of files. The common way to validate this is by using the extension file. So, if an application manages documents, maybe the developer allows PDF files and DOCX documents, but is this secure?

The file extension is not the only validation that the application needs to undertake. A malicious user can upload a malicious file with a valid extension; for example, to propagate malware.

First, we are going to create a malicious PDF using a tool called Metasploit. Metasploit is an exploitation framework that allows attack vulnerabilities, ...