Rename attack.php to Upload/attack.php