← All Challenges
Challenge 25 of 66
Upload Bypass
🟡 Medium
Web App
+75 XP
A file upload only checks the file extension client-side. Bypass the JavaScript validation to upload a PHP web shell.
Disable JavaScript, intercept the request with Burp, or rename .php to .php.jpg and exploit double extensions.