FiPloit

Local File Inclusion (LFI) and insecure file upload vulnerabilities are among the most common and dangerous flaws found in PHP web applications. LFI allows attackers to read arbitrary files from the server by manipulating file path parameters, while insecure file upload mechanisms can be exploited to place malicious code on the server. When combined, these vulnerabilities create a devastating attack chain that progresses from information disclosure to remote code execution and complete system compromise.

Understanding Local File Inclusion

Local File Inclusion occurs when a PHP application uses user-controllable input in file inclusion functions like include(), require(), or file_get_contents() without proper validation. A vulnerable URL pattern like page.php?file=about.html can be exploited by changing the parameter to page.php?file=../../../../etc/passwd, using directory traversal sequences to navigate the file system and read sensitive files. Common targets include /etc/passwd for user enumeration, /etc/shadow for password hashes, application configuration files containing database credentials, and log files that can be poisoned for code execution.

Advanced LFI techniques include PHP filter wrappers like php://filter/convert.base64-encode/resource= for reading PHP source code, null byte injection in older PHP versions to bypass extension appending, and log poisoning where malicious PHP code is injected into server logs and then included through the LFI vulnerability to achieve code execution.

Insecure File Upload Exploitation

File upload vulnerabilities arise when applications fail to properly validate uploaded files. Common bypass techniques include changing the Content-Type header to an allowed MIME type, using double extensions like shell.php.jpg, exploiting null bytes in filenames, and uploading files with alternative PHP extensions like .phtml, .php5, or .pht. Once a web shell is successfully uploaded, the attacker can execute commands, enumerate the server, and pivot to other systems.

Defending Against File-Based Attacks

Prevention requires input validation using allowlists for file inclusion parameters, storing uploads outside the web root, renaming uploaded files to random names, validating file content rather than just extensions, and implementing proper file permissions. Web Application Firewalls can detect common LFI patterns but should not be the sole defense.