上传漏洞思维导图
来源于 c0ny 大佬的 Github 仓库,总结得挺到位的,所以在这里贴一下(侵删),文件上传漏洞有两个大类,一个是服务器端用代码验证文件时没有过滤完全,另一大类就是利用服务器的解析漏洞上传...jSp",".jSpx",".jSpa",".jSw",
".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",
".ashx...",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",
".aShx",".aSmx",".cEr",".sWf",".swf"
);
php6...jSp",".jSpx",".jSpa",".jSw",
".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",
".ashx...",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",
".aShx",".aSmx",".cEr",".sWf",".swf"
);
建议过滤后缀的话用白名单