Thread by @osiryszzz

1/ Thread about file upload exploitation
you have a file upload resource where you managed to upload arbitrary files, however failed to find where they got uploaded and you think there go my chances of #RCE. Hold your breath you might still get it:

2/ At this point you don’t know - if ever - where the file might potentially get executed, could be on a different server than the original web app with different tech.
Approach:
1. Make sure you have a sniffer always running on a VPS of yours ->

3/
2. Create at least 3 shells, one in PHP, one in JSP, one in C#.
3. In the payload, get the shell to execute a bunch of commands both for Windows and Linux OS, like: whoami, uname, pwd.
4. Code the shell to use at least 3 different ways to send outgoing http requests ->

4/
To send the results of the commands to your VPS where you have the sniffer running.
5. Upload all 3 shells and wait

At a later time, an admin, a backend user, even an internal script or program might actually execute your shell, when that’ll happen you’ll know as you’ll ->

5/
Receive the hit on your VPS and obtain the output of the CMDs your payload executed.
Your failed initial exploit would have turned into a Blind OOB RCE.