File Inclusion Report
pg. 1
File Inclusion Report
TABLE OF CONTENT
1. Prerequisites ............................................................................................................. 3
1.1 The tech-stack functions ...................................................................................... 3
1.2 PHP Wrappers ...................................................................................................... 3
2. What is File Inclusion Vulnerabilities ? ........................................................................ 5
2.1 Types of File Inclusion Vulnerability ....................................................................... 5
2.2 Impact of File Inclusion Vulnerabilities................................................................... 5
3. File Inclusion Vulnerability Practical ............................................................................ 6
3.1 Most simple Local File Inclusion ............................................................................ 6
3.2 File Inclusion (using Path traversal) ........................................................................ 7
3.3 File Inclusion (Filename prefix bypass) ................................................................... 8
3.4 File Inclusion (Denied Path Traversal using Filters) .................................................. 9
3.5 File Inclusion (Regex Filters) ................................................................................ 11
3.6 Most simple Remote File Inclusion to RCE ........................................................... 11
4. Advanced File Inclusion attacks ................................................................................ 13
4.1 PHP wrapper (filter) ............................................................................................. 14
4.2 RCE using (data:// wrapper) ................................................................................. 14
4.3 RCE using (PHP Wrapper (INPUT))........................................................................ 15
4.4 RCE using (zip wrapper) (Combination of File Upload and LFI to RCE) .................... 16
4.5 RCE using (PHAR wrapper) .................................................................................. 17
5. Mitigation................................................................................................................. 19
6. Conclusion .............................................................................................................. 20
pg. 2
File Inclusion Report
1. Prerequisites
1.1 The tech-stack functions
Read Remote
Function Execute Description
Content URL
PHP
include()/ These functions execute a PHP file at
include_once() runtime. include_once() prevents
multiple inclusion of same file.
require()/ These are same as above the only
require_once() difference is in the error handling.
file_get_contents Read the raw contents of remote/local
() file.
fopen()/file() It can only read the content of local file.
NodeJS
[Link]() Read the raw content of remote file.
[Link]() Render a template using a template
engine.
Java
include Include another JSP during page
rendering.
import Used to load java classes or external
things.
.NET
@[Link]() Load Local content
@[Link] Can load local and partial content from
artial() remote/local endpoint.
1.2 PHP Wrappers
PHP wrappers are built-in code libraries that tell PHP’s stream functions (like fopen(),
file_get_contents(), etc.) how to handle different protocols, data sources and encodings. It
provides a unified way to work with various data streams.
pg. 3
File Inclusion Report
Wrapper Description
Accesses the local file system (this is the default if no wrapper is
file://
specified).
http:// & Makes HTTP(s) requests to remote web server.
https://
ftp:// Accesses files on an FTP server.
Provides access to various internal I/O streams and filters. (e.g.,
php://
php://input, php://filter) and allows execution.
Allows embedding data directly within the URI itself, often using Base64
data://
encoding and executes directly into the memory.
zip:// Accesses files within a ZIP archive.
phar:// PHP archive files (can be abused if not secured).
expect:// Execute system commands.
pg. 4
File Inclusion Report
2. What is File Inclusion Vulnerabilities ?
File Inclusion is a web application vulnerability that occurs when an application
dynamically loads or executes files based on user-controlled input without proper
validation. This vulnerability only allows to read or execute existing files.
2.1 Types of File Inclusion Vulnerability
1. Local File Inclusion (High chances)
• Local File Inclusion (LFI) is a web application vulnerability that occurs when
an application includes or reads files from the local server filesystem based
on user-controlled input, without proper validation or sanitization.
2. Remote File Inclusion (Less chances)
• .Remote file inclusion (RFI) is a web application vulnerability where an
application includes an executes a file hosted on a remote server, fully
controlled by the attacker.
• It may result in immediate remote code execution and requires a specific
configuration (e.g., PHP allow_url_include).
2.2 Impact of File Inclusion Vulnerabilities
1. Sensitive Information Disclosure
• Attacker can read configuration files, database credentials, API keys and
source code.
2. Source code disclosure
• Reading application source file allows attackers to understand business logic,
identify hardcoded secrets and find additional vulnerabilities.
