Questions tagged [local-file-inclusion]

Local File Inclusion (also known as LFI) allows an attacker to include files in server-side through the web browser. LFI is commonly found to affect web applications that rely on a scripting runtime. This occurs mainly due to a bad input validation mechanism, wherein the user’s input is passed to the file include commands without proper validation.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
79 views

How to prevent absolute path traversal in EasyPHP Webserver 14.1 [closed]

In the EasyPHP Webserver 14.1 software, there is an Absolute Path Traversal vulnerability in the dashboard index.php page. https://www.exploit-db.com/exploits/51430 I reviewed the source code and ...
luminare's user avatar
  • 101
0 votes
2 answers
302 views

Is this PHP code vulnerable to LFI?

I'm currently learning about LFI attacks. I have coded a simple example and tried to get the content of secrets.txt with an unsafe input ($_GET['extension']). I have tried the following payloads with ...
kokitax's user avatar
  • 13
0 votes
2 answers
519 views

LFI to RCE in java EE Application

I found vulnerable end-points in my university's old portal. It should not be accessible but I found it somehow. -> First end-point allows me to upload any kind of file on following path : /home/...
Abu Bakar's user avatar
1 vote
0 answers
166 views

Is this a LFI vulnerability?

I'm playing with uploads, so I'm wondering if this route is safe to use, because if you somehow break off from the md5 function path, then you can control the path (if in TypeScript null byte is a ...
Kiwi501987's user avatar
1 vote
0 answers
136 views

Any Windows/NTFS trick to ignore/cancel out a file extension from a path?

I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call: File.Open("C:\Resources\"+resName+".res&...
PenetrationTester's user avatar
0 votes
1 answer
280 views

Is this really a way to filter LFI?

I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd. Is it possible to bypass in_array function? <?php $...
Kiwi501987's user avatar
0 votes
1 answer
3k views

PHP 7.4.3 preg_match bypass

I want to filter user input like this: $data = file_get_contents('php://input'); if ($data != null && $data !=='') { $parsedData = json_decode($data, true); } // find quickmodule name $...
The Modern Gamer's user avatar
2 votes
2 answers
368 views

File inclusion exposed passwords

I am confused about LFI where I have seen many broken web-app demos demonstrate LFI where they traverse to a directory similar to /etc/passwd. How are these passwords being stored exactly? I do not ...
Krellex's user avatar
  • 197
2 votes
0 answers
171 views

Does Windows Server ship with any sensitive images in the filesystem?

I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
Daniel's user avatar
  • 21
0 votes
2 answers
446 views

How does Local File Inclusion (LFI) work?

In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
CBCH's user avatar
  • 15
0 votes
2 answers
2k views

Bypass Local File Inclusion(LFI) prevention filters

I have these two LFI filters and i want to bypass them $bad = str_replace('../','',$_GET['bad']); while( substr_count($bad, '../', 0)) { $bad = str_replace('../', '', $bad);...
Mike Anast's user avatar
3 votes
2 answers
8k views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
eyal's user avatar
  • 73
0 votes
1 answer
933 views

Log poisoning prevention in the context of LFI

Back in the day, mostly, such injections were taking place over the server log files. Such files are the Apache error log, the Access log and more. Techniques like these have been used for years and, ...
cyzczy's user avatar
  • 1,568
2 votes
2 answers
8k views

LFI filter bypass

$patterns[0] = '/[^[:print:]]+/'; // remove non-printable characters $patterns[1] = '/[ \t]+$/'; // remove whitespace at end of string $patterns[2] = '/^[ \t]+/'; // remove whitespace at ...
David's user avatar
  • 95
0 votes
2 answers
365 views

Path traversal limited

I trying to pentest website. I know that there are files named "file1" and "file2". The server is nginx. So I did this test: http://example.com/file1..%2ffile2 => 404 http://...
Mosa Salman's user avatar
1 vote
2 answers
964 views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
7_R3X's user avatar
  • 646