Echo $_get[cat%20/etc/passwd] Root-me File Upload Double Extensions

HTML - Source code 49% 123740 5 g0uZ v 3 October 2006 HTTP - IP restriction bypass four% 8449 ten Cyrhades 5 23 March 2021 HTTP - Open redirect 19% 47225 10 Swissky 10 2 August 2017 HTTP - User-agent 24% 60548 10 g0uZ 10 iii October 2006 Weak password 33% 81472 ten g0uZ 7 three October 2006 PHP - Command injection 18% 45689 x sambecks ten twenty September 2017 Backup file 17% 40736 fifteen g0uZ viii 27 February 2011 HTTP - Directory indexing 23% 57058 15 g0uZ 7 7 October 2006 HTTP - Headers 16% 39602 15 Arod ix 11 January 2015 HTTP - Postal service fourteen% 33370 fifteen Th1b4ud 10 14 Baronial 2018 HTTP - Improper redirect xiii% 30878 xv Arod 10 26 November 2014 HTTP - Verb tampering 14% 34324 15 g0uZ x three February 2011 Install files fourteen% 33320 xv g0uZ five vii October 2006 CRLF 10% 23320 xx g0uZ 7 31 July 2011 File upload - Double extensions 11% 25686 20 g0uZ 9 24 Dec 2012 File upload - MIME type 8% 20206 twenty g0uZ 10 26 December 2012 HTTP - Cookies 13% 33050 twenty g0uZ viii seven October 2006 Insecure Code Direction four% 8227 xx Swissky half-dozen 29 September 2019 JSON Web Token (JWT) - Introduction 4% 9408 xx Kn0wledge v 21 Baronial 2019 Directory traversal 11% 26157 25 g0uZ 3 31 July 2011 File upload - Zip byte 8% 17998 25 g0uZ 4 26 Dec 2012 JSON Spider web Token (JWT) - Weak surreptitious three% 6632 25 Jrmbt 6 21 August 2019 JWT - Revoked token ii% 2791 25 ArnC half-dozen xx March 2020 PHP - assert() five% 11169 25 Birdy42 ten 26 November 2016 PHP - Filters 7% 15331 25 g0uZ 3 27 February 2011 PHP - register globals 5% 12545 25 g0uZ 2 8 October 2011 PHP - Remote Xdebug i% 876 25 mayfly iii 18 March 2020 Python - Server-side Template Injection Introduction one% 1534 25 Podalirius three 7 September 2021 File upload - ZIP 3% 6919 xxx ghozt iii 3 August 2017 Control injection - Filter featherbed three% 5328 30 sambecks 6 20 September 2017 Coffee - Server-side Template Injection 4% 7717 xxx righettod five 29 November 2015 JSON Web Token (JWT) - Public key 1% 2333 30 Jrmbt 5 21 Baronial 2019 Local File Inclusion 8% 19651 30 g0uZ 4 2 Oct 2011 Local File Inclusion - Double encoding iv% 9679 30 zM_ 4 13 June 2016 Node - Eval i% 1498 xxx Mhd_Root vii 24 Feb 2021 PHP - Loose Comparing 3% 5400 30 ghozt 4 10 Jan 2018 PHP - preg_replace() 3% 7144 30 sambecks 4 2 March 2016 PHP - type juggling 3% 6968 30 vic 4 x March 2016 Remote File Inclusion 4% 8766 30 g0uZ 8 25 November 2015 SQL injection - Authentication 13% 31839 30 g0uZ 11 27 February 2011 SQL injection - Authentication - GBK 3% 6763 30 dvor4x 4 2 December 2015 SQL injection - String 6% 14690 30 g0uZ viii 24 December 2012 XSLT - Lawmaking execution ii% 2730 thirty ghozt 5 16 July 2017 LDAP injection - Authentication 4% 7892 35 g0uZ 8 26 May 2013 Node - Serialize 1% 622 35 Mhd_Root 1 24 February 2021 NodeJS - Image Pollution Bypass 1% 124 35 Worty 0 22 October 2021 NoSQL injection - Authentication 3% 5796 35 mastho 8 31 May 2015 PHP - Path Truncation 2% 4237 35 Geluchat 6 25 March 2015 PHP - Serialization iii% 5221 35 Arod iii 3 Feb 2014 SQL injection - Numeric 5% 10230 35 g0uZ 6 24 December 2012 SQL Injection - Routed 2% 3479 35 soka five 24 December 2016 SQL Truncation two% 4792 35 Geluchat two 1 May 2015 XML External Entity ii% 3911 35 sambecks ii twenty October 2014 XPath injection - Authentication 3% 5289 35 g0uZ half-dozen 27 December 2012 Yaml - Deserialization 1% 557 35 Nishacid ii 20 April 2021 GraphQL ane% 769 40 CanardMandarin 2 twenty October 2020 Java - Spring Kick i% 1747 40 dvor4x 3 24 December 2016 Local File Inclusion - Wrappers 1% 2469 xl sambecks 4 ii March 2016 PHP - Eval 1% 2396 40 chmod x viii November 2018 PHP - Unserialize overflow 1% 458 forty mayfly two 4 April 2020 SQL injection - Fault iii% 5290 40 sambecks five four March 2015 SQL injection - Insert one% 2134 40 sambecks 4 23 February 2015 SQL injection - File reading two% 4241 twoscore Arod iii 19 October 2014 XPath injection - String 2% 3041 xl g0uZ v 26 May 2013 NoSQL injection - Blind 1% 2193 45 ghozt half dozen 26 November 2016 SQL injection - Time based 2% 3854 45 ycam 4 eleven September 2015 NodeJS - vm escape 1% 378 50 Podalirius one 15 Apr 2021 Server Side Request Forgery 1% 1110 50 sambecks 7 22 June 2018 SQL injection - Blind 3% 5489 l g0uZ 5 27 February 2011 LDAP injection - Blind 2% 2552 55 g0uZ ii viii June 2013 PHP - Unserialize Pop Concatenation 1% 161 55 Worty 1 22 October 2021 Python - Blind SSTI Filters Bypass 1% 229 75 Podalirius three seven September 2021 XPath injection - Blind i% 1671 75 g0uZ 4 27 December 2012 SQL injection - Filter bypass i% 1594 80 sambecks 7 21 July 2014

redmanunwhan.blogspot.com

Source: https://www.root-me.org/en/Challenges/Web-Server/File-upload-Double-extensions?q=%2Fen%2FChallenges%2FWeb-Server%2FFile-upload-double-extensions