Shell's Revenge — GIF Polyglot PHP Webshell Upload

Upload a file starting with the GIF89a magic bytes followed by a PHP shell. The server validates MIME type from the header but saves the file where PHP can execute it. Access the uploaded file URL to run arbitrary commands.

January 1, 2024 · 2 min · giordii