← All Challenges
Challenge 25 of 66
Upload Bypass
🟡 Medium
Web App
+75 XP
A file upload only checks the file extension client-side. Bypass the JavaScript validation to upload a PHP web shell.
Disable JavaScript, intercept the request with Burp, or rename .php to .php.jpg and exploit double extensions.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free