Now let's talk about how you can secure your website from file upload vulnerabilities.
The main thing to keep in mind is that never allow people to upload executables.
There shouldn't be a need for you to allow people to upload executables really.
So stuff like BHB by scripts executables like x com all these files.
You should never allow people to upload them because there is a high possibility that these files could
harm your server.
The second thing is you need to check that the file type is what the what you want is what you're expecting.
And check the extension at the same time.
So when we see and when you check in with our tests and the previous videos are the low security level
obviously there was no checks.
The medium security level there was check in for only the file type and the high security level they
were check in for the extension on the.
So what you want to do really is never allow executables.
Make sure the uploaded file is what you're expecting.
So if you're uploading an image make sure that the file type is an image on the other and the extension
is an image extension so it's a peg or a PNB or any other image type on.
And once you do these two checks so that and that make sure that you recreate the uploaded files so
you check that the file is an image and check that the extension is an image extension.
Then analyze the file use in some sort of a library so depending on the program the language you're
using on your server.
Make sure that you analyze you past this file to a library and analyze its content and recreate the
file to suit your Web site.
Now this is actually a good step anyway because since you're displaying this on your Web site you want
to make sure that the images are too big and that they are optimized for web applications.
So it's a good thing for your web site to run faster.
And it's also a good thing to make sure that this image is actually an image and not a harm a harmful
file.
So let's just have a look on the source code now I know I always say we're doing blackbox testing but
we're talking about the security now so you actually have to see the source code to see how you can
secure it.
So I'm just going to set the security level to medium because the low just doesn't really check anything.
So we're just going to go with the medium for now and we're going to go on the upload
I'm going to view the source.
So as you can see now in the media it's only chicken if the uploaded file type is an image now I don't
want to get into too much details about coding because this isn't a coding course.
We're only talking about how you secure yourself and about penetration testing.
So I have to cover the security part.
So we're going to talk about the concepts but not the actual code that you need to use because you could
be using a different programming language.
So and here they are using Ph.D. and what they're doing is they have just a simple IF statement and
they're checking if the image if the uploaded file type is an image.
So we see how we can bypass this easily by uploading an image and then changing the extension by renaming
our shell to the GBG which will uploaded which will be accepted as an image and then we'll just rename
it as it's been uploaded to BHB file.
Now if we set this to high security level
and we go back to the upload and have a look at the source code you can see that what they're doing
here they're checking that the extension is GBG or AJP e.g..
And then you can upload the picture.
So they're not checking for the file type this time.
So as I said you need to check for both now and the new versions of DVD which you ate and actually has
an extra security setting called impossible.
And what it does is it basically just shows you the right implementation of each one of these pages.
So it's it's actually can't be if it's the right way to do it.
The DVD a version that comes in with me to exploit a will doesn't have that security setting.
But we don't really need to use it anyway.
We just need to see the code.
So we have it here on get up.
And the way the right way to implement this is if we're look at this is the same if statement.
And basically what they're checking is they check the extension.
It is an image extensions a j peg or GBG or PND.
So that's all good.
So it has to be one of these things and it has to be of an image type so it has to be of type image
daypack or image BNZ and it doesn't stop that actually checks the sizes.
But that's OK.
What also does which I was speaking about which is recreate in the image itself.
So what they're doing is they're they're stripping the metadata of the image and they're using a library.
Actually they're not used in that library but you should be using that library which is called THP magic
or whatever there is that there are similar libraries for Python and Ruby and all of that too.
Basically what they do is they recreate another image from the uploaded image
once they do that they actually delete and destroy the old image and use the new image with a new name
so they create a new image from the old image.
They rename it and then you they use that image.
So these are three things you need to check for the extension check for the file type recreate the image
itself that way even if a person tries to upload a bad file or a malicious file then you'll be able
to protect your web application and your server from that file.
So even if they manage to upload the file then the file will be destroyed because of the creation process.