jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp...",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx"...aSmx",".cEr",".sWf",".swf",".htaccess"
这个时候可以采用一种方法来绕过,因为靶场是搭建在windows上的,所以windows有一个特性,windows系统自动去掉不符合规则符号后面的内容...举个栗子
比如你新建了一个1.txt文件,然后你将名称改为1.txt.试试,虽然会有下面的警告,但是windows还是会默认去掉后面的....,当上传到win机器上时又会将后面的.去掉,然后后缀就又会被还原成.php,这样就可以执行了,下面演示一下
首先上传1.php文件并抓包,在burp修改文件后缀名为.php.
image.png
测试链接