Tips for Exploiting Local File Inclusion (LFI) Vulnerabilities

Local File Inclusion (LFI) is a common web vulnerability that allows an attacker to include files from the server’s file system through vulnerable parameters in a URL. Understanding how to effectively test and exploit LFI vulnerabilities is essential for penetration testers, bug bounty hunters, and security researchers.

This article summarizes important considerations and techniques when dealing with LFI exploitation.

1. Common Files to Test

When you suspect that a parameter in a URL is vulnerable to LFI, start by attempting to include commonly accessible system files:

• System user information: /etc/passwd

• Authentication logs: /var/log/auth.log

• Web server access logs: /var/log/apache2/access.log

If the target server is running additional services, such as email, you may also want to test service-specific files:

• Mail files: /var/mail/<username>

Testing these files can help confirm the vulnerability and, in some cases, expose sensitive information.

2. Directory Traversal

If accessing the file directly does not return content, it may be necessary to prepend directory traversal sequences to bypass restrictions: