Geek Culture
Published in

Geek Culture

Fuzzing File Uploads With Burp Intruder

Apps and websites often need to allow users to upload files for various reasons. Sometimes users need to upload arbitrary files, such as on file bin services like S3, but most of the time, a service is expecting a specific type of file. Your bank might want a photo of your passport for KYC purposes, TikTok expects a video and so on. Unrestricted file uploads create risks for web applications, including complete system takeover, forwarding attacks to back-end systems or client-side attacks. Uploaded files can cause serious problems.

In cases where a service is expecting a specific kind of file, it is best to validate a file’s magic bytes against the expected file types.

Magic Bytes

File formats sometimes specify a few bytes to be at the start of each file. This allows programs to recognize them. For example, Windows PE executables (.exe files) start with the byte sequence 4D 5A (MZ)

Magic Bytes at the start of a Windows executable shown in a hex editor (Hex Fiend).

To prevent malicious files from being uploaded, web applications should check the first few bytes of a file against expected file types. There is a list of magic bytes for common file types on Wikipedia.

These magic bytes make it possible to test allowed file types quickly by generating synthetic files that contain the file header corresponding to different types. I’d created a tool, HTTPFuzz that could do this, but I’d prefer to stay in Burp Suite instead of having to switch to a CLI window. I created the File Generator extension to make this possible.

Installing File Fuzzer

File Fuzzer can be installed manually through the Extender tab in Burp Suite. It’s not on the BApp Store yet because I want to test it more, but I use it without issues on web penetration tests.

Install File Fuzzer through the JAR

The File Fuzzer JAR is on GitHub. It’s best to download the latest release, which at the time of writing is 0.0.2-alpha. Simply install it through the Burp Extender tab.

Using File Fuzzer to Test File Uploads

Burp File Fuzzer will generate synthetic files of different types. It provides three payload generators: one that generates files, one that generates MIME types and one that generates filenames.

It should be used in Pitchfork mode with injection points placed on the file and filename. This will cause Burp File Fuzzer to generate synthetic files and appropriate filenames and MIME types.

Set the payload set according to the position of your filename and file contents. The filename will usually be first in multipart requests.

Payloads for filenames, MIME types and synthetic files should be extension generated by Filename Generator, File MIME Type Generator and File Generator respectively.

Payload Generators included with File Fuzzer

For best results, disable URL encoding for filenames and MIME types to prevent the . in filenames and / in MIME types from being URL encoded.

After you’ve configured an attack, simply start the attack and Burp Intruder will generate payloads, filenames and MIME types if needed. I’ll be adding more types over time, but you can add support for additional file types by adding them to fileHeaders in FileTypes.kt.

File Generator generating synthetic files with appropriate filenames

File Generator will add a tab to Burp’s UI that allows you to set the payload size and base filename for uploaded files. If you don’t set a size, it’ll default to 1024 bytes (1 KB).

File Generator UI tab that will generate 1024 byte large files named payload.exe, payload.jpg.php, etc.

Get File Fuzzer

File Fuzzer is open source and the code is on GitHub. You can get a pre-built JAR on the releases page. It’s currently in alpha, but I’ll add it to the BApp Store once it’s been tested by more people. I use this extension to make my life easier on web pentests.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Jonathan Cooper

Jonathan Cooper

I’m a cybersecurity consultant who develops software. I help agile teams deliver secure digital experiences to their customers.