Local File Inclusion

Local File inclusion (LFI) refers to an inclusion attack. An attacker can trick the online application in including files on the online server. The attacker does this by exploiting functionality that dynamically includes native files or scripts. The consequence of a successful LFI attack. It includes Directory Traversal and information revealing also as Remote Code Execution.

This server allows an attacker to include a file, usually exploiting a “dynamic file inclusion” mechanisms implemented in the target application. This is due to the use of user-supplied input without proper validation.

Example

        /**
        * Get the filename from a GET input
        * Example - https://www.example.beaglesecurity.com/?file=filename.php
        */
        
        $file = $_GET['file'];
        
        /**
        * Unsafely include the file
        * Example - filename.php
        */
        include('directory/' . $file);

    

Impact

• Intrution attack

  Mitigation / Precaution

• Avoid passing user-submitted input to any file system/framework API
• Maintain a white list of files, that include page, and use an identifier to access to the selected file.Invalid identifier has to be rejected

Written by

Febna V M

Cyber Security Engineer

Febna once spent an entire evening arguing with an AI chatbot just to prove that machines can be confidently wrong. The debate ended with no clear winner, but it did spark her curiosity for the fascinating world of artificial intelligence. Today, she works at the intersection of AI and cybersecurity, helping build smarter systems while making sure they don’t become too smart for their own good. When she’s not exploring the future of technology, she’s probably asking “but what if?” one more time.