Questions tagged [lfi]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
168 views

Is this a LFI vulnerability?

I'm playing with uploads, so I'm wondering if this route is safe to use, because if you somehow break off from the md5 function path, then you can control the path (if in TypeScript null byte is a ...
Kiwi501987's user avatar
0 votes
1 answer
283 views

Is this really a way to filter LFI?

I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd. Is it possible to bypass in_array function? <?php $...
Kiwi501987's user avatar
0 votes
0 answers
90 views

bruteforce attack inside iFrame

How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff? For example I have an iFrame on the server like this: iframe.php <html> <head><title&...
Freeman's user avatar
  • 241
2 votes
2 answers
370 views

File inclusion exposed passwords

I am confused about LFI where I have seen many broken web-app demos demonstrate LFI where they traverse to a directory similar to /etc/passwd. How are these passwords being stored exactly? I do not ...
Krellex's user avatar
  • 197
2 votes
0 answers
171 views

Does Windows Server ship with any sensitive images in the filesystem?

I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
Daniel's user avatar
  • 21
0 votes
2 answers
2k views

Bypass Local File Inclusion(LFI) prevention filters

I have these two LFI filters and i want to bypass them $bad = str_replace('../','',$_GET['bad']); while( substr_count($bad, '../', 0)) { $bad = str_replace('../', '', $bad);...
Mike Anast's user avatar
1 vote
1 answer
134 views

What can a lfi without ssh open be used for

If a server has LFI vulnerability, I usually try to find if ssh is open and after some research if I can't find any spilt credentials, I just bruteforce it or something. Can I use a LFI vulnerability ...
user avatar
2 votes
4 answers
565 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
RFIx's user avatar
  • 21
3 votes
2 answers
8k views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
eyal's user avatar
  • 73
0 votes
1 answer
727 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
201120's user avatar
  • 1
2 votes
2 answers
8k views

LFI filter bypass

$patterns[0] = '/[^[:print:]]+/'; // remove non-printable characters $patterns[1] = '/[ \t]+$/'; // remove whitespace at end of string $patterns[2] = '/^[ \t]+/'; // remove whitespace at ...
David's user avatar
  • 95
1 vote
2 answers
946 views

Attacking through a malicious HTML file apart from XSS through Javascript?

I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
Sreeraj's user avatar
  • 1,317
0 votes
1 answer
2k views

LFI to RCE through User-Agent

I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
mat80n2012 cerqueira's user avatar
0 votes
1 answer
2k views

How to Create file name with Slash in it for Path traversal attack?

Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
user154's user avatar
3 votes
0 answers
763 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
Guysudai1's user avatar
  • 143
1 vote
2 answers
749 views

PHP Local File Inclusion from URL; no param

The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path. The $path argument is /...
Zackline's user avatar
  • 111
1 vote
2 answers
2k views

Local file inclusion to RCE

Here is the code: <?php $file=trim($_GET['img_name']); //echo $file; if (file_exists($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'...
Dangu OP's user avatar
0 votes
1 answer
193 views

Attack Web Forms dvwa to achieve lfi

Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server? Is there a endpoint to hit for this? ...
JShee's user avatar
  • 1
0 votes
1 answer
587 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
KJ202's user avatar
  • 1
6 votes
3 answers
3k views

Can there be a way to exploit PHP include_once() when the input is filtered?

Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice): $input = addslashes($_GET["input"]); if (strpos($input, '../') === false) { ...
user avatar