Now, let's talk about how you can secure your website from file upload vulnerability's.
The main thing to keep in mind is that never allow people to upload executables, there shouldn't be
a need for you to allow people to upload executables, really.
So stuff like Fibi scripts, executables, lik e e com.
All these files, you should never allow people to upload them because there is a high possibility that
these files could harm your server.
The second thing is you need to check that the file type is what the what you want is what you're expecting
and check the extension at the same time.
So when we see in when we are checking with our tests and the previous videos at the low security level,
obviously there was no checks at the medium security level.
There was checking for only the file type.
And at the high security level, they were checking for the extension only.
So what you want to do really is never allow executables make sure the uploaded file is what you're
expecting.
So if you're uploading an image, make sure that the file type is an image and the and the extension
is an image extension.
So it's a JPEG, RPG or any other image type only.
And once you do these two checks, so that ad that make sure that you recreate the upload file, so
you check that the file is an image and check that the extension is an image extension, then analyze
the file using some sort of a library.
So depending on the programming language you're using on your server, make sure that you analyze you
pass this file to a library and analyze its content and recreate the file to suit your website.
Now, this is actually a good step anyway, because since you're displaying this on your website, you
want to make sure that the images are in too big and that they are optimized for Web applications.
So it's a good thing for your website to run faster.
And it's also a good thing to make sure that this image is actually an image and it's not a harmful
file.
So let's just have a look on the source code.
Now, I know I always say we're doing blackbox testing, but we're talking about the security now.
So you actually have to see the source code to see how you can secure it.
So I'm just going to set the security level to medium because the load just doesn't really check anything.
So we're just going to go with the medium for now and we're going to go on the upload.
And I'm going to view the source so as you can see now in the media, it's only checking if the uploaded
file type is an image.
Now, I don't want to get into too much details about coding, because this isn't a coding course,
we're only talking about how you secure yourself and about penetration testing.
So I have to cover the security part.
So we're going to talk about the concepts, but not the actual code that you need to use because you
could be using a different programming language.
So in here, they're using you.
And what they're doing is they have just a simple if statement and they're checking if the if the image
of the uploaded file type is an image.
So we see how we can bypass this easily by uploading an image and then changing the extension to by
renaming our shell to the jpg, which we will upload it, which will be accepted as an image, and then
we'll just rename it as it's been uploaded to a file.
Now, if we send this to a high security level.
And you go back to the upload and have a look at the source code.
You can see that what they're doing here.
They're checking that the extension is a jpg or EEG and then you can upload the picture so they're not
checking for the file type this time.
So, as I said, you need to check for both.
Now, the new versions of DVDs and actually has an extra security, something called impossible and
what that is, it basically just shows you the right implementation of each one of these pages.
So it's it's actually can't be hacked.
It's the right way to do it.
The DVD version that comes in with me transplantable doesn't have that security setting, but we don't
really need to use it anyway.
We just need to see the code.
So I have it here on GitHub.
And the way the right way to implement this is if we look at this is the same if statement.
And basically what they're checking is they check the extension is is an image extension.
So it's a JPEG or JPEG or Pangea's.
So that's all good.
So it has to be one of these things and it has to be of an image type.
So it has to be of type image jpeg or image PMG and it doesn't stop or that actually checks the sizes.
But that's OK.
What it also does, which I was speaking about, which is recreating the image itself.
So what they're doing is they're they're stripping the metadata of the image and they're using a library
actually they're not using that library.
But you should be using that library, which is called magic or whatever there is that there are similar
libraries for Python and Ruby and all of that to basically what they do is they recreate another image
from the uploaded image.
Once they do that, they actually delete and destroy the old image and use the new image with a new
name, so they create a new image from the old image, they rename it and then they use that image.
So these are three things you need to check for the extension, check for the file type, recreate the
image itself.
That way, even if a person tries to upload a bad file or a malicious file, then you'll be able to
protect your Web application and your server from that file.
So even if they manage to upload the file, then the file will be destroyed because of the recreation
process.