XSSy File name XSS

[Arjevan1dze]

hello friends, hackers i have some problem about finding solution in this lab because i tried lot of variation like content-type fuzz + extension fuzz, bypass with: .png.svg or reverse .svg.png what problem i have?

[paj28]

1. The file content doesn't matter.
2. What extensions does the lab allow?
3. What characters are permitted in the file name?

[Arjevan1dze]

how can i detect what characters are permitted in file name?

[paj28]

Are you using an intercepting proxy like Burp or Zap? You can intercept a request, tweak the file name and inject characters there to see what is allowed. I should probably do a video for this :)

[Arjevan1dze]

yeah i using caido but i can't see any error

[paj28]