File Upload Vulnerabilities

Recursos cross-platform para File Upload Vulnerabilities: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar File Upload Vulnerabilities de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 28 retos en 3 plataformas — 16 HackTheBox · 8 PortSwigger · 4 TryHackMe. 16 con writeup en español, 16 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Remote code execution via web shell upload (Apprentice) · 🇬🇧
2. PortSwigger — Web shell upload via Content-Type restriction bypass (Apprentice) · 🇬🇧
3. PortSwigger — Web shell upload via race condition (Apprentice) · 🇬🇧
4. TryHackMe — 25 Days of Cyber Security (Easy · ~45 min) · 🇬🇧
5. TryHackMe — Advent of Cyber 2 [2020] (Easy · ~45 min) · 🇬🇧
6. TryHackMe — Advent of Cyber 2022 (Easy · ~1440 min) · 🇬🇧

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/file-upload

​

Máquinas HTB que practican File Upload Vulnerabilities (16)

Máquina	SO	Dificultad	Writeup
Bank	Linux	EASY	🇪🇸 🇬🇧 📹
Beep	Linux	EASY	🇪🇸 🇬🇧 📹
Blunder	Linux	EASY	🇪🇸 🇬🇧 📹
Bounty	Windows	EASY	🇪🇸 🇬🇧 📹
Conceal	Windows	HARD	🇪🇸 🇬🇧 📹
Falafel	Linux	HARD	🇪🇸 🇬🇧 📹
Late	Linux	EASY	🇪🇸 🇬🇧 📹
Meta	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Nibbles	Linux	EASY	🇪🇸 🇬🇧 📹
OpenSource	Linux	EASY	🇪🇸 🇬🇧 📹
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹
Phoenix	Linux	HARD	🇪🇸 🇬🇧 📹
Silo	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Talkative	Linux	HARD	🇪🇸 🇬🇧 📹
TheNotebook	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Timing	Linux	MEDIUM	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican File Upload Vulnerabilities (8)

Lab	Dificultad	Topic	Oficial
Remote code execution via web shell upload	APPRENTICE	File Upload Vulnerabilities	Abrir
Web shell upload via Content-Type restriction bypass	APPRENTICE	File Upload Vulnerabilities	Abrir
Web shell upload via race condition	APPRENTICE	File Upload Vulnerabilities	Abrir
Exploiting XXE via image file upload	PRACTITIONER	XXE (XML External Entity)	Abrir
Remote code execution via polyglot web shell upload	PRACTITIONER	File Upload Vulnerabilities	Abrir
Web shell upload via extension blacklist bypass	PRACTITIONER	File Upload Vulnerabilities	Abrir
Web shell upload via obfuscated file extension	PRACTITIONER	File Upload Vulnerabilities	Abrir
Web shell upload via path traversal	PRACTITIONER	File Upload Vulnerabilities	Abrir

​

Rooms TryHackMe que practican File Upload Vulnerabilities (4)

Room	Dificultad	Tipo	Acceso	Oficial
25 Days of Cyber Security	EASY	Walkthrough	🟢 Free	Abrir
Advent of Cyber 2 [2020]	EASY	Walkthrough	🟢 Free	Abrir
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Abrir
envizon	HARD	Challenge	🟢 Free	Abrir

​

Skills relacionadas

• /skills/rce

---

← Volver al glosario completo

Última actualización: 2026-08-17