search

File Inclusion

Notes about some basic File Insclusion attack

hashtag
Playground

hashtag
Dangerous Function

Function

Read Content

Execute

Remote URL

PHP

include()/include_once()

✅

✅

✅

require()/require_once()

✅

✅

❌

file_get_contents()

✅

❌

✅

fopen()/file()

✅

❌

❌

NodeJS

fs.readFile()

✅

❌

❌

fs.sendFile()

✅

❌

❌

res.render()

✅

✅

❌

Java

include

✅

❌

❌

import

✅

✅

✅

.NET

@Html.Partial()

✅

❌

❌

@Html.RemotePartial()

✅

❌

✅

Response.WriteFile()

✅

❌

❌

include

✅

✅

✅

hashtag
Local File Inclusion (LFI)

Local File Inclusion (LFI) is a type of vulnerability where an attacker can exploit a web application to include files that are already present on the server. By manipulating input parameters, such as URLs or form fields, the attacker can trick the application into loading files from the local file system, potentially accessing sensitive information or executing malicious code.

hashtag
Basic LFI Payloads

Command
Description

/etc/passwd

Basic LFI

../../../../etc/passwd

LFI with path traversal

/../../../etc/passwd

LFI with name prefix

./languages/../../../../etc/passwd

LFI with approved path

php://filter/read=convert.base64-encode/resource=config

LFI with Base64 Filter

../../../../etc/passwd%00

LFI with Null byte

hashtag
Log Poisoning to RCE

hashtag
Access Log Location

Apache:

Nginx:

  • /var/log/nginx/access.log

hashtag
LFI to RCE

hashtag
Remote File Inclusion (RFI)

In most languages, including remote URLs is considered as a dangerous practice as it may allow for such vulnerabilities. This is why remote URL inclusion is usually disabled by default. For example, any remote URL inclusion in PHP would require the allow_url_include setting to be enabled.

hashtag
Automation

hashtag
Tools

hashtag
LFImap

LFImap

hashtag
WordLists

  • https://raw.githubusercontent.com/DragonJAR/Security-Wordlist/main/LFI-WordList-Linux

  • https://raw.githubusercontent.com/DragonJAR/Security-Wordlist/main/LFI-WordList-Windows

  • https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/LFI/LFI-Jhaddix.txt

hashtag
References

PreviousSSTINextXSS

Last updated