File inclusion
Last updated
Was this helpful?
Last updated
Was this helpful?
Many web applications manage files and use server-side scripts to include them. When input parameters (cookies, GET or POST parameters) used in those scripts are insufficiently validated and sanitized, these web apps can be vulnerable to file inclusion.
LFI/RFI (Local/Remote File Inclusion) attacks allow attackers to read sensitive files, include local or remote content that could lead to RCE (Remote Code Execution) or to client-side attacks such as XSS (Cross-Site Scripting).
(a.k.a. path traversal, directory climbing, backtracking, the dot dot slash attack) attacks allow attackers to access sensitive files on the file system, outside the web server directory. File inclusion attacks can leverage a directory traversal vulnerability to include files with a relative path.
Testers need to identify input vectors (parts of the app that accept content from the users) that could be used for file-related operations. For each identified vector, testers need to check if malicious strings and values successfully exploit any vulnerability.
Local File Inclusion: inclusion of a local file (in the webserver directory) using an absolute path
LFI + directory traversal: inclusion of a local file (in the webserver directory or not) by "climbing" the server tree with ../ (relative path)
Remote File Inclusion: inclusion of a remote file (not on the server) using a URI
The tool (Perl) can help in finding and exploiting directory traversal vulnerabilities by fuzzing the web app. However, manual testing is usually more efficient.
The tool (C) can help in finding and exploiting File Inclusion vulnerabilities. However, manual testing is usually more efficient.
Depending on the environment, file inclusions can sometimes lead to RCE (Remote Code Execution) by including a local file containing code previously injected by the attacker or a remote file containing code that the server can execute.
Local file inclusions can sometimes be combined with other vulnerabilities to achieve code execution
directory traversal
null-byte injection
unrestricted file upload
log poisoning
Once an attacker is able to execute code on a target, testing the limitations of that code execution can help to go from code execution (e.g. PHP, ASPX, etc.) to command execution (e.g. Linux or Windows commands).
With PHP as example, the tester can create a phpinfo.php containing <?php phpinfo(); ?> and use a simple HTTP server so that the target application can fetch it. When exploiting the RFI to include the phpinfo.php file, the tester server will send the plaintext PHP code to the target server that should execute the code and show the phpinfo in the response.
If the tester server used to host the phpinfo.php file can interpret PHP, it will. The tester will not achieve code execution on the target server but on his own instead. A simple HTTP server will do.
If the phpinfo has been successfully printed in the response, the tester can engage a more offensive approach by trying to execute commands with one of the following payloads.
