You can use the dev tools of browser and see if there is check at the front end instead of backend. You can check this from network tab. If no new request is sent to the server once you try to upload a file, it means check is on frontend.
First capture a legitimate request and then send it to repeater to play with it
You can manupulate the request in burp and see if it gets uploaded.
We can even try to upload a php shell
Magic Bytes
Magic Bytes identify the file type. Server is checking the file type
Null bytes attack
add FF D8 FF DB in hex editor of files or adding GIF89a or GIF87; may also work
We can do that in burp. We need son content in the start as well as well in the end
We can also try alternate php extensions
Check a directory permissions
If you have a webpage. We can use options header to check what headers types are supported by a directory.
This directory also supports webdav which can be used to upload file.
