For this recipe, we need Mutillidae II in our vulnerable VM to be at security level, use the Toggle Security option in the menu to set it, and use Burp Suite as proxy:
- In Mutillidae II's menu, go to Others | Unrestricted File Upload | File Upload.
- The first test will be to attempt uploading a PHP webshell. You can use the ones we used in previous chapters or make a new one. As follows, the upload will fail and we will receive a detailed description of why it failed:
From the preceding response, we can infer that the files are uploaded to /tmp in the server, first using a randomly generated name, then file extension and type ...
