LFI & RFI
Local File Inclusion
Directory traversal is used to read the contents of a file outside of the web serverās web root. File inclusion vulnerabilities allow us to include a file in the applicationās running code allowing use to execute local or remote files
Log Injection
Display contents of a log file (if dir traversal is present)
It should have something like the following
We can then edit the User-Agent to the following in Burp for RCE
Now when we request the access log and add our command with the cmd parameter it will execute
Windows apache logs located at C:\xampp\apache\logs\
Remote File Inclusion
Same concept as LFI except with remote files that can be accessed over HTTP or SMB. The allow_url_include options needs to be enabled within the PHP application to leverage this.
Last updated