An upload that trusts you

Upload, then fetch

The target has an upload at /app/upload. Send it a file and it saves it, then serves it back under /uploads/:

echo 'hello from the student' > note.txt
curl -s -F 'file=@note.txt;filename=note.txt' http://127.0.0.1:8080/app/upload
curl -s http://127.0.0.1:8080/uploads/note.txt

In the terminal

student@vulntech:~$ echo 'hello from the student' > note.txt
student@vulntech:~$ curl -s -F 'file=@note.txt;filename=note.txt' http://127.0.0.1:8080/app/upload
saved as note.txt
student@vulntech:~$ curl -s http://127.0.0.1:8080/uploads/note.txt
hello from the student

Whatever you upload comes back verbatim. Two things make an upload dangerous: it trusts the name you give the file, and it doesn't check what the file is.