0

In a local file inclusion attack, besides guessing, is there method that allows an attacker to know the name of the right file? The name of the file to be included in a LFI attack is not always something well known such as these:

/etc/passwd
/etc/shadow
.htaccess
.htpasswd
../admin/.htpasswd
/proc/self/environ 

Sometimes the name of the file to include is very hard to guess and unpredictable. Hence, I am asking if there is a technical method to know the right name of the file that can save us the time of guessing.

3

No, there's no other way to know if the file exists or not.

However, if you can find out what OS is running on the system, then often you will be able to find the right path to certain files quite easily.

In rare cases websites have a script or page which iterates through files in a folder specified by a POST or GET parameter which you could manipulate to display all files in a specific folder. I haven't seen this vulnerability in a while though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy