文件上传本身不是漏洞，但如果文件上传功能的限制出现纰漏，允许了不合法且影响网站安全的文件的上传
可以将不合法且影响网站安全稳定性的文件等内容上传的均为“文件上传漏洞”
黑方将文件上传后可通过手段执行以及上传的脚本文件（通过获得上传的地址目录查看文件并达到目的）
一般的，以上所述的内容文件为通俗的所说的：“一句话木马”。
而文件上传功能是大多web应用均具备的功能（例如图片、附件、头像等）正常的将文件上传是合法的。
但如果通过修改文件性质，绕过web应用的限制，将恶意的脚本文件上传到服务器后台，并可以执行，意味着获得了webshell
获得webshell则意味着服务器的操作权限被拿到了下一步的攻击则是最危险的（违法）
{用户=是无法直接看见后端代码的，后端代码在服务器，当用户请求服务器
（静态下，由服务器给出响应，浏览器直接渲染）
（动态下，浏览器和后端的php中间件通信，由中间件对程序处理或解释，最终生成html的结果）}
流程：
成功上传——获得脚本路径——webshell
成功绕过机制将恶意脚本上传到服务器路径下后
获得脚本存放的路径
进入脚本存储路径对脚本执行（中国菜刀）
low等级：
没有任何审查机制，直接将php脚本上传即可上传成功并获得脚本位置后
1 ?<?php 2 ?3 ????????????????????if( isset( $_POST[ ‘Upload‘ ] ) ) { 4 ????????????????????????// Where are we going to be writing to? 5 ????????????????????????$target_path ?= DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 6 ????????????????????????$target_path .= basename( $_FILES[ ‘uploaded‘ ][ ‘name‘ ] ); 7 ?8 ????????????????????????// Can we move the file to the upload folder? 9 ????????????????????????if( !move_uploaded_file( $_FILES[ ‘uploaded‘ ][ ‘tmp_name‘ ], $target_path ) ) {10 ????????????????????????????// No11 ????????????????????????????echo ‘<pre>Your image was not uploaded.</pre>‘;12 ????????????????????????}13 ????????????????????????else {14 ????????????????????????????// Yes!15 ????????????????????????????echo "<pre>{$target_path} succesfully uploaded!</pre>";16 ????????????????????????}17 ????????????????????}18 19 ?????????????????> {ps：实际情况下，用户是无法直接看见php源码和路径地址的}
Low等级的机制下没有对上传的文件类型进行检查，所以直接上传php脚本即可；会返回路径（靶机返回，现实中不直接返回）
Medium等级：
添加了对文件格式、大小的检查机制
1 ?if( isset( $_POST[ ‘Upload‘ ] ) ) { 2 ????????????????????????// Check Anti-CSRF token 3 ????????????????????????checkToken( $_REQUEST[ ‘user_token‘ ], $_SESSION[ ‘session_token‘ ], ‘index.php‘ ); 4 ?5 ?6 ????????????????????????// File information 7 ????????????????????????$uploaded_name = $_FILES[ ‘uploaded‘ ][ ‘name‘ ]; 8 ????????????????????????$uploaded_ext ?= substr( $uploaded_name, strrpos( $uploaded_name, ‘.‘ ) + 1); 9 ????????????????????????$uploaded_size = $_FILES[ ‘uploaded‘ ][ ‘size‘ ];10 ????????????????????????$uploaded_type = $_FILES[ ‘uploaded‘ ][ ‘type‘ ];11 ????????????????????????$uploaded_tmp ?= $_FILES[ ‘uploaded‘ ][ ‘tmp_name‘ ];12 13 ????????????????????????// Where are we going to be writing to?14 ????????????????????????$target_path ??= DVWA_WEB_PAGE_TO_ROOT . ‘hackable/uploads/‘;15 ????????????????????????//$target_file ??= basename( $uploaded_name, ‘.‘ . $uploaded_ext ) . ‘-‘;16 ????????????????????????$target_file ??= ?md5( uniqid() . $uploaded_name ) . ‘.‘ . $uploaded_ext;17 ????????????????????????$temp_file ????= ( ( ini_get( ‘upload_tmp_dir‘ ) == ‘‘ ) ? ( sys_get_temp_dir() ) : ( ini_get( ‘upload_tmp_dir‘ ) ) );18 ????????????????????????$temp_file ???.= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . ‘.‘ . $uploaded_ext;19 20 ????????????????????????// Is it an image?21 ????????????????????????if( ( strtolower( $uploaded_ext ) == ‘jpg‘ || strtolower( $uploaded_ext ) == ‘jpeg‘ || strtolower( $uploaded_ext ) == ‘png‘ ) &&22 ????????????????????????????( $uploaded_size < 100000 ) &&23 ????????????????????????????( $uploaded_type == ‘image/jpeg‘ || $uploaded_type == ‘image/png‘ ) &&24 ????????????????????????????getimagesize( $uploaded_tmp ) ) {25 26 ????????????????????????????// Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD)27 ????????????????????????????if( $uploaded_type == ‘image/jpeg‘ ) {28 ????????????????????????????????$img = imagecreatefromjpeg( $uploaded_tmp );29 ????????????????????????????????imagejpeg( $img, $temp_file, 100);30 ????????????????????????????}31 ????????????????????????????else {32 ????????????????????????????????$img = imagecreatefrompng( $uploaded_tmp );33 ????????????????????????????????imagepng( $img, $temp_file, 9);34 ????????????????????????????}35 ????????????????????????????imagedestroy( $img );36 37 ????????????????????????????// Can we move the file to the web root from the temp folder?38 ????????????????????????????if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) {39 ????????????????????????????????// Yes!40 ????????????????????????????????echo "<pre><a href=‘${target_path}${target_file}‘>${target_file}</a> succesfully uploaded!</pre>";41 ????????????????????????????}42 ????????????????????????????else {43 ????????????????????????????????// No44 ????????????????????????????????echo ‘<pre>Your image was not uploaded.</pre>‘;45 ????????????????????????????}46 47 ????????????????????????????// Delete any temp files48 ????????????????????????????if( file_exists( $temp_file ) )49 ????????????????????????????????unlink( $temp_file );50 ????????????????????????}51 ????????????????????????else {52 ????????????????????????????// Invalid file53 ????????????????????????????echo ‘<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>‘;54 ????????????????????????}55 ????????????????????}56 57 ????????????????????// Generate Anti-CSRF token58 ????????????????????generateSessionToken();59 60 ?????????????????> Medium等级下上传gif/jpg(MIME类型和后缀)且1000b以下的文件即可上传成功；除此以外的文件均被拦截不可上传。
而在安全领域下有一个名词：绕过（过狗）
通过Burp代理进行访问后拦击数据包并修改后释放上传
文件上传绕过思路：推荐文章
https://www.cnblogs.com/blacksunny/p/8001201.html
https://www.freebuf.com/articles/web/179954.html
web安全——文件上传
原文地址：https://www.cnblogs.com/wangyuyang1016/p/10229174.html