Questions tagged [lfi]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
98 views

Local file inclusion to RCE

Here is the code: <?php $file=trim($_GET['img_name']); //echo $file; if (file_exists($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'...
0
votes
1answer
66 views

Attack Web Forms dvwa to achieve lfi

Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server? Is there a endpoint to hit for this? ...
0
votes
1answer
161 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
6
votes
3answers
675 views

Can there be a way to exploit PHP include_once() when the input is filtered?

Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice): $input = addslashes($_GET["input"]); if (strpos($input, '../') === false) { ...