File Upload Vulnerabilities

Cross-platform resources for File Upload Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

File Upload Vulnerabilities

This page aggregates cross-platform resources to practice File Upload Vulnerabilities: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/file-upload

HTB machines practicing File Upload Vulnerabilities (16)

Machine	OS	Difficulty
Bank	Linux	EASY
Beep	Linux	EASY
Blunder	Linux	EASY
Bounty	Windows	EASY
Conceal	Windows	HARD
Falafel	Linux	HARD
Late	Linux	EASY
Meta	Linux	MEDIUM
Nibbles	Linux	EASY
OpenSource	Linux	EASY
OverGraph	Linux	HARD
Phoenix	Linux	HARD
Silo	Windows	MEDIUM
Talkative	Linux	HARD
TheNotebook	Linux	MEDIUM
Timing	Linux	MEDIUM

PortSwigger labs practicing File Upload Vulnerabilities (8)

Lab	Difficulty	Topic	Official
Remote code execution via web shell upload	APPRENTICE	File Upload Vulnerabilities	Open
Web shell upload via Content-Type restriction bypass	APPRENTICE	File Upload Vulnerabilities	Open
Web shell upload via race condition	APPRENTICE	File Upload Vulnerabilities	Open
Exploiting XXE via image file upload	PRACTITIONER	XXE (XML External Entity)	Open
Remote code execution via polyglot web shell upload	PRACTITIONER	File Upload Vulnerabilities	Open
Web shell upload via extension blacklist bypass	PRACTITIONER	File Upload Vulnerabilities	Open
Web shell upload via obfuscated file extension	PRACTITIONER	File Upload Vulnerabilities	Open
Web shell upload via path traversal	PRACTITIONER	File Upload Vulnerabilities	Open

TryHackMe rooms practicing File Upload Vulnerabilities (4)

Room	Difficulty	Type	Access	Official
25 Days of Cyber Security	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2 [2020]	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Open
envizon	HARD	Challenge	🟢 Free	Open

Related skills

• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-06-07