3. Remote Code Execution (RCE)
• File inclusion can lead to code execution via log poisoning, session poisoning,
File upload + include etc.
4. Secondary attack
• File inclusion often enables SSRF, Credential abuse and lateral movement.
pg. 5
File Inclusion Report
3. File Inclusion Vulnerability Practical
3.1 Most simple Local File Inclusion
3.1.1 Target
3.1.2 Functionality
Whenever we select a language, we can see that the php file page changes in the URL.
Now on analyzing the provided source code we can understand that it is retrieving and
executing files directly provided to the language parameter.
include($_GET[‘language’]);
3.1.3 Exploitation
Thus, to exploit this type of vulnerability we can simply add /etc/passwd because there is
no any prefix or suffix in the include function and thus it will directly render the required file
as seen in the below image.
pg. 6
File Inclusion Report
3.2 File Inclusion (using Path traversal)
3.2.1 Target
3.2.2 Functionality
We have the same functionality as in the previous lab, where we were able to fetch specific
language PHP files accordingly. However, in this case, the source code has been modified
and forcibly restricted to include files only from the ./languages directory.
include(“./langauges/”.$_GET([‘language’]);
pg. 7
File Inclusion Report
3.2.3 Exploitation
Thus, adding any file will be opened only from `./languages`. E.g., (/etc/passwd =>
./languages/etc/passwd) which is invalid as in the below image.
We can easily bypass this restriction by traversing directories using relative paths. To do
so, we can add ../ before our file name, which refers to the parent directory.
3.3 File Inclusion (Filename prefix bypass)
We’ve the same type of target and functionality as in the previous labs the only difference
is in the source code behind the logic of the inclusion. This time the source code is
changed to something like this.
include(“lang_”.$_GET[‘language’]);
Thus, if we add anything to the language parameter it will get a prefix of `lang_`
automatically.
pg. 8
File Inclusion Report
3.3.1 Exploitation
Thus, even using directory traversal method we’re unable to fetch our intended file.
Thus, what we can do is we can prefix a `/` before our payload, and this should consider
the prefix as a directory, and then should bypass the filename and be able to traverse
directories.
3.4 File Inclusion (Denied Path Traversal using Filters)
3.4.1 Target
3.4.2 Functionality
Now there are filters to prevent directory traversal by amending the source code.
$language=str_replace(‘../’, “”, $_GET[‘language’]);
include($_GET[‘language’]);
pg. 9
File Inclusion Report
3.4.3 Exploitation
Yes, it is removing `../` but it is not recursively removing the `../` substring and thus we
can modify the input string to get our intended result by using `…//`
Thus it will remove `../` in the substring which instead concatenate remaining string and
again it becomes `../`.
Method – 2 : Encoding
We can URL encode the `../` character and send it in the browser and we can see the
same result
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77
%64 ➔ ../../../../etc/passwd
pg. 10
File Inclusion Report
3.5 File Inclusion (Regex Filters)
We’ve the same kind of target and functionality as provided in the above labs.
Some web applications may also use Regular Expressions to ensure that the file being
included is under a specific path. For example, the web application we have been dealing
with may only accept paths that are under the ./languages directory, as follows:
if(preg_match('/^\.\/languages\/.+$/',
$_GET['language'])) {
include($_GET['language']);
} else {
echo 'Illegal path specified!';
}
3.5.1 Exploitation
3.6 Most simple Remote File Inclusion to RCE
3.6.1 Target
pg. 11
File Inclusion Report
The backend PHP code is:
include($_GET[‘language’]);
One more thing modified in the [Link] file is this line `allow_url_include=On`. This line
allows us to include remote URL in the function.
3.6.2 Exploitation
We’ve added `<?php phpinfo();?>` as the code in [Link].
pg. 12
File Inclusion Report
4. Advanced File Inclusion attacks
Common target for all exercise ahead is inlanefreight (HTB) & DVWA
No security is in place and allow_url_include is set to On which is required for all the
below wrappers used.
pg. 13
File Inclusion Report
4.1 PHP wrapper (filter)
PHP filters are a type of PHP wrapper, where we can pass different types of input and have
it filtered by the filter we specify.
