How Hackers Bypass Website File Upload Filters (Upload WebShell Backdoor) | picoCTF - byp4ss3d

💻 Learn Web App Pentesting for free, right in your browser 👉 https://www.hackstation.io/

⏱️ Only 3 hours
🛠️ No VMs, no setup
🔓 Learn by hacking, not watching
🆓 Completely free

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

In this video, I break down the picoCTF byp4ss3d "Bypassed" challenge and show how a vulnerable file-upload feature can be abused to execute code on the server and reveal the flag. The challenge looks simple on the surface—an upload form that only accepts images—but a hint about Apache behavior exposes a major weakness. By uploading both an .htaccess file that changes how Apache handles image files and a disguised “image” containing PHP code, it’s possible to trick the server into running commands through a .jpg file. Once both files are in place, accessing the uploaded image with a command parameter lets us read the hidden flag from the server.

Disclaimer: This video is for educational purposes only.