# Skills Assessment
* Try to exploit the upload form to read the flag found at the root directory "/".
I can see into the main web a section with name /contact/, in it i can upload a image(screenshot), but i can see into his source code a whitlist -->
> Intercept this peticion with burpsuite -->
## XEE
Try to change the extension name with .svg -IT WORK!- Then i need to test the Content-Type of xml - svg
```
cat /usr/share/seclists/Discovery/Web-Content/web-all-content-types.txt | grep svg
image/svg+xml
application/vnd.oipf.dae.svg+xml
```
Into the code, inset xml malicious code -->
```
]>
```
With it, can use another malicious codes for view for example the index.php of this web -->
```
]>
```
We can see the content of index.php base64 endoce, with it, we can enumerate anothers endpoint into the web, for example upload.php
> Decode base64 it
Allright!! With it we can see, the route of save the files/imgs is `/user_feedback_submissions/`, maybe: `contact/user_feedback_submissions/` with it, too can see the rename of the images save;
```
$fileName = date('ymd') . '_' . basename($_FILES["uploadFile"]["name"]);code
```
> date(ymd) \_ name of upload file
With it, i can test with a simple upload if i can see the picture -->
## WebShell Upload
First again, delete de front restriccions -->
Then, with the burp active, intercept the peticon of upload a image and send to Repeater:
We can upload a simple webshell code, but... we need test all casuistics of the content-type, magics numbers and extensions.
First, we modify the extension to see which can send -->
> ws.phar.jpg - doble extension nice! We can use the intruder
Second, we need imput malius code, for examen a web shell and try to upload. The safest, we can see a normal webshell and need alterate the content-type and mime type -->
> With it, we can see that the content type correct is jpg o jpeg and the Magic Numbers is the yoya of the jpg iamges
To finaly, we can see the content upload and base64 encoded. And with the another vulnerability XXE, we can view the addres to safe the images: `contact/user_feedback_submissions/date(ymd) _ name of upload file` -->
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cbbh/file-upload-attacks/skills-assessment.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.