File Inclusion
Dr. Digvijaysinh Rathod
Assistant Professor
Gujarat Forensic Sciences University
Description
• The File Inclusion vulnerability allows an attacker to include a
file, usually exploiting a "dynamic file inclusion" mechanisms
implemented in the target application. The vulnerability occurs
due to the use of user-supplied input without proper validation.
• This can lead to something as outputting the contents of the
file, but depending on the severity, it can also lead to:
– Code execution on the web server
– Code execution on the client-side such as JavaScript which can lead to
other attacks such as cross site scripting (XSS)
– Denial of Service (DoS)
– Sensitive Information Disclosure
Local File Inclusion
• Local File Inclusion (also known as LFI) is the process of
including files, that are already locally present on the server,
through the exploiting of vulnerable inclusion procedures
implemented in the application.
• This vulnerability occurs, for example, when a page receives,
as input, the path to the file that has to be included and this
input is not properly sanitized, allowing directory traversal
characters (such as dot-dot-slash) to be injected.
• Although most examples point to vulnerable PHP scripts, we
should keep in mind that it is also common in other
technologies such as JSP, ASP and others.
Local File Inclusion
• Since LFI occurs when paths passed to "include" statements
are not properly sanitized, in a blackbox testing approach, we
should look for scripts which take filenames as parameters.
• Consider the following example:
• [Link]
• This looks as a perfect place to try for LFI. If an attacker is
lucky enough, and instead of selecting the appropriate page
from the array by its name, the script directly includes the
input parameter, it is possible to include arbitrary files on the
server.
• Typical proof-of-concept would be to load passwd file:
• [Link]
Local File Inclusion : Perfect Place
• At Two places
1. [Link]
2. [Link]
• Now what to include in page or file parameter you can
understand with practical examples
Local File Inclusion - DVWA
• Open DVWA
• Security -> low
• Click on File Inclusion
• Click on file1
• Check URL
• [Link]
• Check source code
Local File Inclusion - DVWA
• <?php
• // The page we wish to display
• $file = $_GET[ 'page' ]; // input is not validated or filtered
• ?>
• Try to access [Link]
– [Link]
– host/dvwa/vulnerabilities/fi/?page=../../[Link]
– localhost/dvwa/vulnerabilities/fi/?page=\
Local File Inclusion - DVWA
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
• // may not work
• [Link]
• // work
• [Link]
• [Link]
• // list of disallow ftp users
• [Link]
• [Link]
• May not work
Local File Inclusion - DVWA
• Try to include index page of another web site
• [Link]
dvwa/vulnerabilities/brute/
• [Link]
localhost/dvwa/vulnerabilities/fi/?page=../../[Link]
Local File Inclusion - DVWA
• Very often, even when such vulnerability exists, its exploitation is a bit
more complex. Consider the following piece of code:
• <?php “include/”.include($_GET['filename'].“.php”); ?>
• In the case, simple substitution with arbitrary filename would not work
as the postfix 'php' is appended. In order to bypass it, a technique with
null-byte terminators is used.
• Since %00 effectively presents the end of the string, any characters
after this special byte will be ignored. Thus, the following request will
also return an attacker list of basic users attributes:
• [Link]
Remote File Inclusion