4.2 RCE using (data:// wrapper)
With allow_url_include we can proceed with our data wrapper attack. It can be used
to include external data, including PHP code. It feeds code directly into PHP memory.
Example in DVWA
pg. 14
File Inclusion Report
4.3 RCE using (PHP Wrapper (INPUT))
Note: To pass our command as a GET request, we need the vulnerable function to also
accept GET request (i.e. use $_REQUEST). If it only accepts POST requests, then we can
put our command directly in our PHP code, instead of a dynamic web shell (e.g. <\?php
system('id')?>)
Example in DVWA
pg. 15
File Inclusion Report
4.4 RCE using (zip wrapper) (Combination of File Upload and LFI to RCE)
DVWA Example
For ease of exploitation, I’ve moved [Link] to desired folder.
pg. 16
File Inclusion Report
File path exploitation using file from the uploaded location. Finally done .
4.5 RCE using (PHAR wrapper)
Thus, we’re going to create a new phar file and add our payload inside it.
<?php
$phar = new Phar('[Link]');
$phar->startBuffering();
$phar->addFromString('[Link]', '<?php
system($_GET["cmd"]); ?>');
$phar->setStub('<?php __HALT_COMPILER(); ?>');
$phar->stopBuffering();
This script can be compiled into a phar file that when called would write a web shell to
a [Link] sub-file, which we can interact with. We can compile it into a phar file and rename it
to [Link] as follows:
pg. 17
File Inclusion Report
pg. 18
File Inclusion Report
5. Mitigation
1. Avoid Dynamic File Inclusion Based on User Input
• Do not pass user-controlled input directly to include, require, render, or similar
functions
• Replace dynamic inclusion with static includes wherever possible
• Design application flow without user-selected file paths
2. Use Strict Allowlisting
• Maintain a predefined list of allowed files or language options
• Map user input to internal filenames instead of using it directly
• Reject any value not explicitly defined in the allowlist
3. Validate and Normalize File Paths
• Resolve the full filesystem path using canonicalization (realpath)
• Ensure the resolved path starts with the intended base directory
• Block path traversal sequences such as ../ after normalization
4. Enforce File Extension Restrictions
• Allow only specific extensions (e.g., .php, .html)
• Reject files with double extensions or unexpected formats
• Prevent inclusion of configuration, log, or binary files
5. Disable Remote File Inclusion
• Disable PHP settings like allow_url_include and allow_url_fopen
• Prevent inclusion of files over HTTP, FTP, or other protocols
• Restrict use of stream wrappers unless absolutely required
6. Apply Least-Privilege File Permissions
• Ensure application directories are not writable by the web server
• Separate upload directories from executable directories
• Prevent attackers from placing malicious files in includable paths
pg. 19
File Inclusion Report
7. Separate File Upload and Execution Paths
• Never include files from user-uploaded directories
• Store uploaded files outside the web root
• Disable script execution in upload directories
8. Use Secure Framework Rendering Mechanisms
• Use framework-provided view resolvers instead of manual includes
• Avoid rendering templates based on raw user input
• Enforce framework-level path restrictions
9. Implement Proper Error Handling
• Do not expose detailed error messages to users
• Suppress path and stack trace information in production
• Log errors securely for internal review only
6. Conclusion
File inclusion vulnerabilities arise when an application dynamically loads files based on
untrusted user input, allowing attackers to access unintended local or remote resources. If
left unprotected, such flaws can lead to serious consequences including sensitive
information disclosure, source code leakage, authentication bypass, and even remote
code execution through exploit chaining techniques. Although developers often attempt to
mitigate these issues using basic input validation, improper path handling and unsafe
inclusion logic frequently leave applications exposed. Preventing file inclusion
vulnerabilities requires a secure design approach that avoids user-controlled file paths,
enforces strict allowlisting, validates resolved file locations, and applies least-privilege
permissions. When properly addressed, these measures significantly reduce the risk of full
system compromise and strengthen the overall security posture of web applications.
pg. 20
File Inclusion Report
pg. 21