Uploading malicious files – polyglots
Polyglot is a term defined as something that uses several languages. If we carry this concept into hacking, it means the creation of an attack vector by using different languages as execution points. For example, attackers can construct valid images and embed JavaScript. The placement of the JavaScript payload is usually in the comments section of an image. Once the image is loaded in a browser, the XSS content may execute, depending upon the strictness of the content type declared by the web server and the interpretation of the content type by the browser. In this recipe, we will use a polyglot to upload a webshell disguised as an image.
Getting ready
Using the OWASP WebGoat file upload functionality, we will write a small Java Server Pages (JSP) webshell and upload it to the application, disguised as an image.
We will use some popular source code for the JSP webshell and save it in a file called poly.jsp.
