📖 What is Local File Inclusion (LFI)?
Local File Inclusion (LFI) is a vulnerability where a web application allows an attacker to include files that are already present on the local server. This can lead to the disclosure of sensitive configuration files or remote code execution.
"LFI is often the first step in a 'log poisoning' attack, where the attacker injects code into a log file and then includes that file via LFI."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Local File Inclusion (LFI)?
- ▸ Path traversal sequences, such as '../', are used to break out of the application's root directory to access restricted system files.
- ▸ Common targets for confirmation include /etc/passwd on Linux systems or win.ini on Windows to prove the ability to read arbitrary files.
- ▸ PHP wrappers, like php://filter, can be used to encode file contents in base64, allowing attackers to read source code without executing it.
- ▸ Log poisoning involves injecting a web shell into server logs, which are then executed when the attacker includes the log file via LFI.
- ▸ The vulnerability typically stems from improper input validation in functions that dynamically include files based on user-supplied parameters.
🎯 How does Local File Inclusion (LFI) appear on the PT0-002 Exam?
You may be asked to identify a vulnerability after seeing a URL parameter like '?page=contact.php' that allows the retrieval of /etc/passwd when modified with directory traversal sequences.
A scenario might describe an attacker who has successfully achieved LFI but needs to escalate to Remote Code Execution (RCE) by manipulating the Apache access logs through log poisoning.
Expect questions about the effectiveness of input whitelisting versus blacklisting when mitigating LFI, specifically focusing on how attackers bypass simple filters using null byte injections or URL encoding.
❓ Frequently Asked Questions
What is the primary difference between Local File Inclusion (LFI) and Remote File Inclusion (RFI)?
LFI involves including files already present on the local filesystem, while RFI allows an attacker to include a file from an external server. RFI is generally more dangerous as it leads to immediate RCE.
How can an attacker use PHP wrappers to enhance an LFI attack?
Attackers use wrappers like 'php://filter' to read the source code of PHP files in base64 format. This prevents the server from executing the code, allowing the attacker to analyze the logic for further vulnerabilities.