Intermediate LevelWeb Security & Cyber Defense
How do attackers exploit Content-Type tampering to bypass file upload filters?
❓ Interview Prompt: Explain Content-Type tampering, extension spoofing (`shell.php.png`), magic byte inspection, and non-executable upload directory configuration.
Attacking file upload forms by tampering with request headers:
Exploit Scenario:
An application checks 'if (file.type === 'image/jpeg')'. An attacker uploads a PHP web shell ('shell.php') while tampering with the HTTP request header to send 'Content-Type: image/jpeg'.
•
If the server saves 'shell.php' in a web-accessible directory, the attacker executes arbitrary code on the server!
•
Defenses: Inspect file magic bytes, generate random non-executable filenames, and serve uploads from a separate domain or S3 bucket.
Code Implementation Example
typescript
import fileType from 'file-type';
export async function verifyUploadedImage(buffer: Buffer): Promise<boolean> {
// Read true magic bytes from raw buffer (Ignores client Content-Type header!)
const result = await fileType.fromBuffer(buffer);
return !!result && ['image/jpeg', 'image/png', 'image/webp'].includes(result.mime);
}💡Verifying file magic bytes to neutralize Content-Type tampering exploits.
🎯 Interview Key Takeaway
Verify true file magic bytes and enforce non-executable directories to prevent upload file tampering exploits.
#File Uploads#Content-Type#Magic Bytes#Intermediate
Back to all Web Security & Cyber Defense Questions→